Questions tagged [windows]

Windows refers to the Microsoft Windows series of operating systems.

Filter by
Sorted by
Tagged with
1
vote
0answers
35 views

How to disassemble win32 function RegSetValueExW?

I have opened up advapi32.dll in IDA and found out that RegSetValueExW is just a jump to RegSetValueExW_0. And RegSetValueExW_0 seems to be an extern. How do I actually disassemble RegSetValueExW_0?
-1
votes
0answers
28 views

Windows PE File Where is the table located SEH?

I compile the file using MSVC. I am aware of the existence of the exception directory, but it is empty in my file. Although the code contains four SEH handlers. I wonder where, in this case, the ...
2
votes
1answer
44 views

Unable to attach into mysterious PID

I have a suspicious process. I found it by ProcessHacker's network tab. ProcessHacker display the process as Unknown. The process listening into a constant port number that's also not found by ...
2
votes
1answer
58 views

Extracting strings from binary files (.exe)

This question has been asked quite a lot especially on stackoverflow, but the solutions/replies are not clear or extensive. What I`m looking for is to build what Strings does from Sysinternals. My ...
2
votes
1answer
51 views

How to find sleep() in ollydbg or IDA or ghidra

I have a program which converts videos from a proprietary format into mp4. The conversion is very slow and CPU utilization is less than 1%. I'm able to speed up the conversion process via Cheat Engine'...
0
votes
1answer
42 views

Disassembly call function offset from RIP

I am writing a program where I map an .exe PE file in memory and I "dissect" it. I am disassembling the .text section of the target executable, using the distorm disassembler. CALL ...
0
votes
2answers
45 views

Import header files in IDA to get the struct definitions?

I am reversing a program that has a lot of internal structs in it. The problem is that there are a lot of structs, so i can't import them manually using local types->insert. Lets say i have some ...
0
votes
1answer
24 views

Find out version of statically linked MFC from an exe

I have an exe with symbols stripped that I am trying to reverse engineer. I know the library is linked with MFC but I don't know which version. (Therefore, I can't use something like FLIRT signatures ...
0
votes
0answers
52 views

Can I reverse engineer original file names?

I'm new to IT and I turned my external hard-drive into a windows boot disc. I managed to recover files with testdisc & photorec_win. The downside is I got more than I bargened for and I have twice ...
1
vote
1answer
57 views

Merging a large number of segments in IDA Pro

I'm working with a memory dump of a protected win32 program. Something causing me a lot of pain is the program being split into roughly 3,000 contiguous small segments (i.e. instead of just .text and ....
0
votes
0answers
41 views

WMI Spoofing by Fastprox.dll Hooking

I m trying to spoof WMI output by hooking the fastprox.dll. Here is the code I m working on: typedef HRESULT(__stdcall* tGetFunc)(IWbemClassObject*, LPCWSTR, LONG, VARIANT*, CIMTYPE*, long*); static ...
0
votes
1answer
45 views

How much of the kernel does remote kernel debugging allow you to debug?

This is a theoretical question because I've never set up remote kernel debugging before -- but I will do at some point, which should hopefully answer some of the experimental questions I have. What ...
-1
votes
0answers
38 views

Recommendations for C++ Junk Code Generator / Obfuscator

Is there any recommendations for open-sourced C++ junk code generator? I would like to add junk code to my application. I've tried to download this tool but couldn't download :( Thanks a bunch for ...
0
votes
0answers
34 views

new to malware analysis and disassembly. dotpeek has been helpful. is this unreadable code due to SuppressIldasmAttribute?

just getting into rev engineering malware. i want to get to source on my own. i could use run.any or VT but that's no fun. any reason why this is unreadable the way it is? is it due to the module ...
0
votes
0answers
18 views

Set standard input/output to a process using NtCreateProcessEx

In the official Windows API function CreateProcessA is possible set or change the standar input and output of the process vía LPSTARTUPINFO structure. How can do this using the undocumented function ...
0
votes
1answer
69 views

Why a single “nop” crashed the game?

