Questions tagged [windows]

Windows refers to the Microsoft Windows series of operating systems.

Filter by
Sorted by
Tagged with
0 votes
0 answers
4 views

Calling a function with a variable number of args from a proxy DLL

The program I'm messing with has builtin logging. Using a proxy DLL, I managed to activate it by calling the right functions from the real DLL. However, I got stuck at using the actual logging ...
user avatar
1 vote
1 answer
25 views

Understanding disassembly information from Visual Studio's dumpbin and GNU's objdump

I usually write my code on Windows, and there are two different types of development environments, each providing their own tools to view the assembly code of an object file(*.obj) or executable (*....
user avatar
  • 113
1 vote
0 answers
22 views

How to convert addresses shown by IDA when statically analyzing a DLL to real addresses in runtime

In a DLL I am trying to reverse there often is a reference to something I believe to be a fixed pointer (like a global var) which looks like dword_10038534. The references I am talking about look like ...
user avatar
0 votes
0 answers
13 views

How are system page map entries belonging to process's updated?

Every process has its own PML4 table, and the first 9 bits of the 48-bit virtual address describe the index of a PML4 entry. The first bit of the PML4 index is clear for user code and set for kernel ...
user avatar
1 vote
1 answer
48 views

How to load a PDB file into x64dbg?

I want to see symbols in the disassembly wherever possible, and I have a PDB file for the .exe I'm debugging, but I can't find a way to load the PDB file from disk. Is it even possible?
user avatar
0 votes
1 answer
61 views

Frida hook multiple processes

There was such a situation. I run the frida hook on the process like this: frida -f '..\hack2\hackme.exe' -l .\start.js In the script itself I do this var moduleData = Process.getModuleByName("...
user avatar
  • 11
1 vote
1 answer
24 views

What are these Device Object Characteristics / Flags in Windows 10 ntoskrnl!IopParseDevice

In Windows 10 looking at ntoskrnl!IopParseDevice I'm trying to work out the name / purpose of the flags in this check, which seem to be testing for values in a DEVICE_OBJECT Characteristics property ...
user avatar
0 votes
1 answer
24 views

IDA show xrefs in .pdata and nothing else

I'm debugging the Windows ARM64 version's EFI (bootaa64.efi). Using QEMU and GDB I was able to find that bootaa64.efi was stuck in one of the two functions BlKernelSp0SystemErrorHandler and ...
user avatar
1 vote
0 answers
14 views

Why does OllyDbg label data segment as read only?

I'm working on this problem: Challenge 53 When compiling with cl c53.c /Fac53.asm /MD in VS2019 X86 Development Console and loading the .exe into OllyDbg, I found OllyDbg labels all segments of c53 as ...
user avatar
0 votes
0 answers
19 views

How to initiate usb connection as usb display

I'm trying to essentially make an hdmi dummy plug to trick the computer into thinking there is a second monitor. I am planning on doing it by having a raspberry pi pico act as a usb monitor. (much ...
user avatar
1 vote
1 answer
60 views

Why is Visual Studio compiling my EXE file with an entry point that is not in the file?

So I am trying to open my test app EXE file in ollydbg to study the assembly, the stack, registers and all that stuff for educational purposes and it gives me this message saying that the entry point ...
user avatar
0 votes
0 answers
18 views

How to download previous releases that were published on Windows Store?

Often it's useful when Reverse Engineering to compare releases to one another. Windows Store has previously been unpopular, but is getting increasing use. Utilities like https://github.com/microsoft/...
user avatar
1 vote
1 answer
91 views

Instructions to compare two strings

I made a list of which instructions compare two strings in disassembly so that when I get to intermodular calls in x64dbg, I can simply type this instructions to see if there is a comparison have been ...
user avatar
1 vote
0 answers
44 views

Reverse engineering unknown data file

I have a set of datafiles that I want to reverse engineer which are used by a software that controls my heating system. I want to extract the commands to then use these commands in my home automation ...
user avatar
0 votes
0 answers
18 views

Phoenix Exploit Education, Powershell script not working the error: '-netdev:user: invalid option','vmlinuz-4.9.0-8-amd64': No such file or directory

I tried these 2 scripts to set up phoenix from Exploit-Education but faced the below errors could not find any other script online one was from https://blog.lamarranet.com/index.php/exploit-education-...
user avatar
1 vote
1 answer
55 views

funcion calls extern function without body

I wanted to look at how does the Windows API get the size of a file, so I opened kernel32.dll in a disassembler. I searched for GetFileSizeEx, and it seems to call a stub(?), but the disassembler ...
user avatar
  • 25
0 votes
0 answers
78 views

How to identify if an .exe packed by VMProtect has virtualization enabled?

