Questions tagged [winapi]

Microsoft's application programming interfaces available in the Windows operating system.

Filter by
Sorted by
Tagged with
1 vote
1 answer
4k views

How to analyze a child process created by malware by process hollowing mechanism using immunity debugger?

When I analyzed this malware sample it was invoking api's related to creating additional processes. With the process explorer I saw the debugged process is creating a new process. Please suggest any ...
wolverinegptg's user avatar
1 vote
2 answers
396 views

Identifying DeviceIoControl argument

I am reversing an application that uses the serial interface (COM1 port) and am using API Monitor to trace through the API calls. I found a reference to CreateFileA("\\.\Commsb96", GENERIC_READ | ...
Farhan Yusufzai's user avatar
2 votes
3 answers
1k views

Winapi ReadFile monitor

I'm trying to make a small proxy dll that will be able to print out all the files that a game tries to access from disk. I'm using a dinput8 wrapper dll as my proxy dll, from where I've managed to ...
Greg K.'s user avatar
  • 175
4 votes
1 answer
7k views

IDA python, list all imported functions

I have the following IDA python script. It sets and removes breakpoints on all calls to library functions: import idc import idaapi import idautils def set_breakpoints(): ea = idc.ScreenEA() ...
igntec's user avatar
  • 41
2 votes
1 answer
328 views

Changes on threads and threading system, in new Windows OS

I looked up the source code of the functions like CreateProcess and CreateThreade from kernel32. For example, CreateThread@kernel32 leads into kernelbase.dll and ends with a call to NtCreateThreadEx. ...
Vlad's user avatar
  • 153
1 vote
0 answers
198 views

How do I access the TEB in PIN?

In PIN's documentation it says this about PIN_SafeCopy: PIN_SafeCopy is used to copy the specified number of bytes from a source memory region to a destination memory region. This function ...
Seralize's user avatar
  • 121
0 votes
2 answers
335 views

Can benign applications have such APIs?

I am new to malware analysis .. and I was analyzing some 'windows' apps and found functions that I thought it exist only on malware, is this possible or there is something wrong with my analysis ? I ...
Ophilia's user avatar
  • 187
1 vote
2 answers
281 views

MSDetour not detouring SHGetKnownFolderPath

Tried to hook SHGetKnownFolderPath from shell32, using the normal DetourFunctionWithTrampoline, and it could not. Investigating, it seen that the application use GetProcAddress to load the function, ...
Shmuel Fomberg's user avatar
4 votes
2 answers
1k views

CreateProcess - First thread routine - where is the memory allocated for the thread?

When calling CreateProcess internally it will call (obviously ZwCreateProcessEx and then) ZwCreateThread with a CreateSuspended set to True, then i assume final initialization is taking place. ...
0xAK's user avatar
  • 668
2 votes
0 answers
81 views

Inserting Win32 controls into MFC application [closed]

I was wondering if there's a way to insert native win32 controls(button, static, etc.) into a MFC application during runtime. I was abled to embed my dll but everytime I create a new control via ...
AcarX's user avatar
  • 301
0 votes
1 answer
624 views

Breaking on specific API

I wish to set a breakpoint on a call to a specific windows API function, e.g.- RegQueryValueExA() It is resolved at runtime in unknown stage of malware execution, and I wish to initiate manual ...
GalB1t's user avatar
  • 103
-1 votes
1 answer
1k views

What does “mov [edi+68h], eax” mean?

What does mov [edi+68h], eax mean in the following asm code .text:0083FB35 call esi ; RegisterWindowMessageW .text:0083FB37 push offset My_Priv8_Msg ; "MY_PRIVATE_MSG" .text:...
RepeatUntil's user avatar
5 votes
3 answers
597 views

Is there a tool to see kernel space mapping of a Windows exe?

In Microsoft Windows, a 32bits process calc.exe has 0x0-0x80000000 (2GB) reserved as its user-space and the rest is kernel-space (2GB). So, a process has 2+2 = 4GB of virtual space. This ratio could ...
rebel87's user avatar
  • 391
0 votes
1 answer
130 views

How to find "enter" key event functions in games

I'm trying to locate the function that handles the Enter key press event from a dialog box in a very simple game (no directx afaik, game has a spashscreen that says "Made with Macromedia"). I think I'...
user2711115's user avatar
1 vote
1 answer
833 views

Why do i get into endless loop in winapi when i am debugging?

I am debugging some quiz program called "abex crackme 1" When I execute this program without debugging, it shows a simple message box, which reads "Make me think your HD is a CD-Rom" After I click ...
Lee Young joo's user avatar
10 votes
1 answer
3k views

Anti-debugging techniques - Preventing me from setting a memory and hardware breakpoint. How can I bypass that?

I'm debugging this process which has a lot of anti debugging techniques in it, and I faced something new which I don't know how to bypass yet. Changing the code dynamically causes exceptions to occur ...
0xAK's user avatar
  • 668
4 votes
2 answers
2k views

How to debug a self-debugging process?

