Questions tagged [windows]

Windows refers to the Microsoft Windows series of operating systems.

Filter by
Sorted by
Tagged with
0
votes
1answer
67 views

Understanding the meaning of EBP + 0xffff98b4

I'm currently reverse-engineering an old game from 2003 to extend its functionality. I have now found what I am looking for and since it was written in C++ I'm trying to re-create the used classes. I ...
0
votes
0answers
27 views

How can i reconstruct a full PE from a memory injected PE that only has IAT + sections content?

I have a injected PE (kernel mode rootkit to be exact) that only has the IAT table, which basically only stores the addresses of some kernel functions in an array which is referenced inside its code, ...
-2
votes
1answer
182 views

Windows reverse engineered?

Have read in some Discord channel, that Windows was reverse engineered. Does anybody here have knowledge about such reverse engineered Windows version? If it really exists, where can it be downloaded?
1
vote
1answer
48 views

Windows UI freezes except the debugger itself when a breakpoint is hit in every debuggers I tried on a particular application

I'm trying to "trace" (just setting breakpoint, step in, step over to know how certain things work) an application. But if the application enters suspended state by using breakpoint, every ...
0
votes
1answer
37 views

One class with different sizes

After looking at some basic examples of how C++ classes are compiled by MSVC, I tried to apply the knowledge to a DLL I'm working on. While searching for a class to start with, I came across ...
0
votes
1answer
75 views

How do I get all sections in a PE file using C++?

So I am wondering how can I get all sections and their info from a dumped PE file on the disk, using C++. I have the entire PE loaded on a buffer, the NT headers, and hopefully the DOS headers. I need ...
0
votes
0answers
20 views

How to redirect connections by an exe file to a specific external ip address

I have an exe program that connects randomly to one of the 4 addresses 188.39.21.82...83...84...85 out of which only 82 works Currently I blocked the remaining addresses using Windows 10 Firewall ...
1
vote
1answer
52 views

Unknown usage of dwLength and SsHandle members in PEB_LDR_DATA

I've been implementing some Windows internals code and when I have tried to document this structure I have not been able to do so because of those two members. I can't find anything about them. This ...
0
votes
0answers
50 views

Reverse engineering Samsung Quick share UWP app

I want to make the Samsung Quick Share app work on my PC which is not from Samsung. So which DLL file would I have to reverse engineer to bypass that restriction, and how to get full access to UWP ...
0
votes
0answers
38 views

How to debug a .NET windows service: "Cannot start service from the command line or a debugger"

I have a .NET windows service which I can stop and run through Process Hacker. I can also view it's code with dnSPY. I tried to debug it without a success by trying to attach to the process. I wanted ...
0
votes
2answers
69 views

Why windbg skips syscall on kernel mode?

I have a VM running windows with notepad open, I did list the modules with lm: start end module name 00007ffc`60fb0000 00007ffc`60fe2000 vertdll (deferred) ...
2
votes
1answer
186 views

How to propagate re-typed variables to functions signatures automatically?

In the Ghidra decompiler, after applying a type to a function parameter, the compiler uses that type information to provide better decompilation within the function. When that parameter is used in a ...
0
votes
0answers
41 views

Immunity Debugger not running on Windows 10

I'm experiencing some issues with Immunity Debugger where when I'm ready to run the program, I'll push the "play/start" button and nothing will happen. I've gone through the process already ...
0
votes
0answers
49 views

How are programs like 'StartAllBack' and 'T-Clock' developed?

There are many programs like StartAllBack and its predecessor StartIsBack which somehow modifies different aspects of Windows Shell (explorer.exe). How are these hook points discovered in the first ...
0
votes
0answers
60 views

Remote debugging with Binary Ninja on Windows possible?

Quick background -- I cannot start the .exe from a debugger; I need to attach after the fact. Binary Ninja's debugging plugin only allows attaching to a remote debug server and not a process. The ...
0
votes
2answers
187 views

Why are certain functions from kernel32.dll always imported?

I've been noticing this for a while. Functions like IsDebuggerPresent and GetModuleHandle are always present in a binary's import directory structure. I assume is the Window's dynamic linker, but ...
3
votes
0answers
50 views

Is it possible to fake being joined to a domain in Windows 10?