I am interested in reverse engineering a few parts of an .exe application (windows 32-bit executable) that downloads some documents from a server and decrypts them locally in memory. Using PE EXE ...
user avatar
0 votes
1 answer
87 views

Understanding the meaning of EBP + 0xffff98b4

I'm currently reverse-engineering an old game from 2003 to extend its functionality. I have now found what I am looking for and since it was written in C++ I'm trying to re-create the used classes. I ...
user avatar
0 votes
0 answers
46 views

How can i reconstruct a full PE from a memory injected PE that only has IAT + sections content?

I have a injected PE (kernel mode rootkit to be exact) that only has the IAT table, which basically only stores the addresses of some kernel functions in an array which is referenced inside its code, ...
user avatar
-2 votes
1 answer
218 views

Windows reverse engineered?

Have read in some Discord channel, that Windows was reverse engineered. Does anybody here have knowledge about such reverse engineered Windows version? If it really exists, where can it be downloaded?
user avatar
  • 101
1 vote
1 answer
71 views

Windows UI freezes except the debugger itself when a breakpoint is hit in every debuggers I tried on a particular application

I'm trying to "trace" (just setting breakpoint, step in, step over to know how certain things work) an application. But if the application enters suspended state by using breakpoint, every ...
user avatar
0 votes
1 answer
41 views

One class with different sizes

After looking at some basic examples of how C++ classes are compiled by MSVC, I tried to apply the knowledge to a DLL I'm working on. While searching for a class to start with, I came across ...
user avatar
0 votes
1 answer
172 views

How do I get all sections in a PE file using C++?

So I am wondering how can I get all sections and their info from a dumped PE file on the disk, using C++. I have the entire PE loaded on a buffer, the NT headers, and hopefully the DOS headers. I need ...
user avatar
0 votes
0 answers
27 views

How to redirect connections by an exe file to a specific external ip address

I have an exe program that connects randomly to one of the 4 addresses 188.39.21.82...83...84...85 out of which only 82 works Currently I blocked the remaining addresses using Windows 10 Firewall ...
user avatar
  • 101
1 vote
1 answer
60 views

Unknown usage of dwLength and SsHandle members in PEB_LDR_DATA

I've been implementing some Windows internals code and when I have tried to document this structure I have not been able to do so because of those two members. I can't find anything about them. This ...
user avatar
0 votes
0 answers
63 views

Reverse engineering Samsung Quick share UWP app

I want to make the Samsung Quick Share app work on my PC which is not from Samsung. So which DLL file would I have to reverse engineer to bypass that restriction, and how to get full access to UWP ...
user avatar
0 votes
0 answers
106 views

How to debug a .NET windows service: "Cannot start service from the command line or a debugger"

I have a .NET windows service which I can stop and run through Process Hacker. I can also view it's code with dnSPY. I tried to debug it without a success by trying to attach to the process. I wanted ...
user avatar
  • 451
0 votes
2 answers
122 views

Why windbg skips syscall on kernel mode?

I have a VM running windows with notepad open, I did list the modules with lm: start end module name 00007ffc`60fb0000 00007ffc`60fe2000 vertdll (deferred) ...
user avatar
  • 39
2 votes
1 answer
343 views

How to propagate re-typed variables to functions signatures automatically?

In the Ghidra decompiler, after applying a type to a function parameter, the compiler uses that type information to provide better decompilation within the function. When that parameter is used in a ...
user avatar
  • 195
0 votes
0 answers
79 views

Immunity Debugger not running on Windows 10

I'm experiencing some issues with Immunity Debugger where when I'm ready to run the program, I'll push the "play/start" button and nothing will happen. I've gone through the process already ...
user avatar
  • 1
0 votes
0 answers
67 views

How are programs like 'StartAllBack' and 'T-Clock' developed?

There are many programs like StartAllBack and its predecessor StartIsBack which somehow modifies different aspects of Windows Shell (explorer.exe). How are these hook points discovered in the first ...
user avatar
0 votes
0 answers
120 views

Remote debugging with Binary Ninja on Windows possible?

Quick background -- I cannot start the .exe from a debugger; I need to attach after the fact. Binary Ninja's debugging plugin only allows attaching to a remote debug server and not a process. The ...
user avatar
  • 101
0 votes
2 answers
239 views

Why are certain functions from kernel32.dll always imported?

I've been noticing this for a while. Functions like IsDebuggerPresent and GetModuleHandle are always present in a binary's import directory structure. I assume is the Window's dynamic linker, but ...
user avatar
  • 69
3 votes
0 answers
88 views

Is it possible to fake being joined to a domain in Windows 10?

