Questions tagged [winapi]
Microsoft's application programming interfaces available in the Windows operating system.
88
questions
10
votes
3
answers
6k
views
Windows API reference for OllyDbg
There is an old help file containing Windows API I used few years ago with ollydebug, which can jump to the appropriate help page of function when double clicking on the function in the disassembly ...
- 4,845
10
votes
2
answers
1k
views
Detecting an emulator using the windows api
I've been given a program that emulates the Windows API. I'm attempting to find flaws in this emulator where it either:
Always returns a constant value, regardless of the host system (Useful for ...
- 103
10
votes
1
answer
3k
views
Anti-debugging techniques - Preventing me from setting a memory and hardware breakpoint. How can I bypass that?
I'm debugging this process which has a lot of anti debugging techniques in it, and I faced something new which I don't know how to bypass yet.
Changing the code dynamically causes exceptions to occur ...
- 668
9
votes
1
answer
2k
views
How can I find the Thread Local Storage (TLS) of a Windows Process Thread?
The Thread Local Storage (TLS) contains static or global values for a thread. Those values can be very important to find reliable references to memory structures when the memory locations are not ...
- 3,079
7
votes
4
answers
2k
views
Program with no dependencies
while reading the answers to Can I statically link (not import) the Windows system DLLs? I came up with another question. So:
Is there a way to write a program that has no dependencies (nothing is ...
- 3,062
7
votes
2
answers
4k
views
Can a Windows process check if it has been injected by another process?
There are many tutorials which show how to detect injected code into process memory. However, this generally requires using a debugger.
Is it possible for a process to somehow detect if it has been ...
- 828
6
votes
3
answers
6k
views
Does code injected into process memory always belong to a page with RWX access?
I've seen a few memory forensics tutorials, which start by looking for injected code in the "victim's" process memory. They always seem to find the injected code in pages which have RWX access (i.e. ...
- 828
5
votes
1
answer
7k
views
IDA python, list all imported functions
I have the following IDA python script. It sets and removes breakpoints on all calls to library functions:
import idc
import idaapi
import idautils
def set_breakpoints():
ea = idc.ScreenEA()
...
- 51
5
votes
1
answer
2k
views
DLL Injection search for procedures/variables
I am learning DLL injection basics and different techniques to achieve it, like using CreateProcess and LoadLibrary for example, or simply replacing a .dll in folder where the application to inject ...
- 145
5
votes
3
answers
613
views
Is there a tool to see kernel space mapping of a Windows exe?
In Microsoft Windows, a 32bits process calc.exe has 0x0-0x80000000 (2GB) reserved as its user-space and the rest is kernel-space (2GB). So, a process has 2+2 = 4GB of virtual space. This ratio could ...
- 391
5
votes
1
answer
375
views
Why is function in kernel32.dll jumping into a api-ms-win-core stub
I was trying to look into the implementation of GetVersion function in kernel32.dll.
I was surprised to see that the GetVersion thunk is issuing a jump to API-MS-WIN-CORE-SYSINFO-L1-1-0.DLL::...
- 205
4
votes
2
answers
1k
views
CreateProcess - First thread routine - where is the memory allocated for the thread?
When calling CreateProcess internally it will call (obviously ZwCreateProcessEx and then) ZwCreateThread with a CreateSuspended set to True, then i assume final initialization is taking place. ...
- 668
4
votes
2
answers
1k
views
finding a RC4 Encryption function in obfuscated assembly code with no symbols
RC4 encryption is quite basic and its Pseudo random generation algorithm is given at Wikipedia
When Looking for a hashing algorithm like MD5 or SHAx it is pretty simple to look for the Hashing ...
- 668
4
votes
2
answers
2k
views
How to debug a self-debugging process?
How do you swap debuggers in Windows?
In my case, I have a process A which creates a copy of itself:
CreateProcessA("XXX.exe", NULL, 0x0023f560, 0x0023f560, TRUE,
**...
faberle
4
votes
0
answers
120
views
API Breakpoints not hitting while debugging a malware using x32dbg
I have been having a really strange issue which I have tried all ways to troubleshoot from my end but was not successful.
I am going through a malware analysis course and following the debugging ...
- 41
3
votes
1
answer
1k
views
Finding AddressOfEntryPoint for a 64-bit process
Okay, so in the following code-snippet I am starting a notepad.exe process in a suspended state and trying to get the AddressOfEntryPoint of the process. Problem is I can't seem to find the actual ...
- 33
3
votes
3
answers
939
views
Why IDA Pro generate define-lack code like this?
