Questions tagged [winapi]
Microsoft's application programming interfaces available in the Windows operating system.
84
questions
5
votes
1
answer
292
views
Why is function in kernel32.dll jumping into a api-ms-win-core stub
I was trying to look into the implementation of GetVersion function in kernel32.dll.
I was surprised to see that the GetVersion thunk is issuing a jump to API-MS-WIN-CORE-SYSINFO-L1-1-0.DLL::...
CommunityBot
- 1
2
votes
0
answers
363
views
How to hack fan control speed?
So I recently bought a new laptop (Acer Aspire A315-57g) on which I found that the cooling solution wasn't optimal, and I decided that I want more RPMs from my fan. However, I wasn't able to find a ...
1
vote
2
answers
155
views
Identifying file-access functions used by explorer.exe
I'm trying to write a Windows 10 64-bit rootkit that runs on userland and hides files using IAT hooking. I managed to accomplish that on cmd.exe by hooking FindFirstFileW and FindNextFileW imported ...
- 16.3k
3
votes
1
answer
137
views
Are win32api calls differentiable from real actions?
I've been tinkering with the win32api library on Python and interacting with Notepad. I now want to try it on an online game to automate some boring tasks but I'm scared I get banned for this.
Is for ...
- 459
4
votes
0
answers
83
views
API Breakpoints not hitting while debugging a malware using x32dbg
I have been having a really strange issue which I have tried all ways to troubleshoot from my end but was not successful.
I am going through a malware analysis course and following the debugging ...
- 41
2
votes
0
answers
43
views
Redirect exception handler?
I'm working on a localization project and have a few trampoline hooks to translate some text in an online game. Periodically throughout gameplay, there are checks that run in the background to ensure ...
1
vote
1
answer
786
views
How to disassemble an entire function in Windbg?
I am trying to disassemble the function ExAcquireFastMutex using WinDbg but it gives me only 8 rows:
3: kd> u nt!ExAcquireFastMutex
nt!ExAcquireFastMutex:
fffff805`456e3820 4053 push ...
- 16.3k
1
vote
0
answers
88
views
How to get the call stack of WinAPI functions?
Yesterday, I noticed an answer to a question about the purpose of a certain undocumented function, which is a call stack (including the DLL library) for this function, This got me interested in the ...
- 115
4
votes
2
answers
1k
views
finding a RC4 Encryption function in obfuscated assembly code with no symbols
RC4 encryption is quite basic and its Pseudo random generation algorithm is given at Wikipedia
When Looking for a hashing algorithm like MD5 or SHAx it is pretty simple to look for the Hashing ...
- 326
3
votes
0
answers
190
views
Why can't I view certain USER32.dll API calls in the disassembly?
I'm trying to understand and patch the GUI in Microsoft Edge. When I look at the disassembly in 2 different debuggers (x64dbg and cutter), the API calls responsible for much of the GUI functionality ...
- 459
3
votes
1
answer
4k
views
What is the difference between kernelBase.dll and Kernel32.dll
What is the difference between kernelBase.dll and Kernel32.dll in system32 folder ?
Why both of them implement WideCharToMultiByte ?
- 1
2
votes
0
answers
115
views
Frida hook InsertMenuItemW
I'm trying to get information about menu items in an application. Experimentally established that InsertMenuItemW is called. Thanks to the documentation, I set the number of input parameters and wrote ...
- 65
1
vote
1
answer
66
views
funcion calls extern function without body
I wanted to look at how does the Windows API get the size of a file, so I opened kernel32.dll in a disassembler. I searched for GetFileSizeEx, and it seems to call a stub(?), but the disassembler ...
CommunityBot
- 1
0
votes
1
answer
2k
views
How do I get all sections in a PE file using C++?
So I am wondering how can I get all sections and their info from a dumped PE file on the disk, using C++.
I have the entire PE loaded on a buffer, the NT headers, and hopefully the DOS headers.
I need ...
- 16.3k
3
votes
0
answers
119
views
WinApi of UWΡ Shаdοws
I want to ask which WinApi methods being used to draw shadows under flyouts on UWΡ.
What I know:
This shаdοw disappearing when hiding flyout (via SW_HIDE), but it stays if we one hide it using ...
- 1,120
0
votes
1
answer
201
views
CreateFileA returning invalid handle when file exists
I was working on a practice binary. It opens the file at C:/WINDOWS/system32/filename#123.dat, if the file does not exist, the check compares the result to -1 (An invalid handle). However, even after ...
