Skip to main content

Questions tagged [winapi]

Microsoft's application programming interfaces available in the Windows operating system.

17 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
4 votes
0 answers

API Breakpoints not hitting while debugging a malware using x32dbg

I have been having a really strange issue which I have tried all ways to troubleshoot from my end but was not successful. I am going through a malware analysis course and following the debugging ...
Daksh Kapur's user avatar
3 votes
0 answers

Why can't I view certain USER32.dll API calls in the disassembly?

I'm trying to understand and patch the GUI in Microsoft Edge. When I look at the disassembly in 2 different debuggers (x64dbg and cutter), the API calls responsible for much of the GUI functionality ...
n0rmalguy011's user avatar
3 votes
0 answers

WinApi of UWΡ Shаdοws

I want to ask which WinApi methods being used to draw shadows under flyouts on UWΡ. What I know: This shаdοw disappearing when hiding flyout (via SW_HIDE), but it stays if we one hide it using ...
stackexchahgeaccount949102944's user avatar
3 votes
0 answers

How to disassemble win32 function RegSetValueExW?

I have opened up advapi32.dll in IDA and found out that RegSetValueExW is just a jump to RegSetValueExW_0. And RegSetValueExW_0 seems to be an extern. How do I actually disassemble RegSetValueExW_0?
jafarlihi's user avatar
  • 131
2 votes
0 answers

Redirect exception handler?

I'm working on a localization project and have a few trampoline hooks to translate some text in an online game. Periodically throughout gameplay, there are checks that run in the background to ensure ...
isuckatreversing's user avatar
2 votes
0 answers

Frida hook InsertMenuItemW

I'm trying to get information about menu items in an application. Experimentally established that InsertMenuItemW is called. Thanks to the documentation, I set the number of input parameters and wrote ...
user123's user avatar
  • 85
2 votes
0 answers

How to hack fan control speed?

So I recently bought a new laptop (Acer Aspire A315-57g) on which I found that the cooling solution wasn't optimal, and I decided that I want more RPMs from my fan. However, I wasn't able to find a ...
rec's user avatar
  • 475
1 vote
0 answers

How to get the call stack of WinAPI functions?

Yesterday, I noticed an answer to a question about the purpose of a certain undocumented function, which is a call stack (including the DLL library) for this function, This got me interested in the ...
IVs's user avatar
  • 137
1 vote
0 answers

Windbg memory access error when trying to edit a string value of a button

So i was trying to edit the string value of a button as a debugging practice using windbg. I'm still a complete novice in reverse engineering and debugging, when i try to edit the string value using ...
Someone's user avatar
  • 21
1 vote
0 answers

Calling undocumented kernel functions directly (xxxSendInput and xxxMouseEventDirect)

In the core my question is about how to reverse engineer undocumented functions. I want to call the function "xxxMouseEventDirect" (located in win32kfull.sys). I have already been able to collect some ...
moccajoghurt's user avatar
1 vote
0 answers

Fighting programs that don't respond to Send/PostMessage-based input

This can be difficult to ask because 1) people assume this is necessarily malicious and 2) unrelated but effectual techniques like GetForegroundWindow can make this impossible to answer. So, to keep ...
Lupe's user avatar
  • 185
1 vote
0 answers

How do I access the TEB in PIN?

In PIN's documentation it says this about PIN_SafeCopy: PIN_SafeCopy is used to copy the specified number of bytes from a source memory region to a destination memory region. This function ...
Seralize's user avatar
  • 121
1 vote
1 answer

Injecting exe file into process fails on windows 7 but works on windows 10 / Execution library function fails, access denied

I'm trying to inject my executable payload into remote process. I allocated memory in remote process, I converted raw payload using RVA addressing. I applied relocations and imports table. When I'm ...
bielu000's user avatar
  • 133
1 vote
2 answers

Identifying file-access functions used by explorer.exe

I'm trying to write a Windows 10 64-bit rootkit that runs on userland and hides files using IAT hooking. I managed to accomplish that on cmd.exe by hooking FindFirstFileW and FindNextFileW imported ...
one_hell_of_a_guy's user avatar
0 votes
0 answers

Is game hacking all about memory manipulation?

I wanted to know if game hacking is all about manipulating memory ? and If we need anything more than, this topics for game hacking ? memory manipulation Reverse engineering Windows internals C++ ...
Mahdi's user avatar
  • 1
0 votes
1 answer

Windows User Identification / HWID Limiting

I've been playing a game that has an HWID limit and a bunch of other limitations, such as: a) Cannot be ran in a VM b) Cannot be ran using Sandboxie and other Sandbox environments c) Limits 3 ...
layer07's user avatar
0 votes
1 answer

CreateFileA returning invalid handle when file exists

I was working on a practice binary. It opens the file at C:/WINDOWS/system32/filename#123.dat, if the file does not exist, the check compares the result to -1 (An invalid handle). However, even after ...
user37385's user avatar