Questions tagged [windows]

Windows refers to the Microsoft Windows series of operating systems.

Filter by
Sorted by
Tagged with
0 votes
0 answers
27 views

Is there any way to get old Windows kernel drivers?

I'm working through "Practical Reverse Engineering" and absolutely loving it so far. However, some of the exercises involve "decompiling" some Windows kernel files (like ...
0 votes
1 answer
48 views

Find out which struct RaGetUnitStorageDeviceProperty use by reverse engineering

I am trying to find out which struct storport!RaGetUnitStorageDeviceProperty uses by myself. I know I can use google and find out the correct answer is _RAID_UNIT_EXTENSION. However i want to do it ...
1 vote
1 answer
38 views

STATUS_PRIVILEGED_INSTRUCTION 0xc0000096 from kernel mode code?

Running a kernel driver I wrote. The driver includes: mov rax, cr0 btr rax, 10h mov cr0, rax to clear WP bit in cr0. Curiously the last instruction faults and causes a bluescreen, ...
1 vote
1 answer
27 views

Finding Correct Segment From An Address For Windows 3.1 EXE in IDA Pro

We have an EXE that IDA pro lists the following segments: Name Start End R W X D L Align Base Type Class AD es ss ds fs gs cseg01 00000000 0000EA50 ? ? ? . ...
2 votes
0 answers
38 views

Are system dlls like NTDLL and KERNELBASE etc. are always loaded at the same address on a per-session basis?

If I am understanding, code and read only sections of common DLLs are given system-wide section objects for which each process gets its own section view, in order to save physical memory. As such even ...
2 votes
1 answer
69 views

Programmatically Find COM Object Method Offset in Image from Method Name

What is a way to lookup a COM method offset with an image, just based on the module name and method name. For example want to find "Exec" method in "WScript.Shell" In this scenario ...
0 votes
0 answers
50 views

c000001d (Illegal instruction)

My Windows crashed, don't understand it shows 'Illegal instruction' on a simple 'strlen' instruction: ******************************************************************************* * ...
  • 101
1 vote
0 answers
52 views

Finding the main function on Windows compiled executables

For a C/C++ program compiled on Windows using the x86 architecture, what is the best way to find the main function within disassembled code without relying on signatures such as FLIRT? I've found ...
  • 21
0 votes
1 answer
49 views

Which function or file is responsible for initialization of g_37HashSeed

I'm checking tcpip.sys file in IDA and found that in the .data part there is an int called g_37HashSeed. This seed is an input for a hash function that I look into. Can someone tell me which program ...
0 votes
0 answers
52 views

How to get the call stack of WinAPI functions?

Yesterday, I noticed an answer to a question about the purpose of a certain undocumented function, which is a call stack (including the DLL library) for this function, This got me interested in the ...
1 vote
2 answers
48 views

I need simple debugger source

How can I write a simple debugger for Windows? I need to launch another program (do not attach to an already running one, but launch it yourself) then to let it run and to catch it at a certain ...
0 votes
1 answer
31 views

Symbol name tcpip!IppInitializePathSet found in windbg but unable to find function IppInitializePathSet in tcpip.sys

I'm debugging windows server 2019 in windbg and I want to find function IppInitializePathSet. However, I can't find the function in IDA but I can find the symbol named tcpip!IppInitializePathSet. How ...
1 vote
1 answer
82 views

x86 weird register call

I am digging with disassembler inside old game (release year 2002) and something is bugging me, I noticed it has a bunch of... questionable instructions. One of the things it does is calling imported ...
1 vote
0 answers
62 views

x64 Windows: Why is ExAllocatePool stepping on the caller's stack?

I am playing around with windbg on a 64-bit machine and noticed something interesting: nt!ExAllocatePool: ... sub rsp, 0xd0 ... mov qword ptr [rsp+0xf8], rbx Windows only allocated ...
0 votes
0 answers
51 views

Is there any available source code which is Windows 64 bit compatible that can disassemble binary code?

I'm writing a program that takes as input a single byte of binary (machine code from code segment) and converts it into assembly. I've done some searching online but have yet to find anything helpful. ...
  • 1
0 votes
0 answers
31 views

How to reverse an import function?