CommunityBot
- 1
0
votes
1
answer
631
views
Windows User Identification / HWID Limiting
I've been playing a game that has an HWID limit and a bunch of other limitations, such as:
a) Cannot be ran in a VM
b) Cannot be ran using Sandboxie and other Sandbox environments
c) Limits 3 ...
CommunityBot
- 1
10
votes
1
answer
3k
views
Anti-debugging techniques - Preventing me from setting a memory and hardware breakpoint. How can I bypass that?
I'm debugging this process which has a lot of anti debugging techniques in it, and I faced something new which I don't know how to bypass yet.
Changing the code dynamically causes exceptions to occur ...
- 1,120
1
vote
1
answer
140
views
Is there any way to watch a block of memory of the current process for change?
I'm looking for a way to get notified when some block of memory of the current process change.
To be more specific, I want to track when some fields of a struct change.
Let's say I have one instance ...
- 16.3k
1
vote
0
answers
298
views
Windbg memory access error when trying to edit a string value of a button
So i was trying to edit the string value of a button as a debugging practice using windbg. I'm still a complete novice in reverse engineering and debugging, when i try to edit the string value using ...
- 21
3
votes
0
answers
271
views
How to disassemble win32 function RegSetValueExW?
I have opened up advapi32.dll in IDA and found out that RegSetValueExW is just a jump to RegSetValueExW_0. And RegSetValueExW_0 seems to be an extern.
How do I actually disassemble RegSetValueExW_0?
- 131
2
votes
1
answer
2k
views
Extracting strings from binary files (.exe)
This question has been asked quite a lot especially on stackoverflow, but the solutions/replies are not clear or extensive.
What I`m looking for is to build what Strings does from Sysinternals. My ...
- 915
2
votes
1
answer
269
views
How to find sleep() in ollydbg or IDA or ghidra
I have a program which converts videos from a proprietary format into mp4.
The conversion is very slow and CPU utilization is less than 1%.
I'm able to speed up the conversion process via Cheat Engine'...
- 356
7
votes
2
answers
4k
views
Can a Windows process check if it has been injected by another process?
There are many tutorials which show how to detect injected code into process memory. However, this generally requires using a debugger.
Is it possible for a process to somehow detect if it has been ...
0
votes
1
answer
115
views
How can a debugger break on dynamic loaded libraries?
I think I have a massive understanding problem with the following issue:
Usually the loader will fix the Import Table for the modules that have been loaded, right, so if I set a breakpoint on ...
- 36.4k
0
votes
1
answer
553
views
which is harder to reverse engineer? [closed]
I'm planning on writing a windows application, used everywhere in my home country. I will code it in C++, but my question is which would you consider better to use?
win32api
Visual C++
MFC
I'm ...
- 169
0
votes
1
answer
190
views
Debugging Encrypted Malware with Multiple Threads
What is the best approach when debugging a multithreaded program that is yet to be encrypted? Where is the best place to put Breakpoints using Ollydbg?
- 96
1
vote
2
answers
60
views
In the context of the Windows API, what extra information do the debugging symbols provide that the export table doesnt provide?
Take for example, 'kernel32.dll', the export table already provides the list of exported functions, then in what use case, would I need to download the debugging symbols for it from the MS symbol ...
- 16.3k
3
votes
1
answer
1k
views
Finding AddressOfEntryPoint for a 64-bit process
Okay, so in the following code-snippet I am starting a notepad.exe process in a suspended state and trying to get the AddressOfEntryPoint of the process. Problem is I can't seem to find the actual ...
- 696
3
votes
1
answer
334
views
CreateTimerQueueTimer arguments differs from WinAPI
I was reading a man page about CreateTimerQueueTimer.
BOOL CreateTimerQueueTimer(
PHANDLE phNewTimer,
HANDLE TimerQueue,
WAITORTIMERCALLBACK Callback,
PVOID ...
CommunityBot
- 1
0
votes
1
answer
352
views
How to call WinApi from a breakpoint in IDA Pro?
When I'm stepping through a debuggee process with IDA+WinDbg (as a debugger), I need to track one parameter by executing the following API (from within the breakpoint):
//C++ code
SCROLLINFO s;
s....
- 36.4k
2
votes
1
answer
244
views
Missing Symbols RtlGetFrame, RtlPushFrame, RtlPopFrame
I'd like to use some undocumented symbols that listed in ProcessHacker project. taken from Here:
https://github.com/processhacker/processhacker/blob/master/phnt/include/ntpebteb.h#L241
https://...
- 10.9k
3
votes
1
answer
224
views
GetWindowLongPtr with undocumented nIndex of -1
I'm trying to reverse functionality of scrollbars in comctrl32.dll and I keep witnessing them calling GetWindowLongPtr function with undocumented index -1 as such:
Does anybody know what that ...