I hope answer to my question is not game/app specific and can be answered in communities like this. So, I tried to use some internal functions of a game, like pick a target. No malicious intentions, ...
1
vote
1answer
52 views

does mov DWORD PTR 32[rsp], 5 means mov DWORD PTR [rsp+32], 5?

I am learning about windows x64 calling convention, where the first four arguments are passed to registers and left arguments are passed through the stack. To see it, I checked the assembly of the ...
0
votes
1answer
33 views

Switch between debuggers while paused on a breakpoint

Is it possible to switch between debuggers and preserve where you are paused? Often times I find myself wanting to use a feature from a different debugger while paused in a specific context as each of ...
0
votes
2answers
56 views

kd live local debugging !pte and db don't work (only shows context of the debugger for all contexts), but !vtop works

Says the PDPT and PDs of the process are at the same physcial frames (pfns) in both processes. The first process is winword.exe and the second process is calc.exe The virtual address in the first case ...
0
votes
0answers
24 views

How to apply complete type information from PDB for multiple images in one IDA database?

IDA is capable of loading multiple images/DLLs into the same database. In this scenario, ntdll.dll and kernel.dll have been loaded additionally to the main target .exe-file into the database. On top ...
0
votes
0answers
49 views

Reversing Windows binary to find where the error is with Ollydbg

I've some experience with gdb and debugging in Linux environment (I'm studying computer science at University and I'm able to handle bof in Linux). The problem now is on a Windows program. I start it ...
0
votes
0answers
50 views

SSL pinning and bypass

I'm currently investigating one very suspicious app on my system (Windows 10 x64 bit). I wanted to try and understand outgoing https traffic it utilizes by trying to MITM it using Fiddler but as I ...
0
votes
1answer
49 views

PE Self Injection Not Working

I'm working on different PE Injection technique. I want inject PE file into virtual memory of current executable. After that, I want execute injected PE file, I wrote inject code but my method is not ...
0
votes
0answers
23 views

Smart Battery Issues, a RE Quest?

TL;DR: Perhaps this doesn't sound like a RE post at first, but it's kind of moving in that direction. Essentially, I replaced the battery in my Surface laptop with 2x different new batteries, and they ...
0
votes
0answers
23 views

Thread keeps generating page fault

So i was recently trying to exploit a kernel mode driver (HEVD) and I encountered a problem which doesn't make sense to me. After i jumped to my shellcode (which resides in usermode), the thread keeps ...
0
votes
0answers
30 views

Fuzzing Third Party Windows Drivers

I want to contribute to vendors while learning how to be a security researcher, and I was wondering: How can I fuzz third party windows drivers? (For instance, those that come with cpu/gpu and similar ...
0
votes
2answers
88 views

CaptureBAT equivalent on Windows 10?

Hello RE community on stack ! I am a beginner, so please pardon any commonplace errors I am looking to run CaptureBAT on a Windows 10 VM, to capture network activity of different kinds of Malwares I ...
0
votes
0answers
48 views

Patching a program in IDA

I've opened a simple Hello World program in IDA (Pro 7.5) like that: global _main extern _printf section .text _main: push message call _printf add esp, 4 push ...
1
vote
1answer
129 views

Arrays assembly

I'm reversing my C array's programs where I'm storing numbers in arrays like this... int marks[5]; marks[0] = 1; marks[1] = 3; marks[2] = 2; marks[3] = 7; marks[4] = 9; so the compiler showing me the ...
1
vote
1answer
45 views

Where are the .NET IL bytes stored in an .NET executable?

When i compile a c# code, it compiles into a .NET executable, that only imports _CorExeMain from mscoree.dll, now my questions are : Is _CorExeMain the interpreter that fetches ILs and executes their ...
0
votes
0answers
28 views

Renesas Chip reverse engineer mcu

I need to access MCU (the MCU is the Renesas R5H30211) – goal is to reset a register value to 24 as card counts down to 0 for each cycle – I want to reset the card. Can anyone help with this, I do ...
0
votes
0answers
60 views

How to Find Password/ Bypass Password in a Switch Statement using IDA

I'm new to reverse engineering, wondering how access or bypass the password contained in the switch statement ? File Link
1
vote
0answers
19 views

