Questions tagged [windows]
Windows refers to the Microsoft Windows series of operating systems.
784
questions
1
vote
0
answers
17
views
WinDbg Preview search is not returning results
I am attempting to manually unpack a malware sample. I am using the new WinDbg Preview (only thing that is available to download now). After letting the malware call VirtualAlloc I am trying to search ...
- 111
0
votes
0
answers
46
views
Why is Windows 10 still blocking me from running malware?
I am analyzing some malware on Windows 10. I installed FLARE VM, disabled tamper protection and disabled the virus scanner in the registry. However when I attempt to run a malware, Windows is still ...
- 111
0
votes
0
answers
25
views
IDA pro Error how to resolve this error
52C187F5: The instruction at 0x52C187F5 referenced memory at 0x4. The memory could not be read -> 00000004 (exc.code c0000005, tid 672)
How to Solve this.
I have seen sandbox reports in those the ...
3
votes
0
answers
38
views
Reverse engineer DPC Latency Checker tool to fix high Windows kernel timer latency
I need help with something very Windows/kernel-specific.
I'm working on a fix for the high Kernel Timer Latency in Windows 10 2004 and higher. This problem was introduced between Insider Build 18950 ...
- 31
2
votes
0
answers
29
views
How does Windows Updates determine if the patches are compatible?
I am looking into Microsoft Windows updates, and how they are applied, after extracting the .msu file, we get some .cab files with patches (in PA30 format), and informations on the file attributes, ...
- 151
3
votes
1
answer
71
views
Windows 11: Interact with IDA pro when running in session 0
I am trying to debug a windows service, so I set IDA as the debugger of that service.
But since services are running in session 0, I can't interact with IDA. Also in the latest windows version (e.g. ...
- 43
2
votes
1
answer
58
views
The same notepad.exe runs in both WoW64 and x64 modes
When I run notepad.exe with x64dbg it runs as WOW64 process. But when I run it with x32dbg it runs as x64 process with x64 instructions. I am running it from the same directory C:\Windows\System32\...
- 21
3
votes
1
answer
100
views
Why is function in kernel32.dll jumping into a api-ms-win-core stub
I was trying to look into the implementation of GetVersion function in kernel32.dll.
I was surprised to see that the GetVersion thunk is issuing a jump to API-MS-WIN-CORE-SYSINFO-L1-1-0.DLL::...
- 185
2
votes
1
answer
50
views
How does this Is64BitOS pointer-arithmetic-based function work?
Reversed this function. It works. But stepping through I can't figure out how. Why does this work?
bool _Is64BitOS(void) {
unsigned int version = *(unsigned int*)0x7FFE026C;
unsigned int ...
- 145
1
vote
1
answer
47
views
Capture and Replay
I was wondering if it was possible to create a python script that is able to capture and replay the instructions executed by a windows program for in depth analysis.
- 29
1
vote
1
answer
131
views
Forcing a legacy Windows application to use an older version of ntdll.dll
There is this old Windows application I've been using for more than a decade now: DesktopEarth. It got its last update in 2015 and the author's website is offline now, but it's been running fine on ...
- 111
1
vote
1
answer
104
views
How to access files stored in mouse?
I own a Razer Mamba Elite mouse. After plugging it in to the usb port, an software installation window shows up. Basically it's the Razer software to manage device's options such as profiles, macros, ...
- 11
1
vote
0
answers
48
views
How to decrypt data during runtime before executing and then encrypting it back
I was doing some research and came across the term protectors. From my understanding is they encrypt a file to be protected but run it without an issue. During its execution it is able to decrypt the ...
- 11
1
vote
0
answers
45
views
What is the following code will do after modifying it? [closed]
The following commands will change the files information gatherosstate.exe file. From looking at the hex values I can interpret that there are nop (0x00). The file changed in windows terminal.
But ...
2
votes
1
answer
81
views
How to call Windows console in ASM and printf some values there?
Is there a working way to embed the windows console in disasm code? I tried AllocConsole with GetStdHandle or AttachConsole with PID of an existing console but it didn't work. I have tried printf ...
- 21
1
vote
1
answer
123
views
What are latest research in reverse engineering?
I am searching research papers related to reverse engineering between 2020 and 2022 but did not found good papers with latest research in the direction of reverse engineering.
So, what are the latest ...
2
votes
1
answer
35
views
generate code execution/cpu time flame-graph of library DLL (Noob question)
I have a library DLL which I'm trying to analyze, and I have a basic understanding of its function and behavior (and can modify some input to affect how long certain operations will take to execute/...
