We’re rewarding the question askers & reputations are being recalculated! Read more.

Questions tagged [windows]

Windows refers to the Microsoft Windows series of operating systems.

Filter by
Sorted by
Tagged with
1
vote
1answer
59 views

Call function by ebp

When I looking at exe file with Ida I see call dword ptr [ebp -70p] What is that? Why this function calling by ebp and not call sub_0xabcd How can I know which function is that to enter to this ...
0
votes
0answers
36 views

How to know which exe call to dll

I Have few exe in windows that running, and I have 1 dll file that export few functions. How can I know which exe call to specific function from dll?
2
votes
1answer
26 views

IAT vs GOT address resolving: which of them resolve during runtime and which during load time by default?

So based on my knowledge on windows apps, as far as i know the IAT gets filled with correct addresses when the library gets loaded (correct me if I'm wrong) now in linux, they use GOT, and again ...
0
votes
0answers
26 views

Intel Pin assertion failed: RTN_Valid(x)

I am working on modifying my Intel Pin based tool. As before I am using VS2015 on Windows 10. Previously, I have been testing a tool on the same system where I build it and it worked just fine. The ...
0
votes
1answer
61 views

mfc140 dll , what is the usage?

While I open exe file in ida I can see lot of calls to mfc140_6153 or mfc140_8718. What are those functions ? what they do ? thanks
2
votes
0answers
27 views

Get NonPagedPool (NPP) Base Address on any Windows OS

Is there a way to get the the base(start) address of the NonPagedPool in Windows ? I know that it's dynamic for Post windows 7 Operating Systems (Does this include Windows server 2008 ?)
0
votes
0answers
23 views

Alternative APIs to hook instead of messagebox for message pop ups?

So i am reversing an app that pops up a message at some point, but its not doing this using messagebox i also tried to pause and then run to user code but didn't work, so what are some of the other ...
0
votes
2answers
61 views

Is relocation table only used for absolute addresses?

I was reading about mapped and unmapped PE format, and how the alignment between sections changes after loading it into memory and that caused two question for me: is the relocation table used before ...
0
votes
2answers
41 views

Which APIs are responsible for terminating process icons in Taskbar?

I am trying to reverse and debug a program but it exists after certain point, tried setting breakpoint on any inter module call that starts with exit or terminate, now here's the weird part : it does ...
-1
votes
2answers
61 views

How to add a message box to a PE [closed]

So, I have a "simple" question. I have this PE that I want to show a message box when the file is launched. How can I patch the file and make the window? Thanks!
0
votes
1answer
75 views

Can GUI elements of a running program be found/located in memory?

Is it possible for a particular GUI element of a running program (on Windows platform) to be located in memory, such as a text element from a dialog box? For example, locating title text of a drop-...
0
votes
1answer
77 views

Possible to get address of DRIVER OBJECT programmatically?

I am looking into getting the address of a dispatch routine. For example, I can get it with windbg easily like so: 0: kd> !drvobj HEVD 2 Driver object (ffffa70752fdbe30) is for: \Driver\HEVD ...
1
vote
2answers
98 views

Find a instruction in a binary file (PE) based on a virtual address of a string reference

English is not my first language, so I'm sorry if my text isn't so clear. I'm trying to program an automatic patcher for a PE binary that should work for multiple versions of this executable. For ...
0
votes
1answer
69 views

I'm trying to understand the SEH mechanism

I'm trying to understand the mechanism of SEH (Structured Exception Handling). I understood how it was recorded and saved in FS: [0] on the previous three instructions. But why add interrupt 1 (step ...
2
votes
1answer
63 views

__security_cookie for function pointers in Windows 10

I'm curious about this __security_cookie that I keep seeing all over the msvcp140.dll from my Windows 10 x64 (insider build.) Here's an example: Note that the address for indirect function call (or ...
0
votes
3answers
101 views

Injecting C++ code, while also maximizing compatibility with other injections

Using the New Vegas Script Extender C++ API for Fallout New Vegas, I am able to write to the process' memory directly at runtime through a .dll plugin that's loaded by the NVSE injector. But it is not ...
1
vote
0answers
39 views

How to identify the NonPagedPool Start Memory address from a memory dump

I need to find the memory address where starts the NonPagedPool. I saw some people doing it with Rekall, but I'm having a lot of problems with it. Is that possible with Volatility ? Tks
1
vote
3answers
113 views