I'm dealing with a malware sample from a pentest that will only execute properly if the system is a member of the target organization's Windows Active Directory domain. Rather than standing up my own ...
0
votes
1answer
281 views

How to unpack Armadillo protected software using x64dbg?

I am planning to reverse-engineer a Windows executable that has been protected with Armadillo. When I put the executable through Detect It Easy, the results show that the executable was protected with ...
0
votes
1answer
116 views

Windows User Identification / HWID Limiting

I've been playing a game that has an HWID limit and a bunch of other limitations, such as: a) Cannot be ran in a VM b) Cannot be ran using Sandboxie and other Sandbox environments c) Limits 3 ...
0
votes
1answer
130 views

How do I interpret this double offset?

While looking at that old game I've found a class CStr that is used in an unusual (to me) manner. Most of the times a member of CStr is used, it's done as follows. In both cases, this is a CStr *. ...
0
votes
0answers
29 views

How to extract an AutoIT script when tools fail to extract it?

Lets say you have a Autoit malware (windows executable, autoit v3), and you want to extract the script from it. But tools such as exe2aut fail to extract it. What would you do? is there any place in ...
0
votes
2answers
187 views

How to prevent File Modification in C++

so i want to protect my software against reverse-engineering and i want to add checksum verification to prevent patching the binary but the problem that if i added a checksum verification the binary ...
1
vote
1answer
164 views

Change manifest file using ResourceHacker CLI

I want to automate some manifest file changes (change requestedExecutionLevel level to requireAdministator from asInvoker) so I have to use ResourceHacker CLI. I have managed to extract the resources ...
1
vote
2answers
33 views

Cant Save .exe using reflixil and Red Gate Reflector 10.3

First off all im pretty new to Reverse Engineering. Im Stuck on Saving my Project. When i want to save the Assembly as .exe file Reflexil says cant save, the specified Method is not supported. I tried ...
1
vote
0answers
25 views

Send file or non-printable character in Immunity Debugger arguments

I am a beginner in Reverse Engineering. I am on Windows and using Immunity Debugger. I would like to send my payload on the .exe file. The payload contains non-printable characters. How I can launch ...
0
votes
1answer
94 views

Proxy dll doesn't load the original dll

I have relatively simple code here for the proxy DllMain() function: BOOL APIENTRY DllMain(HMODULE hDll, DWORD reason, LPVOID reserved) { if (reason != DLL_PROCESS_ATTACH) { return TRUE; } ...
1
vote
2answers
99 views

Can't figure out a crash in IDA "The memory could not be read -> 00000710 (exc.code c0000005, tid 20612)"

I'm trying to debug out a game. Basically, the Steam version works perfectly but the GOG version (which is 8kb smaller) has an annoying problem where for some people (which happen to be me) the game ...
0
votes
0answers
68 views

Ghidra: Identify and display a struct broken into multiple smaller fields

Me vs the 90s game, part two. I'm trying to figure out how the game detects the current date, since that part doesn't work correctly anymore. At some point, GetLocalTime() from kernel32.dll gets ...
0
votes
0answers
26 views

There is a course in which they teach you to use WinAFL?

I would like to know if there is a course that begins in a basic way, such as how to use winAFL to find bugs in app desktop.
0
votes
1answer
468 views

How to find main() of Windows EXE with Ghidra?

I'm new to Ghidra, my goal is to add localizations for a small EXE program. The program was written in Visual Studio and has Russian dialogs, which I like to convert to English. I've loaded the EXE ...
-1
votes
1answer
56 views

How to find bugs in a modern desktop application with reverse enginnering?

I would like to clarify the context for the question: I have studied different types of exploiting but all the studies I have carried out were with command line programs and with functions that I ...
0
votes
0answers
27 views

How to replace the modified/corrupted module image on the original in the memory dump

I'm analyzing a windows kernel crash. I have instrumented “USBPORT.sys" kernel module for collecting metrics. I named the instrumented version of the module "TARGET_MODULE". After I ...
0
votes
0answers
93 views

What kind of code creates this function call pattern?