I'm reversing windows .sys file and an import function RtlLookupEntryHashTable appears in my target functions. I want to know the pseudocode of it. How to achieve this? .text:00000001C00218C2 ...
0 votes
0 answers
27 views

Need help finding a windows struct

What I know about it: struct unknown_struct { struct _KAPC apc; struct _KEVENT event; char unknown[2056]; }; So first a kernel apc struct then a kernel event struct and the total size is ...
1 vote
1 answer
37 views

Getting "Flow analysis was incomplete, some code may be missing" on WinDbg

I wanted to perform static analysis on the Win32 function CreateFileW, so I loaded kernel32.dll using WinDbg and perform the command uf kernel32!CreateFileW. But I am seeing the following output ...
6 votes
4 answers
3k views

Do I have to learn computer architecture for underestanding or doing reverse engineering?

I am completely noob in reverse engineering, and I've just started to learn it. Now I have this question in my mind, that does a reverse engineer use any computer architecture knowledge for doing his/...
0 votes
0 answers
26 views

windbg shows different instruction at address when you set the breakpoints in 2 different breaks but not the same break (nvd3d9wrapx thunk in user32)

In the first example I only set a breakpoint on user32!CreateWindowExW In the second example, I set 2 breakpoints at the same time on user32!CreateWindowExW and notepad!WinMain In the 3rd example I ...
1 vote
1 answer
65 views

Why is JMP ESP required in buffer overflow?

I was reading this article by Hackers Grimoire on Windows buffer overflow attacks. The article made sense, except for the part where the author searched for a DLL (.dll) file which contained a JMP ESP ...
2 votes
1 answer
285 views

How do I unpack a file protected by MPRESS?

I have a file that is protected by MPRESS packer and I want to know how to unpack it on Windows. Is there a specific program for that or something else? I am new to this so every help is appreciated.
  • 21
1 vote
0 answers
37 views

How do I read/edit a .xuk file extension?

I am trying to reverse engineer a license key for some software, the company that made it went out of business. In doing so, if you didn't already have the key their $50,000 machines become ...
  • 11
0 votes
1 answer
144 views

Function pointer and symbols in Ghidra

I am using Ghidra and I see that when it uses function pointers it never shows the paraments that are being sent to the function(In IDA pro, it always show the parameters). How can I fix that it will ...
  • 1
0 votes
1 answer
30 views

ida jumping to address I can't see in driver

When I open this driver in IDA i can't seem to see the instructions that this jmp at 0x1400DC46D jumps to. I've tried to undefine bytes and re-analyze the function but it then ends up will garbage. ...
  • 21
2 votes
1 answer
69 views

Mov instruction from a pointed location at the beginning of a program

I am trying to learn how to read assembly code. So far I have understood the basic instructions. Now I am trying to see if I can understand a dissassembly from a linked executable. So this is an ...
  • 143
1 vote
1 answer
31 views

Calling a function with a variable number of args from a proxy DLL

The program I'm messing with has builtin logging. Using a proxy DLL, I managed to activate it by calling the right functions from the real DLL. However, I got stuck at using the actual logging ...
2 votes
1 answer
163 views

Understanding disassembly information from Visual Studio's dumpbin and GNU's objdump

I usually write my code on Windows, and there are two different types of development environments, each providing their own tools to view the assembly code of an object file(*.obj) or executable (*....
  • 143
1 vote
0 answers
32 views

How to convert addresses shown by IDA when statically analyzing a DLL to real addresses in runtime

In a DLL I am trying to reverse there often is a reference to something I believe to be a fixed pointer (like a global var) which looks like dword_10038534. The references I am talking about look like ...
0 votes
0 answers
18 views

How are system page map entries belonging to process's updated?

Every process has its own PML4 table, and the first 9 bits of the 48-bit virtual address describe the index of a PML4 entry. The first bit of the PML4 index is clear for user code and set for kernel ...
1 vote
1 answer
488 views

How to load a PDB file into x64dbg?

I want to see symbols in the disassembly wherever possible, and I have a PDB file for the .exe I'm debugging, but I can't find a way to load the PDB file from disk. Is it even possible?
0 votes
1 answer
663 views

Frida hook multiple processes

There was such a situation. I run the frida hook on the process like this: frida -f '..\hack2\hackme.exe' -l .\start.js In the script itself I do this var moduleData = Process.getModuleByName("...
  • 13
1 vote
1 answer
59 views

What are these Device Object Characteristics / Flags in Windows 10 ntoskrnl!IopParseDevice

In Windows 10 looking at ntoskrnl!IopParseDevice I'm trying to work out the name / purpose of the flags in this check, which seem to be testing for values in a DEVICE_OBJECT Characteristics property ...
1 vote
2 answers
78 views

IDA show xrefs in .pdata and nothing else

I'm debugging the Windows ARM64 version's EFI (bootaa64.efi). Using QEMU and GDB I was able to find that bootaa64.efi was stuck in one of the two functions BlKernelSp0SystemErrorHandler and ...
2 votes
0 answers
26 views

Why does OllyDbg label data segment as read only?

