Skip to main content

Questions tagged [winapi]

Microsoft's application programming interfaces available in the Windows operating system.

17 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
4 votes
0 answers
118 views

API Breakpoints not hitting while debugging a malware using x32dbg

I have been having a really strange issue which I have tried all ways to troubleshoot from my end but was not successful. I am going through a malware analysis course and following the debugging ...
Daksh Kapur's user avatar
3 votes
0 answers
237 views

Why can't I view certain USER32.dll API calls in the disassembly?

I'm trying to understand and patch the GUI in Microsoft Edge. When I look at the disassembly in 2 different debuggers (x64dbg and cutter), the API calls responsible for much of the GUI functionality ...
n0rmalguy011's user avatar
3 votes
0 answers
128 views

WinApi of UWΡ Shаdοws

I want to ask which WinApi methods being used to draw shadows under flyouts on UWΡ. What I know: This shаdοw disappearing when hiding flyout (via SW_HIDE), but it stays if we one hide it using ...
stackexchahgeaccount949102944's user avatar
3 votes
0 answers
330 views

How to disassemble win32 function RegSetValueExW?

I have opened up advapi32.dll in IDA and found out that RegSetValueExW is just a jump to RegSetValueExW_0. And RegSetValueExW_0 seems to be an extern. How do I actually disassemble RegSetValueExW_0?
jafarlihi's user avatar
  • 131
2 votes
0 answers
53 views

Redirect exception handler?

I'm working on a localization project and have a few trampoline hooks to translate some text in an online game. Periodically throughout gameplay, there are checks that run in the background to ensure ...
isuckatreversing's user avatar
2 votes
0 answers
130 views

Frida hook InsertMenuItemW

I'm trying to get information about menu items in an application. Experimentally established that InsertMenuItemW is called. Thanks to the documentation, I set the number of input parameters and wrote ...
user123's user avatar
  • 85
2 votes
0 answers
438 views

How to hack fan control speed?

So I recently bought a new laptop (Acer Aspire A315-57g) on which I found that the cooling solution wasn't optimal, and I decided that I want more RPMs from my fan. However, I wasn't able to find a ...
rec's user avatar
  • 475
1 vote
0 answers
113 views

How to get the call stack of WinAPI functions?

Yesterday, I noticed an answer to a question about the purpose of a certain undocumented function, which is a call stack (including the DLL library) for this function, This got me interested in the ...
IVs's user avatar
  • 137
1 vote
0 answers
360 views

Windbg memory access error when trying to edit a string value of a button

So i was trying to edit the string value of a button as a debugging practice using windbg. I'm still a complete novice in reverse engineering and debugging, when i try to edit the string value using ...
Someone's user avatar
  • 21
1 vote
0 answers
706 views

Calling undocumented kernel functions directly (xxxSendInput and xxxMouseEventDirect)

In the core my question is about how to reverse engineer undocumented functions. I want to call the function "xxxMouseEventDirect" (located in win32kfull.sys). I have already been able to collect some ...
moccajoghurt's user avatar
1 vote
0 answers
69 views

Fighting programs that don't respond to Send/PostMessage-based input

This can be difficult to ask because 1) people assume this is necessarily malicious and 2) unrelated but effectual techniques like GetForegroundWindow can make this impossible to answer. So, to keep ...
Lupe's user avatar
  • 185
1 vote
0 answers
206 views

How do I access the TEB in PIN?

In PIN's documentation it says this about PIN_SafeCopy: PIN_SafeCopy is used to copy the specified number of bytes from a source memory region to a destination memory region. This function ...
Seralize's user avatar
  • 121
1 vote
1 answer
761 views

Injecting exe file into process fails on windows 7 but works on windows 10 / Execution library function fails, access denied

I'm trying to inject my executable payload into remote process. I allocated memory in remote process, I converted raw payload using RVA addressing. I applied relocations and imports table. When I'm ...
bielu000's user avatar
  • 133
1 vote
2 answers
245 views

Identifying file-access functions used by explorer.exe

I'm trying to write a Windows 10 64-bit rootkit that runs on userland and hides files using IAT hooking. I managed to accomplish that on cmd.exe by hooking FindFirstFileW and FindNextFileW imported ...
one_hell_of_a_guy's user avatar
0 votes
0 answers
73 views

Is game hacking all about memory manipulation?

I wanted to know if game hacking is all about manipulating memory ? and If we need anything more than, this topics for game hacking ? memory manipulation Reverse engineering Windows internals C++ ...
Mahdi's user avatar
  • 1
0 votes
1 answer
841 views

Windows User Identification / HWID Limiting

I've been playing a game that has an HWID limit and a bunch of other limitations, such as: a) Cannot be ran in a VM b) Cannot be ran using Sandboxie and other Sandbox environments c) Limits 3 ...
layer07's user avatar
0 votes
1 answer
303 views

CreateFileA returning invalid handle when file exists

I was working on a practice binary. It opens the file at C:/WINDOWS/system32/filename#123.dat, if the file does not exist, the check compares the result to -1 (An invalid handle). However, even after ...
user37385's user avatar