Basically I us IDA Pro 6.1 on Windows 32 bit, dealing with binaries from SPEC 2006.
I use IDA Pro to generate asm code from the binaries, and in the .data section, I see data define like this:
...
- 2,485
3
votes
1
answer
262
views
GetWindowLongPtr with undocumented nIndex of -1
I'm trying to reverse functionality of scrollbars in comctrl32.dll and I keep witnessing them calling GetWindowLongPtr function with undocumented index -1 as such:
Does anybody know what that ...
- 1,751
3
votes
1
answer
4k
views
What is the difference between kernelBase.dll and Kernel32.dll
What is the difference between kernelBase.dll and Kernel32.dll in system32 folder ?
Why both of them implement WideCharToMultiByte ?
- 41
3
votes
1
answer
159
views
Why does this function calls offset move when I restart windows
Every time I restart windows it breaks the patch I've made to an executable where I've called a function from the dll user32.dll. Currently the offset for the function call resides at 0x76E3CDB4, but ...
- 133
3
votes
1
answer
107
views
How can I set up a conditional breakpoint for the CreateFileW function for when a specific file/path is read in x64dbg?
I'm currently debugging a program using x64dbg, and I'm struggling to set up a conditional breakpoint on the CreateFileW function:
HANDLE CreateFileW(
[in] LPCWSTR lpFileName,...
- 85
3
votes
3
answers
2k
views
How to debug ServiceMain function of a service?
I have a malware which is checking for keyboard type and locale information.
After that, it creates a service with BinaryPathName as malware's exe address. After creating a service, malware starts it ...
- 131
3
votes
1
answer
189
views
Are win32api calls differentiable from real actions?
I've been tinkering with the win32api library on Python and interacting with Notepad. I now want to try it on an online game to automate some boring tasks but I'm scared I get banned for this.
Is for ...
- 31
3
votes
1
answer
349
views
CreateTimerQueueTimer arguments differs from WinAPI
I was reading a man page about CreateTimerQueueTimer.
BOOL CreateTimerQueueTimer(
PHANDLE phNewTimer,
HANDLE TimerQueue,
WAITORTIMERCALLBACK Callback,
PVOID ...
- 283
3
votes
1
answer
2k
views
How to debug slow Windows API calls?
My machine at work has recently been updated to Windows 10, from Windows 7, and it has become incredibly slow. The IT has installed a bunch of new tools for security and protection after the upgrade ...
- 149
3
votes
1
answer
696
views
How to debug packet processing with overlapped socket on Windows
The problem is quite complex so i don't want to run into unneccessary details.
I have a network application, that communicates with multiple clients at once via UDP. I haven't written it and there is ...
- 141
3
votes
0
answers
238
views
Why can't I view certain USER32.dll API calls in the disassembly?
I'm trying to understand and patch the GUI in Microsoft Edge. When I look at the disassembly in 2 different debuggers (x64dbg and cutter), the API calls responsible for much of the GUI functionality ...
- 31
3
votes
0
answers
128
views
WinApi of UWΡ Shаdοws
I want to ask which WinApi methods being used to draw shadows under flyouts on UWΡ.
What I know:
This shаdοw disappearing when hiding flyout (via SW_HIDE), but it stays if we one hide it using ...
3
votes
0
answers
333
views
How to disassemble win32 function RegSetValueExW?
I have opened up advapi32.dll in IDA and found out that RegSetValueExW is just a jump to RegSetValueExW_0. And RegSetValueExW_0 seems to be an extern.
How do I actually disassemble RegSetValueExW_0?
- 131
3
votes
0
answers
296
views
int 2eh instead of syscall/sysenter [duplicate]
I have been looking into ntdll.dll on windows 10 x64 bit, and i noticed a check inside the ntdll like this:
So after testing some bit, it tries to execute the system call via int 2eh. I have tried to ...
3
votes
0
answers
675
views
Hooking the BootClassLoader [closed]
According to Wikipedia, there are 3 class loaders.
The Boot Class-Loader which loads everything in RT.jar and /../jre/lib
Then the extensions class loader and the system class loader.
I'm only ...
- 31
2
votes
2
answers
456
views
Why cl.exe change the extern function name used in my code?
So basically I my nasm syntax asm code, I use some extern functions like this:
extern _printf
extern __imp__Sleep@4
....
call _printf
call [__imp__Sleep@4]
Then I use nasm to assemble it into obj:...
- 2,485
2
votes
1
answer
273
views
Missing Symbols RtlGetFrame, RtlPushFrame, RtlPopFrame
I'd like to use some undocumented symbols that listed in ProcessHacker project. taken from Here:
https://github.com/processhacker/processhacker/blob/master/phnt/include/ntpebteb.h#L241
https://...