I'm working on this problem: Challenge 53 When compiling with cl c53.c /Fac53.asm /MD in VS2019 X86 Development Console and loading the .exe into OllyDbg, I found OllyDbg labels all segments of c53 as ...
0 votes
0 answers
21 views

How to initiate usb connection as usb display

I'm trying to essentially make an hdmi dummy plug to trick the computer into thinking there is a second monitor. I am planning on doing it by having a raspberry pi pico act as a usb monitor. (much ...
1 vote
1 answer
85 views

Why is Visual Studio compiling my EXE file with an entry point that is not in the file?

So I am trying to open my test app EXE file in ollydbg to study the assembly, the stack, registers and all that stuff for educational purposes and it gives me this message saying that the entry point ...
0 votes
0 answers
20 views

How to download previous releases that were published on Windows Store?

Often it's useful when Reverse Engineering to compare releases to one another. Windows Store has previously been unpopular, but is getting increasing use. Utilities like https://github.com/microsoft/...
1 vote
1 answer
126 views

Instructions to compare two strings

I made a list of which instructions compare two strings in disassembly so that when I get to intermodular calls in x64dbg, I can simply type this instructions to see if there is a comparison have been ...
1 vote
0 answers
57 views

Reverse engineering unknown data file

I have a set of datafiles that I want to reverse engineer which are used by a software that controls my heating system. I want to extract the commands to then use these commands in my home automation ...
0 votes
0 answers
41 views

Phoenix Exploit Education, Powershell script not working the error: '-netdev:user: invalid option','vmlinuz-4.9.0-8-amd64': No such file or directory

I tried these 2 scripts to set up phoenix from Exploit-Education but faced the below errors could not find any other script online one was from https://blog.lamarranet.com/index.php/exploit-education-...
1 vote
1 answer
58 views

funcion calls extern function without body

I wanted to look at how does the Windows API get the size of a file, so I opened kernel32.dll in a disassembler. I searched for GetFileSizeEx, and it seems to call a stub(?), but the disassembler ...
  • 35
0 votes
0 answers
265 views

How to identify if an .exe packed by VMProtect has virtualization enabled?

I am interested in reverse engineering a few parts of an .exe application (windows 32-bit executable) that downloads some documents from a server and decrypts them locally in memory. Using PE EXE ...
0 votes
1 answer
94 views

Understanding the meaning of EBP + 0xffff98b4

I'm currently reverse-engineering an old game from 2003 to extend its functionality. I have now found what I am looking for and since it was written in C++ I'm trying to re-create the used classes. I ...
0 votes
0 answers
75 views

How can i reconstruct a full PE from a memory injected PE that only has IAT + sections content?

I have a injected PE (kernel mode rootkit to be exact) that only has the IAT table, which basically only stores the addresses of some kernel functions in an array which is referenced inside its code, ...
-1 votes
1 answer
241 views

Windows reverse engineered?

Have read in some Discord channel, that Windows was reverse engineered. Does anybody here have knowledge about such reverse engineered Windows version? If it really exists, where can it be downloaded?
  • 121
1 vote
1 answer
134 views

Windows UI freezes except the debugger itself when a breakpoint is hit in every debuggers I tried on a particular application

I'm trying to "trace" (just setting breakpoint, step in, step over to know how certain things work) an application. But if the application enters suspended state by using breakpoint, every ...
0 votes
1 answer
47 views

One class with different sizes

After looking at some basic examples of how C++ classes are compiled by MSVC, I tried to apply the knowledge to a DLL I'm working on. While searching for a class to start with, I came across ...
0 votes
1 answer
588 views

How do I get all sections in a PE file using C++?

So I am wondering how can I get all sections and their info from a dumped PE file on the disk, using C++. I have the entire PE loaded on a buffer, the NT headers, and hopefully the DOS headers. I need ...
0 votes
0 answers
41 views

How to redirect connections by an exe file to a specific external ip address

I have an exe program that connects randomly to one of the 4 addresses 188.39.21.82...83...84...85 out of which only 82 works Currently I blocked the remaining addresses using Windows 10 Firewall ...
  • 103

1
2 3 4 5
16