While using WinDbg: u/uf to disassemble functions in ntoskrnl.exe there are functions that are used in system calls and exception handling that have these weird function call patterns and I can't ...
4
votes
1answer
217 views

Fixing/recompiling a heavily control flow obfuscated function

I've recently come across a binary that has been obfuscated with a very obscure protection. Obfuscation From what I understand, the obfuscator is effective in several ways. Multiple JMPs via relative ...
2
votes
1answer
115 views

Want to use win API hooking to detect wmi query string? But can't find IWbemServices::ExecQuery in fastprox.dll

I want to implement WMI query detection function using apimon plugin in sandbox https://github.com/tklengyel/drakvuf To do it,I have to get the DLL symbol file. But I can't locate the IWbemServices::...
0
votes
0answers
39 views

Is it possible to Direct3D 9 debug DLL in an app using the release version

I have an application using d3d9.dll, but I want to figure out which functions it calls to gain insight. Since online tools I have found are incompatible with my app (32-bit d3d9), is it instead ...
0
votes
1answer
62 views

CreateFileA returning invalid handle when file exists

I was working on a practice binary. It opens the file at C:/WINDOWS/system32/filename#123.dat, if the file does not exist, the check compares the result to -1 (An invalid handle). However, even after ...
1
vote
0answers
57 views

Reversing Logitech G933 Battery Charge Values

I have a Logitech G933 headset. I replaced the stock battery with a larger capacity. The headset now lasts many hours longer than it was originally designed, and the software is configured to give ...
2
votes
1answer
172 views

How to get thread start address in Windows?

I'm writing thread finder in module. My goal is find all threads in process and find threads currently working address locations. Like image on below. I do this goal with NtQueryInformationThread API. ...
1
vote
1answer
69 views

Identifying/debugging code parts responsible for features in Windows

New to the area, i am trying to identify the code responsible for example for the search functionality in Windows when you start typing in the start menu. What are some generic ways of identifying the ...
1
vote
1answer
55 views

Why is process object is shown as desktop object in nt!_object_type

I try to extract the object type of notepad.exe in windbg but the nt!_object_type is showing it as Desktop object instead of Process object. Any idea why is it so? 4: kd> !process 0 0 notepad.exe ...
0
votes
0answers
135 views

Windows time travel debugging performance bottleneck

First of all I wan to be clear, that this question is not about the collection performance, but indexing performance. What is the performance bottleneck of the indexing step? Some context: Action in ...
2
votes
1answer
39 views

Why some process has empty nt!_object_type

I try to extra the nt!_object_type of notepad.exe process. But seems like it's empty. Is it some process has no object type? Correction for my screenshot above for using the EPROCESS address to ...
1
vote
1answer
104 views

Run ntoskrnl.exe with qemu

We can run linux and similar unix kernels uing qemu -kernel parameter. Is there any way to do the same with NT kernel? I could not find a way to test even reactos kernelwith qemu. Also can .efi files ...
0
votes
1answer
35 views

Can't add tracing in IDA, showing it in gray

I added read/write trace to a program. I was able to record the trace with IDA for the first time. When I run it again, it didn't work. I tried to do what I did on the first time, adding the read/...
1
vote
1answer
95 views

How to load modules symbols to IDA while debugging a process

I am debugging a program that I compiled. This program calls SetWindowTextW. When I am debugging it with IDA I can step into this function, but it doesn't recognize anything there: If I will load ...
1
vote
0answers
44 views

On Windows, when is a PTE a VAD prototype PTE (with address 0xFFFFFFFF0000) instead of a prototype-pointer PTE?

I have reviewed several sources on this PTE type, including Windows internals and the following: http://blog.rekall-forensic.com/2014/10/windows-virtual-address-translation-and.html https://thalium....
1
vote
0answers
22 views

Whats the difference between a MiNotMapped PFN entry with all 1s, and a MiNonCached PFN entry with all 0s and a 0 PteAddress?

On host (UEFI legacy mode): lkd> !pfn 0xf0 PFN 000000F0 at address FFFFFA8000002D00 flink FFFFFFFFFFFFFFFF blink / share count FFFFFFFFFFFFFFFF pteaddress FFFFFFFFFFFFFFFF ...
2
votes
0answers
86 views

How to disassemble win32 function RegSetValueExW?

I have opened up advapi32.dll in IDA and found out that RegSetValueExW is just a jump to RegSetValueExW_0. And RegSetValueExW_0 seems to be an extern. How do I actually disassemble RegSetValueExW_0?
3
votes
1answer
172 views

Unable to attach into mysterious PID

I have a suspicious process. I found it by ProcessHacker's network tab. ProcessHacker display the process as Unknown. The process listening into a constant port number that's also not found by ...

1
2 3 4 5
15