- 205
2
votes
3
answers
1k
views
Winapi ReadFile monitor
I'm trying to make a small proxy dll that will be able to print out all the files that a game tries to access from disk.
I'm using a dinput8 wrapper dll as my proxy dll, from where I've managed to ...
- 175
2
votes
1
answer
3k
views
Extracting strings from binary files (.exe)
This question has been asked quite a lot especially on stackoverflow, but the solutions/replies are not clear or extensive.
What I`m looking for is to build what Strings does from Sysinternals. My ...
- 141
2
votes
1
answer
818
views
How to see ReadFile results with ProcMon
I running procmon to monitor my process, and see that my process uses ReadFile API.
How can I see which data the process received when it uses ReadFile?
- 35
2
votes
1
answer
535
views
How to get the PID of the a thread's creator (not owner, not host)
The THREADENTRY32 structure contains a member called th32OwnerProcessID, which is described as:
The identifier of the process that created the thread.
I'm not sure if I understand how the ...
- 828
2
votes
1
answer
822
views
Can a process disable UAC via WinAPI without prompting the user? [closed]
Is it possible for a running process to turn off User Account Control (UAC) via a Windows API call? If so, which API calls are needed?
I found this interesting question/answer on stackoverflow, ...
- 828
2
votes
1
answer
728
views
Missing kernel32.dll in import table
I have very basic application which is console app dispaying message box.
In Visual Studio I change following options:
- C/C++ -> SecurityCheck -> Disable Security Check (/GS-)
- Linker -> ...
- 133
2
votes
2
answers
8k
views
What is \Sessions\1\BaseNamedObjects\NamedBuffer?
I see those in a debugger (OllyDbg, handles subwindow), but I never meet an explanation on what those are.
Here is the full content of it, and to be honest I want to know the meaning of all of this. ...
- 33
2
votes
1
answer
298
views
How to find sleep() in ollydbg or IDA or ghidra
I have a program which converts videos from a proprietary format into mp4.
The conversion is very slow and CPU utilization is less than 1%.
I'm able to speed up the conversion process via Cheat Engine'...
- 21
2
votes
1
answer
330
views
Changes on threads and threading system, in new Windows OS
I looked up the source code of the functions like CreateProcess and CreateThreade from kernel32. For example, CreateThread@kernel32 leads into kernelbase.dll and ends with a call to NtCreateThreadEx.
...
- 153
2
votes
0
answers
53
views
Redirect exception handler?
I'm working on a localization project and have a few trampoline hooks to translate some text in an online game. Periodically throughout gameplay, there are checks that run in the background to ensure ...
2
votes
0
answers
130
views
Frida hook InsertMenuItemW
I'm trying to get information about menu items in an application. Experimentally established that InsertMenuItemW is called. Thanks to the documentation, I set the number of input parameters and wrote ...
- 85
2
votes
0
answers
440
views
How to hack fan control speed?
So I recently bought a new laptop (Acer Aspire A315-57g) on which I found that the cooling solution wasn't optimal, and I decided that I want more RPMs from my fan. However, I wasn't able to find a ...
- 475
2
votes
0
answers
87
views
Inserting Win32 controls into MFC application [closed]
I was wondering if there's a way to insert native win32 controls(button, static, etc.) into a MFC application during runtime. I was abled to embed my dll but everytime I create a new control via ...
- 301
1
vote
1
answer
1k
views
How to disassemble an entire function in Windbg?
I am trying to disassemble the function ExAcquireFastMutex using WinDbg but it gives me only 8 rows:
3: kd> u nt!ExAcquireFastMutex
nt!ExAcquireFastMutex:
fffff805`456e3820 4053 push ...
- 583
1
vote
1
answer
159
views
GUI represention in assembly level and another question
In advance, I'd say I'm learning reverse engineering newly.
Indeed, there are some questions to be asked.
First of all I would ask : In assembly level of the applications which use GUI ,how things ...
- 67
1
vote
2
answers
62
views
In the context of the Windows API, what extra information do the debugging symbols provide that the export table doesnt provide?
Take for example, 'kernel32.dll', the export table already provides the list of exported functions, then in what use case, would I need to download the debugging symbols for it from the MS symbol ...
- 319
1
vote
1
answer
4k
views
How to analyze a child process created by malware by process hollowing mechanism using immunity debugger?
When I analyzed this malware sample it was invoking api's related to creating additional processes. With the process explorer I saw the debugged process is creating a new process. Please suggest any ...