1
vote
0
answers
40
views
How to obtain import name from disassembled assembly
I'm trying to create my own tools for reverse engineering PE. I have some assembly codes that I fetched from a clone of objdump for a program. Sometimes I see call instructions such as :
callq *...
- 11
2
votes
2
answers
168
views
Reverse function in .rdata field
I'm tracking a function called CreateIoCompletionPort in dns.exe. The import tab in IDA shows that it's imported from api-ms-win-core-io-l1-1-0.dll.
However, it appears in .rdata section in the .dll ...
- 121
0
votes
0
answers
88
views
x32dbg : exe with different code address when running
I have a 32 bits exe that works only when there is a specific usb flash disk inserted. On my new laptop, I only have a single USB port, so I want to make it works without the original key, or from a &...
- 131
2
votes
0
answers
154
views
How find all kernel functions called by a driver in windows 11
I am working on a highly obfuscated driver that is virtualized. In an attempt to work on this driver I asked a question about some python scripts which turned out not to be effective at all so I ...
- 23
1
vote
1
answer
169
views
Reverse Engineering Go obfuscated binaries
I have been trying to understand the working of this go malware by reversing it, which can be found here , so basically this stuff takes a shellcode as an input, and converts it to an exe or dll file, ...
- 11
2
votes
1
answer
56
views
How to investigate in a program of type /SUBSYSTEM:NATIVE that crashes with the RtlFreeAnsiString API?
I compiled a very simple example of an application of type /SUBSYSTEM:NATIVE writing "hello world".
It is launched thanks to the "BootExecute" key. The program works without errors....
- 51
3
votes
1
answer
108
views
Exact copy of USB flash drive
I have a USB flash drive, with 2 partitions : one is read only and contains a Windows software, and the second is read/write for user data.
In order to not damage this precious key, I want to do a ...
- 131
1
vote
1
answer
267
views
How to disassemble an entire function in Windbg?
I am trying to disassemble the function ExAcquireFastMutex using WinDbg but it gives me only 8 rows:
3: kd> u nt!ExAcquireFastMutex
nt!ExAcquireFastMutex:
fffff805`456e3820 4053 push ...
- 573
0
votes
0
answers
34
views
Is there any way to get old Windows kernel drivers?
I'm working through "Practical Reverse Engineering" and absolutely loving it so far. However, some of the exercises involve "decompiling" some Windows kernel files (like ...
0
votes
1
answer
71
views
Find out which struct RaGetUnitStorageDeviceProperty use by reverse engineering
I am trying to find out which struct storport!RaGetUnitStorageDeviceProperty uses by myself. I know I can use google and find out the correct answer is _RAID_UNIT_EXTENSION. However i want to do it ...
- 23
2
votes
1
answer
157
views
STATUS_PRIVILEGED_INSTRUCTION 0xc0000096 from kernel mode code?
Running a kernel driver I wrote. The driver includes:
mov rax, cr0
btr rax, 10h
mov cr0, rax
to clear WP bit in cr0. Curiously the last instruction faults and causes a bluescreen, ...
1
vote
1
answer
74
views
Finding Correct Segment From An Address For Windows 3.1 EXE in IDA Pro
We have an EXE that IDA pro lists the following segments:
Name Start End R W X D L Align Base Type Class AD es ss ds fs gs
cseg01 00000000 0000EA50 ? ? ? . ...
- 1,165
2
votes
0
answers
84
views
Are system dlls like NTDLL and KERNELBASE etc. are always loaded at the same address on a per-session basis?
If I am understanding, code and read only sections of common DLLs are given system-wide section objects for which each process gets its own section view, in order to save physical memory. As such even ...
2
votes
1
answer
75
views
Programmatically Find COM Object Method Offset in Image from Method Name
What is a way to lookup a COM method offset with an image, just based on the module name and method name.
For example want to find "Exec" method in "WScript.Shell" In this scenario ...
- 1,165
0
votes
0
answers
207
views
c000001d (Illegal instruction)
My Windows crashed, don't understand it shows 'Illegal instruction' on a simple 'strlen' instruction:
*******************************************************************************
* ...
- 101
1
vote
0
answers
145
views
Finding the main function on Windows compiled executables
For a C/C++ program compiled on Windows using the x86 architecture, what is the best way to find the main function within disassembled code without relying on signatures such as FLIRT?
I've found ...
- 21
0
votes
1
answer
51
views
Which function or file is responsible for initialization of g_37HashSeed
I'm checking tcpip.sys file in IDA and found that in the .data part
there is an int called g_37HashSeed.