How do you swap debuggers in Windows? In my case, I have a process A which creates a copy of itself: CreateProcessA("XXX.exe", NULL, 0x0023f560, 0x0023f560, TRUE, **...
user avatar
3 votes
0 answers
657 views

Hooking the BootClassLoader [closed]

According to Wikipedia, there are 3 class loaders. The Boot Class-Loader which loads everything in RT.jar and /../jre/lib Then the extensions class loader and the system class loader. I'm only ...
user11780's user avatar
4 votes
2 answers
1k views

finding a RC4 Encryption function in obfuscated assembly code with no symbols

RC4 encryption is quite basic and its Pseudo random generation algorithm is given at Wikipedia When Looking for a hashing algorithm like MD5 or SHAx it is pretty simple to look for the Hashing ...
0xAK's user avatar
  • 668
1 vote
1 answer
154 views

GUI represention in assembly level and another question

In advance, I'd say I'm learning reverse engineering newly. Indeed, there are some questions to be asked. First of all I would ask : In assembly level of the applications which use GUI ,how things ...
user3679015's user avatar
1 vote
2 answers
923 views

How to compare no-case sensitive strings IDC

So I want to track when a certain file is loaded into an Win32 app. That's way I put a break-point on 'CreateFile' which compares the first parameter with the target file name, but the problem is that ...
sasho648's user avatar
  • 411
5 votes
1 answer
2k views

DLL Injection search for procedures/variables

I am learning DLL injection basics and different techniques to achieve it, like using CreateProcess and LoadLibrary for example, or simply replacing a .dll in folder where the application to inject ...
astralmaster's user avatar
1 vote
2 answers
2k views

Command Injection in Windows ShellExecuteA()?

Imagine that we have the following pseudo-code in a Windows application: ShellExecuteA(0, "open", &File, &Parameters, &Directory, 1); And, imagine that you can gain control over the ...
osmund sadler's user avatar
0 votes
1 answer
1k views

What are best practices for reversing a dll that is injected into another process?

For example, you want to use Ollydbg to reverse a binary that is injected using WriteProcessMemory and CreateRemoteThread. How do you do this with ease? Currently I am setting a breakpoint on ...
user4411's user avatar
2 votes
2 answers
444 views

Why cl.exe change the extern function name used in my code?

So basically I my nasm syntax asm code, I use some extern functions like this: extern _printf extern __imp__Sleep@4 .... call _printf call [__imp__Sleep@4] Then I use nasm to assemble it into obj:...
lllllllllllll's user avatar
3 votes
3 answers
924 views

Why IDA Pro generate define-lack code like this?

Basically I us IDA Pro 6.1 on Windows 32 bit, dealing with binaries from SPEC 2006. I use IDA Pro to generate asm code from the binaries, and in the .data section, I see data define like this: ...
lllllllllllll's user avatar
2 votes
1 answer
513 views

How to get the PID of the a thread's creator (not owner, not host)

The THREADENTRY32 structure contains a member called th32OwnerProcessID, which is described as: The identifier of the process that created the thread. I'm not sure if I understand how the ...
Benny's user avatar
  • 828
2 votes
1 answer
797 views

Can a process disable UAC via WinAPI without prompting the user? [closed]

Is it possible for a running process to turn off User Account Control (UAC) via a Windows API call? If so, which API calls are needed? I found this interesting question/answer on stackoverflow, ...
Benny's user avatar
  • 828
7 votes
2 answers
4k views

Can a Windows process check if it has been injected by another process?

There are many tutorials which show how to detect injected code into process memory. However, this generally requires using a debugger. Is it possible for a process to somehow detect if it has been ...
Benny's user avatar
  • 828
6 votes
3 answers
6k views

Does code injected into process memory always belong to a page with RWX access?

I've seen a few memory forensics tutorials, which start by looking for injected code in the "victim's" process memory. They always seem to find the injected code in pages which have RWX access (i.e. ...
Benny's user avatar
  • 828
8 votes
1 answer
2k views

How can I find the Thread Local Storage (TLS) of a Windows Process Thread?

The Thread Local Storage (TLS) contains static or global values for a thread. Those values can be very important to find reliable references to memory structures when the memory locations are not ...
samuirai's user avatar
  • 3,059
10 votes
2 answers
1k views

Detecting an emulator using the windows api

I've been given a program that emulates the Windows API. I'm attempting to find flaws in this emulator where it either: Always returns a constant value, regardless of the host system (Useful for ...
drewb's user avatar
  • 103
7 votes
4 answers
2k views

Program with no dependencies

while reading the answers to Can I statically link (not import) the Windows system DLLs? I came up with another question. So: Is there a way to write a program that has no dependencies (nothing is ...
PhoeniX's user avatar
  • 3,002
10 votes
3 answers
6k views

Windows API reference for OllyDbg

There is an old help file containing Windows API I used few years ago with ollydebug, which can jump to the appropriate help page of function when double clicking on the function in the disassembly ...
Mellowcandle's user avatar
  • 4,785

1
2