- 1,639
1
vote
1
answer
2k
views
x64dbg how to set conditional breakpoint on WinAPI function
I am trying to solve a GUI based crackme. https://crackmes.one/crackme/5c68758633c5d4776a837cc4 so that I learn security. I want to set a conditional Break point on user32.CallWindowProcA. Microsoft ...
CommunityBot
- 1
1
vote
1
answer
722
views
Injecting exe file into process fails on windows 7 but works on windows 10 / Execution library function fails, access denied
I'm trying to inject my executable payload into remote process.
I allocated memory in remote process, I converted raw payload using RVA addressing. I applied relocations and imports table.
When I'm ...
- 10.9k
3
votes
0
answers
292
views
int 2eh instead of syscall/sysenter [duplicate]
I have been looking into ntdll.dll on windows 10 x64 bit, and i noticed a check inside the ntdll like this:
So after testing some bit, it tries to execute the system call via int 2eh. I have tried to ...
1
vote
0
answers
526
views
Calling undocumented kernel functions directly (xxxSendInput and xxxMouseEventDirect)
In the core my question is about how to reverse engineer undocumented functions.
I want to call the function "xxxMouseEventDirect" (located in win32kfull.sys). I have already been able to collect some ...
- 11
3
votes
3
answers
1k
views
How to debug ServiceMain function of a service?
I have a malware which is checking for keyboard type and locale information.
After that, it creates a service with BinaryPathName as malware's exe address. After creating a service, malware starts it ...
- 161
0
votes
2
answers
335
views
Can benign applications have such APIs?
I am new to malware analysis .. and I was analyzing some 'windows' apps and found functions that I thought it exist only on malware, is this possible or there is something wrong with my analysis ?
I ...
- 89
2
votes
1
answer
661
views
Missing kernel32.dll in import table
I have very basic application which is console app dispaying message box.
In Visual Studio I change following options:
- C/C++ -> SecurityCheck -> Disable Security Check (/GS-)
- Linker -> ...
- 1,652
3
votes
1
answer
2k
views
How to debug slow Windows API calls?
My machine at work has recently been updated to Windows 10, from Windows 7, and it has become incredibly slow. The IT has installed a bunch of new tools for security and protection after the upgrade ...
- 36.4k
2
votes
1
answer
680
views
How to see ReadFile results with ProcMon
I running procmon to monitor my process, and see that my process uses ReadFile API.
How can I see which data the process received when it uses ReadFile?
- 10.9k
0
votes
2
answers
94
views
Magic number in resource loading routine
I'm practicing windows disassembly on x64 notepad.exe
I've managed to find buffer allocation and string resources load.
But after that follows code, which I can't fully understand:
rbx = 0, rdx = 0 ...
- 36.4k
3
votes
1
answer
158
views
Why does this function calls offset move when I restart windows
Every time I restart windows it breaks the patch I've made to an executable where I've called a function from the dll user32.dll. Currently the offset for the function call resides at 0x76E3CDB4, but ...
- 36.4k
2
votes
2
answers
8k
views
What is \Sessions\1\BaseNamedObjects\NamedBuffer?
I see those in a debugger (OllyDbg, handles subwindow), but I never meet an explanation on what those are.
Here is the full content of it, and to be honest I want to know the meaning of all of this. ...
- 143
0
votes
3
answers
2k
views
In Memory DLL Injection
I am currently working on learning how different types of DLL injection can be performed. Right now I am able to run a function by:
Opening the remote process;
Allocating memory in remote process;
...
- 7,542
1
vote
1
answer
325
views
Find the code used when you right click and select "Bring To Front" in Task Manager
How can I find out what code is being called when you right click on a process in Windows Task Manager, and click on "Bring To Front" ?
This is related to https://stackoverflow.com/questions/45046765/...
- 111
0
votes
1
answer
144
views
Information about packers
i was trying to search for some information about packers just to learn more about it, there is a lot of stuff out there but its hard to find something that really explain that good and clear,
I would ...
- 2,234
1
vote
2
answers
1k
views
Dumping Memory to Raw File
Is there a way to dump a section of process memory knowing the start and end address to raw bin file via a winapi function or some other method? I know that you can do this easily with a debugger, but ...
- 16.3k
1
vote
0
answers
68
views
Fighting programs that don't respond to Send/PostMessage-based input
This can be difficult to ask because 1) people assume this is necessarily malicious and 2) unrelated but effectual techniques like GetForegroundWindow can make this impossible to answer.
So, to keep ...
- 185