This seed is an input for a hash function that I look into.
Can someone tell me which program ...
- 121
0
votes
0
answers
71
views
How to get the call stack of WinAPI functions?
Yesterday, I noticed an answer to a question about the purpose of a certain undocumented function, which is a call stack (including the DLL library) for this function, This got me interested in the ...
- 5
1
vote
2
answers
50
views
I need simple debugger source
How can I write a simple debugger for Windows? I need to launch another program (do not attach to an already running one, but launch it yourself) then to let it run and to catch it at a certain ...
0
votes
1
answer
54
views
Symbol name tcpip!IppInitializePathSet found in windbg but unable to find function IppInitializePathSet in tcpip.sys
I'm debugging windows server 2019 in windbg and I want to find function IppInitializePathSet. However, I can't find the function in IDA but I can find the symbol named tcpip!IppInitializePathSet. How ...
- 121
1
vote
1
answer
92
views
x86 weird register call
I am digging with disassembler inside old game (release year 2002) and something is bugging me, I noticed it has a bunch of... questionable instructions. One of the things it does is calling imported ...
- 11
1
vote
0
answers
75
views
x64 Windows: Why is ExAllocatePool stepping on the caller's stack?
I am playing around with windbg on a 64-bit machine and noticed something interesting:
nt!ExAllocatePool:
...
sub rsp, 0xd0
...
mov qword ptr [rsp+0xf8], rbx
Windows only allocated ...
- 11
0
votes
0
answers
54
views
Is there any available source code which is Windows 64 bit compatible that can disassemble binary code?
I'm writing a program that takes as input a single byte of binary (machine code from code segment) and converts it into assembly. I've done some searching online but have yet to find anything helpful. ...
- 1
0
votes
0
answers
50
views
How to reverse an import function?
I'm reversing windows .sys file and an import function RtlLookupEntryHashTable appears in my target functions. I want to know the pseudocode of it. How to achieve this?
.text:00000001C00218C2 ...
- 121
0
votes
0
answers
33
views
Need help finding a windows struct
What I know about it:
struct unknown_struct
{
struct _KAPC apc;
struct _KEVENT event;
char unknown[2056];
};
So first a kernel apc struct then a kernel event struct and the total size is ...
2
votes
1
answer
70
views
Getting "Flow analysis was incomplete, some code may be missing" on WinDbg
I wanted to perform static analysis on the Win32 function CreateFileW, so I loaded kernel32.dll using WinDbg and perform the command uf kernel32!CreateFileW.
But I am seeing the following output ...
- 185
6
votes
4
answers
3k
views
Do I have to learn computer architecture for underestanding or doing reverse engineering?
I am completely noob in reverse engineering, and I've just started to learn it.
Now I have this question in my mind, that does a reverse engineer use any computer architecture knowledge for doing his/...
- 63
0
votes
0
answers
47
views
windbg shows different instruction at address when you set the breakpoints in 2 different breaks but not the same break (nvd3d9wrapx thunk in user32)
In the first example I only set a breakpoint on user32!CreateWindowExW
In the second example, I set 2 breakpoints at the same time on user32!CreateWindowExW and notepad!WinMain
In the 3rd example I ...
- 265
1
vote
1
answer
495
views
Why is JMP ESP required in buffer overflow?
I was reading this article by Hackers Grimoire on Windows buffer overflow attacks.
The article made sense, except for the part where the author searched for a DLL (.dll) file which contained a JMP ESP ...
- 113
3
votes
1
answer
1k
views
How do I unpack a file protected by MPRESS?
I have a file that is protected by MPRESS packer and I want to know how to unpack it on Windows. Is there a specific program for that or something else? I am new to this so every help is appreciated.
- 31
1
vote
0
answers
42
views
How do I read/edit a .xuk file extension?
I am trying to reverse engineer a license key for some software, the company that made it went out of business. In doing so, if you didn't already have the key their $50,000 machines become ...
- 11
2
votes
1
answer
348
views
Function pointer and symbols in Ghidra
I am using Ghidra and I see that when it uses function pointers it never shows the paraments that are being sent to the function(In IDA pro, it always show the parameters). How can I fix that it will ...
- 31
0
votes
1
answer
51
views
ida jumping to address I can't see in driver
When I open this driver in IDA i can't seem to see the instructions that this jmp at 0x1400DC46D jumps to.
I've tried to undefine bytes and re-analyze the function but it then ends up will garbage. ...
- 21