Program closes when running Charles proxy

I came across an program that closes itself when I run Charles proxy and if I'm running charles before the progran it won't run. Anyone know what type of security if this and can it be reversed? ...
0
votes
0answers
86 views

Confusion about if statement in disassembly

I recently got into reverse engineering applications for fun. Can someone please help me with this if statement. 140005914 75 38 JNZ LAB_14000594e 140005916 48 8b 4 MOV ...
0
votes
1answer
43 views

idb file and IDA

I've just received from a friend a *.idb file concerning the pe file i'd like to disassemble in IDA. What the file is and how can i load/use it with the exe linked with it in IDA?
0
votes
0answers
39 views

IDA adding a new code

Is it possible to add a new assembler code lines in IDA to a opened, disassembled pe file? For e.g. having such disassembled code in IDA: global _main extern _printf section .text _main:...
0
votes
2answers
45 views

Pe file code starting address

When i load an exe in the IDA the assembled code always starts at 00401000 address. Does it mean that in pe files the code always starts at that specific address?
0
votes
1answer
51 views

Disassembling Hello World program in IDA

I've de-compiled in IDA 7.0 (freeware version) such a simple c program (compiled in the Microsoft Visual Studio Community 2019): #include <stdio.h> #include <string.h > char* sayHello(...
1
vote
1answer
137 views

How to find encrypted strings in an executable?

I am trying to reverse engineer an executable. I am using Process explorer to dump all strings present in the exe image, and from the process's RAM when it is running. The two dumps return a ...
1
vote
1answer
45 views

far jump do not point to instruction?

My title is kind of ambiguous and not sure if it is true, Hence the question mark at the end. Basically, I was trying to trace windows printf in NASM to identify "what is the last call/function ...
1
vote
1answer
63 views

.dll file pull source from compiled study?

Forgive me I’m new, and not a programmer but I am needing to see if this is possible. I have a study in my trading platform I had built a long time ago, lost the original, but have the compiled .dll ...
1
vote
1answer
34 views

What is the role of PAGE section in windows Drivers?

I have seen many drivers with a section named PAGE, but couldn't find good enough information on it, what is the role of this section?
1
vote
1answer
59 views

Using windows 10 for malware analysis

I want to ask can I use windows 10 for malware analysis, I'm asking this because I see many reversers and analysts using windows 7 for this purpose. Can anyone please guide me?
2
votes
3answers
83 views

Where Can I Get .PDB files for Windows OS Components?

I want to take a look at some components of the Windows OS in IDA, such as ntoskrnl.exe and some of the Windows API .DLLs. I understand there is a Microsoft symbol server, but I am not sure how to ...
4
votes
1answer
77 views

Statically recovering thunks in Windows x86_64 DLL

I just started working my way to reversing Windows binaries and I stumbled upon the Import Address Table. When reversing a particular DLL I encountered many thunk-functions which all supposedly ...
0
votes
1answer
47 views

Is it possible for a process to debug itself?

What happens if you try to debug yourself ? I mean, does the process crash ? If it is possible, how would you implement it ? I have tried launching x64dbg and I can't attach to my own x64dbg process. ...
0
votes
0answers
24 views

Ollydbg skippingover breakpoint

I am new to the ollydbg world- I am in the middle of injecting shellcode (created with msfvenom...) into a small PE, and during debugging, I can't get it to halt at the breakpoints I set. If I run the ...
1
vote
0answers
42 views

Acquire command line of remote process in Windows OS

I'd like to use C/C++/CS API to get the command line that invoked another process according to PID. I've seen that this is done in processHacker that is an openSource project, but I couldn't find the ...
2
votes
2answers
188 views

Where to get started with reverse engineering a usb video device on Windows?

I have a piece of proprietary hardware that I'm trying to reverse engineer and write a cross-platform open-source driver for. This device has an IR camera on it, and it seems to be using the UVC ...
1
vote
2answers
79 views

Figuring out encryption technique of network connection

I am trying to reverse a virtualized program (using VMProtect 3.4.x). I decided to hook certain functions of the program such as the winsocks library send() and recv(). This is how it looks like: [...

1
2 3 4 5
14