Questions tagged [windows]

Windows refers to the Microsoft Windows series of operating systems.

Filter by
Sorted by
Tagged with
1 vote
0 answers
17 views

WinDbg Preview search is not returning results

I am attempting to manually unpack a malware sample. I am using the new WinDbg Preview (only thing that is available to download now). After letting the malware call VirtualAlloc I am trying to search ...
0 votes
0 answers
46 views

Why is Windows 10 still blocking me from running malware?

I am analyzing some malware on Windows 10. I installed FLARE VM, disabled tamper protection and disabled the virus scanner in the registry. However when I attempt to run a malware, Windows is still ...
0 votes
0 answers
25 views

IDA pro Error how to resolve this error

52C187F5: The instruction at 0x52C187F5 referenced memory at 0x4. The memory could not be read -> 00000004 (exc.code c0000005, tid 672) How to Solve this. I have seen sandbox reports in those the ...
3 votes
0 answers
38 views

Reverse engineer DPC Latency Checker tool to fix high Windows kernel timer latency

I need help with something very Windows/kernel-specific. I'm working on a fix for the high Kernel Timer Latency in Windows 10 2004 and higher. This problem was introduced between Insider Build 18950 ...
2 votes
0 answers
29 views

How does Windows Updates determine if the patches are compatible?

I am looking into Microsoft Windows updates, and how they are applied, after extracting the .msu file, we get some .cab files with patches (in PA30 format), and informations on the file attributes, ...
3 votes
1 answer
71 views

Windows 11: Interact with IDA pro when running in session 0

I am trying to debug a windows service, so I set IDA as the debugger of that service. But since services are running in session 0, I can't interact with IDA. Also in the latest windows version (e.g. ...
  • 43
2 votes
1 answer
58 views

The same notepad.exe runs in both WoW64 and x64 modes

When I run notepad.exe with x64dbg it runs as WOW64 process. But when I run it with x32dbg it runs as x64 process with x64 instructions. I am running it from the same directory C:\Windows\System32\...
3 votes
1 answer
100 views

Why is function in kernel32.dll jumping into a api-ms-win-core stub

I was trying to look into the implementation of GetVersion function in kernel32.dll. I was surprised to see that the GetVersion thunk is issuing a jump to API-MS-WIN-CORE-SYSINFO-L1-1-0.DLL::...
2 votes
1 answer
50 views

How does this Is64BitOS pointer-arithmetic-based function work?

Reversed this function. It works. But stepping through I can't figure out how. Why does this work? bool _Is64BitOS(void) { unsigned int version = *(unsigned int*)0x7FFE026C; unsigned int ...
  • 145
1 vote
1 answer
47 views

Capture and Replay

I was wondering if it was possible to create a python script that is able to capture and replay the instructions executed by a windows program for in depth analysis.
1 vote
1 answer
131 views

Forcing a legacy Windows application to use an older version of ntdll.dll

There is this old Windows application I've been using for more than a decade now: DesktopEarth. It got its last update in 2015 and the author's website is offline now, but it's been running fine on ...
  • 111
1 vote
1 answer
104 views

How to access files stored in mouse?

I own a Razer Mamba Elite mouse. After plugging it in to the usb port, an software installation window shows up. Basically it's the Razer software to manage device's options such as profiles, macros, ...
  • 11
1 vote
0 answers
48 views

How to decrypt data during runtime before executing and then encrypting it back

I was doing some research and came across the term protectors. From my understanding is they encrypt a file to be protected but run it without an issue. During its execution it is able to decrypt the ...
  • 11
1 vote
0 answers
45 views

What is the following code will do after modifying it? [closed]

The following commands will change the files information gatherosstate.exe file. From looking at the hex values I can interpret that there are nop (0x00). The file changed in windows terminal. But ...
2 votes
1 answer
81 views

How to call Windows console in ASM and printf some values there?

Is there a working way to embed the windows console in disasm code? I tried AllocConsole with GetStdHandle or AttachConsole with PID of an existing console but it didn't work. I have tried printf ...
1 vote
1 answer
123 views

What are latest research in reverse engineering?

I am searching research papers related to reverse engineering between 2020 and 2022 but did not found good papers with latest research in the direction of reverse engineering. So, what are the latest ...
2 votes
1 answer
35 views

generate code execution/cpu time flame-graph of library DLL (Noob question)

I have a library DLL which I'm trying to analyze, and I have a basic understanding of its function and behavior (and can modify some input to affect how long certain operations will take to execute/...
1 vote
0 answers
40 views

How to obtain import name from disassembled assembly

I'm trying to create my own tools for reverse engineering PE. I have some assembly codes that I fetched from a clone of objdump for a program. Sometimes I see call instructions such as : callq *...
  • 11
2 votes
2 answers
168 views