How to find the starting address of text section of a DLL inside a process? (64 bit)

There was a question about this a year ago, but the answer doesn't explain how to do it in C/C++: How to find start of .text section? I'm not talking about module start address, which we can get ...
0
votes
0answers
60 views

injecting through APC using LdrLoadDll fails on `CiValidateImageHeader`

I've encountered an image validation error while trying to inject dll from driver which add apc task to be performed by alertable thread. the function task include calling to LdrLoadDll with the ...
1
vote
2answers
79 views

Does the loader fill the IAT table of an .exe in load time by checking the corresponding export tables or during run time?

I came upon this question : Can we hook the Nt or Zw functions using IAT hooking, or just inline hooking? and it got me wondering, lets say for some reason some function was not in the IAT of our ...
0
votes
1answer
136 views

Can we hook the Nt or Zw functions using IAT hooking, or just inline hooking?

So i was trying to hook the ZwQuerySystemInformation or NtZwQuerySystemInformation using IAT, but i found out that these are not inside the IAT inside the memory nor in the PE file but maybe i am not ...
2
votes
1answer
87 views

How to hide a process from all the methods of getting the list of processes?

So it seems that there are a lot of ways of getting the process list, although I'm not sure whether in the low level do they acquire them from same place or not so these are the ways i know : ...
0
votes
0answers
55 views

What's the point of changing the CS register and can any process do this?

So i was reading this article : http://waleedassar.blogspot.com/2012/07/wow64-user-mode-system-calls-hooking.html which explains the wow64, the part that we do a far jmp and change the CS register ...
0
votes
1answer
100 views

Why address 7FFE0308 always gets compared in 64bit applications before making a syscall in Ntdll?

So there was a question asked before about this : What are the difference syscall and int 0x2E instructions? and it has two answer, one says that is just a way to check if we are in a 32 bit or 64 ...
1
vote
1answer
60 views

What is the ending bytes in the MOV instruction in 32 bit applications in windows? (B8 mov)

So i just compared NTterminateProcess between 32 and 64 bit version of a program, and the mov instruction which moves the syscall into eax is almost the same, both 5 byte, (both the B8 mov) but the ...
0
votes
1answer
54 views

PE Header: What do SizeOfHeapCommit and SizeOfHeapReserve do?

SizeOfHeapReserve and SizeOfHeapCommit are in the optional header of windows executables. They are set to 0x100000 and 0x1000 respectively in most executables (my firefox has 0x40000 as reserve for ...
0
votes
0answers
54 views

How to research the executable file of a game written using the Unreal Engine?

I want to make changes to the gameplay of a game written using the Unreal Engine. To do this, I need to find the function that interests me, embed my DLL in the game process, and change the pointers. ...
1
vote
1answer
45 views

What does BindImageEx actually do?

Docs. If I understand this correctly, this function pre-computes virtual addresses of imported DLLs and writes them to the IAT of an image (provided that BIND_NO_UPDATE is not set as parameter). My ...
1
vote
1answer
69 views

Getting started with RE, with eventually goal being able to make a keygen [closed]

I want to get started in RE and eventually want to be able to figure out how to calculate a serial from a username/license number from program number, etc... (meaning the software tests the serial ...
2
votes
1answer
35 views

Partially correctly decoded strings from pkware zip with known plaintext

I have a password-protected zip file, where the paths and filenames of each file are encrypted using PKWARE encryption. The password is known and correct, and so is the encryption algorithm. I also ...
-1
votes
1answer
57 views

malware analysis [closed]

I tried to use process monitor to find out what program 4.exe did on my system. However, I could not find what changes were made. I believe that this program modifies some files and the registry, but ...
0
votes
1answer
142 views

Info on ProcMon from SysInternals

I need help. I am reversing Procmon64.exe file. It drops procmon.Sys filesystem minifilter driver which does monitoring. Question: I need to know if filtering of events is done in user-mode or ...
0
votes
1answer
78 views

The executable file makes a unique ID from each individual PC. Can anyone decipher from where the file makes these unique IDs?