I'm dealing with a malware sample from a pentest that will only execute properly if the system is a member of the target organization's Windows Active Directory domain. Rather than standing up my own ...
user avatar
  • 131
0 votes
1 answer
604 views

How to unpack Armadillo protected software using x64dbg?

I am planning to reverse-engineer a Windows executable that has been protected with Armadillo. When I put the executable through Detect It Easy, the results show that the executable was protected with ...
user avatar
0 votes
1 answer
169 views

Windows User Identification / HWID Limiting

I've been playing a game that has an HWID limit and a bunch of other limitations, such as: a) Cannot be ran in a VM b) Cannot be ran using Sandboxie and other Sandbox environments c) Limits 3 ...
user avatar
0 votes
1 answer
138 views

How do I interpret this double offset?

While looking at that old game I've found a class CStr that is used in an unusual (to me) manner. Most of the times a member of CStr is used, it's done as follows. In both cases, this is a CStr *. ...
user avatar
0 votes
0 answers
44 views

How to extract an AutoIT script when tools fail to extract it?

Lets say you have a Autoit malware (windows executable, autoit v3), and you want to extract the script from it. But tools such as exe2aut fail to extract it. What would you do? is there any place in ...
user avatar
0 votes
2 answers
242 views

How to prevent File Modification in C++

so i want to protect my software against reverse-engineering and i want to add checksum verification to prevent patching the binary but the problem that if i added a checksum verification the binary ...
user avatar
2 votes
1 answer
301 views

Change manifest file using ResourceHacker CLI

I want to automate some manifest file changes (change requestedExecutionLevel level to requireAdministator from asInvoker) so I have to use ResourceHacker CLI. I have managed to extract the resources ...
user avatar
1 vote
2 answers
36 views

Cant Save .exe using reflixil and Red Gate Reflector 10.3

First off all im pretty new to Reverse Engineering. Im Stuck on Saving my Project. When i want to save the Assembly as .exe file Reflexil says cant save, the specified Method is not supported. I tried ...
user avatar
1 vote
0 answers
29 views

Send file or non-printable character in Immunity Debugger arguments

I am a beginner in Reverse Engineering. I am on Windows and using Immunity Debugger. I would like to send my payload on the .exe file. The payload contains non-printable characters. How I can launch ...
user avatar
0 votes
1 answer
124 views

Proxy dll doesn't load the original dll

I have relatively simple code here for the proxy DllMain() function: BOOL APIENTRY DllMain(HMODULE hDll, DWORD reason, LPVOID reserved) { if (reason != DLL_PROCESS_ATTACH) { return TRUE; } ...
user avatar
  • 146
1 vote
2 answers
220 views

Can't figure out a crash in IDA "The memory could not be read -> 00000710 (exc.code c0000005, tid 20612)"

I'm trying to debug out a game. Basically, the Steam version works perfectly but the GOG version (which is 8kb smaller) has an annoying problem where for some people (which happen to be me) the game ...
user avatar
0 votes
0 answers
112 views

Ghidra: Identify and display a struct broken into multiple smaller fields

Me vs the 90s game, part two. I'm trying to figure out how the game detects the current date, since that part doesn't work correctly anymore. At some point, GetLocalTime() from kernel32.dll gets ...
user avatar
0 votes
0 answers
29 views

There is a course in which they teach you to use WinAFL?

I would like to know if there is a course that begins in a basic way, such as how to use winAFL to find bugs in app desktop.
user avatar
  • 9
0 votes
1 answer
833 views

How to find main() of Windows EXE with Ghidra?

I'm new to Ghidra, my goal is to add localizations for a small EXE program. The program was written in Visual Studio and has Russian dialogs, which I like to convert to English. I've loaded the EXE ...
user avatar
  • 11
-1 votes
1 answer
59 views

How to find bugs in a modern desktop application with reverse enginnering?

I would like to clarify the context for the question: I have studied different types of exploiting but all the studies I have carried out were with command line programs and with functions that I ...
user avatar
  • 9
0 votes
0 answers
29 views

How to replace the modified/corrupted module image on the original in the memory dump

I'm analyzing a windows kernel crash. I have instrumented “USBPORT.sys" kernel module for collecting metrics. I named the instrumented version of the module "TARGET_MODULE". After I ...
user avatar
0 votes
0 answers
94 views

What kind of code creates this function call pattern?

While using WinDbg: u/uf to disassemble functions in ntoskrnl.exe there are functions that are used in system calls and exception handling that have these weird function call patterns and I can't ...
user avatar

1
2 3 4 5
15