The file generates random unique ID. It says hardware ID but I couldn't find it in product key, BIOS serial number or anywhere. I used IDA but I couldn't get from where the file creates the code. Even ...
1
vote
1answer
78 views

change PE file icon without re-signing the file all over again

Is there any option to set new icon for a signed PE executable in windows without re-signing it again. This means that the icon image, although fully assimilated to the PE file, won't change the hash ...
5
votes
1answer
237 views

Microsoft Edge and it's related processes may have turned protected in windows 10 1903

It seems like driver based injection using APC calls fails on MicrosoftEdge and it's related processes (browser_broker.exe , MicrosoftEdgeCP.exe and MicrosoftEdge.exe). Looking into the problem, it ...
1
vote
1answer
103 views

Finding out what calls win32u.dll functions

There's a button which, when clicked, writes some data to the clipboard. I'm trying to call the function this button executes using DLL Injection. I managed to find the function in win32u.dll which ...
0
votes
1answer
176 views

Dump value of register using frida

I'm new with frida and came to this problem. I have dll that I want to reverse engeneer(there are no debug symbols). Specifically I want to dump some data from a function. So I have this big function ...
0
votes
1answer
34 views

Exported DLL function has only stdcall with some offset

I am quite new to reverse engineering. I have opened .dll (x86) in IDA Pro and I have noticed few exported functions. The issue is that all of them looks like this: IDA pseudocode: int __stdcall ...
1
vote
1answer
36 views

What does -c mean in this Windbg Command Syntax?

kd> u win32k!impPsIsThreadTerminating+0xe4-c L5 | \ \ \ \ \ / \ \ \ \ \ / \ \ \ \ \ ...
0
votes
2answers
62 views

Find Target to Call Dword Ptr in 16-bit Windows with IDA Pro

Looking for suggestions on steps that could be used to identify what code would get executed at call dword ptr es:[bx+0Ch] from static analysis. cseg04:3044 loc_105D4: ; ...
1
vote
1answer
53 views

Find Reference To Resource String In Windows 3.1 16-bit DLL with IDA Pro

Experimenting Visual Basic 4 in DosBox + Windows 3.1 running on Windows 10. While I have installed SHARE.exe from MS-DOS 6.22 and it seems to run OK, it still fails to detect it. The error I get is : ...
1
vote
0answers
52 views

Downgrade HTTPS (strip SSL ) to HTTP on Windows (if possible) [closed]

Long Question: I have an Android app: https://transfer.sh/mY240/com.phonegap.voyo.apk which connects to an API: http://www.24ur.com/lbin/WebApp/Popplus/Android.php the problem is the api authors are ...
0
votes
0answers
80 views

find a video file in memory dump of a process

I have a player that plays encrypted video files and works like this: I open an encrypted video file with it it decrypts the video file and writes it to its memory and plays the file from the memory ...
1
vote
0answers
64 views

Dump the value of register into file

I've reverse engineering little game on windows 32bit. I found a string in executable which was interesting for me (it is a board game and this string represents the fact that somebody made a move ...
0
votes
1answer
78 views

ACCESS_VIOLATION when attaching a debugger

I'm debugging a software and it hits access violation on wcslen function under debugger but runs normally without it. First I thought It had some anti-debug trick, but I could not found any ...
0
votes
1answer
62 views

ASCII strings not showing up in CPU in OllyDbg, but rather in dump

I'm pretty much new to the Reverse Engineering and assembly language. I've watched some videos about OllyDbg and cracking serial numbers in programs and I got interested in them and I want to learn ...
0
votes
1answer
61 views

'local call from' in x64dbg

In OllyDbg there was a thing called "local call from xxx,xxx,xxx,xxx ... " which helps me know from where a function is being called in the entire module. Does such a feature exist in x64dbg as well?
0
votes
1answer
59 views

accessing nt!Kd_DEFAULT_MASK using dbh.exe

I would like to set the value of the above variable to 0xFFFFFFFF using command line. I was exploring dbh.exe and believe it will atleast give some clues on where the symbol is. But when I try the ...
2
votes
2answers
169 views

Debug program using peculiar anti-debugging technique

In my BA thesis, I wanted to present a program for Windows, using various anti-debugging techniques. One of them, which I came up on my own (possibly it is well known, but I didn't find it anywhere) ...
0
votes
1answer
167 views

Analyzing Windows kernel driver

I'm trying to analyze some Windows kernel driver. What I want to achieve is full execution trace, from driver entry to end point. Driver is heavily virtualized and contains multiple anti-debugging ...