Reverse function in .rdata field

I'm tracking a function called CreateIoCompletionPort in dns.exe. The import tab in IDA shows that it's imported from api-ms-win-core-io-l1-1-0.dll. However, it appears in .rdata section in the .dll ...
0 votes
0 answers
88 views

x32dbg : exe with different code address when running

I have a 32 bits exe that works only when there is a specific usb flash disk inserted. On my new laptop, I only have a single USB port, so I want to make it works without the original key, or from a &...
  • 131
2 votes
0 answers
154 views

How find all kernel functions called by a driver in windows 11

I am working on a highly obfuscated driver that is virtualized. In an attempt to work on this driver I asked a question about some python scripts which turned out not to be effective at all so I ...
1 vote
1 answer
169 views

Reverse Engineering Go obfuscated binaries

I have been trying to understand the working of this go malware by reversing it, which can be found here , so basically this stuff takes a shellcode as an input, and converts it to an exe or dll file, ...
2 votes
1 answer
56 views

How to investigate in a program of type /SUBSYSTEM:NATIVE that crashes with the RtlFreeAnsiString API?

I compiled a very simple example of an application of type /SUBSYSTEM:NATIVE writing "hello world". It is launched thanks to the "BootExecute" key. The program works without errors....
3 votes
1 answer
108 views

Exact copy of USB flash drive

I have a USB flash drive, with 2 partitions : one is read only and contains a Windows software, and the second is read/write for user data. In order to not damage this precious key, I want to do a ...
  • 131
1 vote
1 answer
267 views

How to disassemble an entire function in Windbg?

I am trying to disassemble the function ExAcquireFastMutex using WinDbg but it gives me only 8 rows: 3: kd> u nt!ExAcquireFastMutex nt!ExAcquireFastMutex: fffff805`456e3820 4053 push ...
  • 573
0 votes
0 answers
34 views

Is there any way to get old Windows kernel drivers?

I'm working through "Practical Reverse Engineering" and absolutely loving it so far. However, some of the exercises involve "decompiling" some Windows kernel files (like ...
0 votes
1 answer
71 views

Find out which struct RaGetUnitStorageDeviceProperty use by reverse engineering

I am trying to find out which struct storport!RaGetUnitStorageDeviceProperty uses by myself. I know I can use google and find out the correct answer is _RAID_UNIT_EXTENSION. However i want to do it ...
2 votes
1 answer
157 views

STATUS_PRIVILEGED_INSTRUCTION 0xc0000096 from kernel mode code?

Running a kernel driver I wrote. The driver includes: mov rax, cr0 btr rax, 10h mov cr0, rax to clear WP bit in cr0. Curiously the last instruction faults and causes a bluescreen, ...
1 vote
1 answer
74 views

Finding Correct Segment From An Address For Windows 3.1 EXE in IDA Pro

We have an EXE that IDA pro lists the following segments: Name Start End R W X D L Align Base Type Class AD es ss ds fs gs cseg01 00000000 0000EA50 ? ? ? . ...
2 votes
0 answers
84 views

Are system dlls like NTDLL and KERNELBASE etc. are always loaded at the same address on a per-session basis?

If I am understanding, code and read only sections of common DLLs are given system-wide section objects for which each process gets its own section view, in order to save physical memory. As such even ...
2 votes
1 answer
75 views

Programmatically Find COM Object Method Offset in Image from Method Name

What is a way to lookup a COM method offset with an image, just based on the module name and method name. For example want to find "Exec" method in "WScript.Shell" In this scenario ...
0 votes
0 answers
207 views

c000001d (Illegal instruction)

My Windows crashed, don't understand it shows 'Illegal instruction' on a simple 'strlen' instruction: ******************************************************************************* * ...
  • 101
1 vote
0 answers
145 views

Finding the main function on Windows compiled executables

For a C/C++ program compiled on Windows using the x86 architecture, what is the best way to find the main function within disassembled code without relying on signatures such as FLIRT? I've found ...
  • 21
0 votes
1 answer
51 views

Which function or file is responsible for initialization of g_37HashSeed

I'm checking tcpip.sys file in IDA and found that in the .data part there is an int called g_37HashSeed. This seed is an input for a hash function that I look into. Can someone tell me which program ...
0 votes
0 answers
71 views

How to get the call stack of WinAPI functions?

Yesterday, I noticed an answer to a question about the purpose of a certain undocumented function, which is a call stack (including the DLL library) for this function, This got me interested in the ...
1 vote
2 answers
50 views

I need simple debugger source

How can I write a simple debugger for Windows? I need to launch another program (do not attach to an already running one, but launch it yourself) then to let it run and to catch it at a certain ...
0 votes
1 answer
54 views

Symbol name tcpip!IppInitializePathSet found in windbg but unable to find function IppInitializePathSet in tcpip.sys

I'm debugging windows server 2019 in windbg and I want to find function IppInitializePathSet. However, I can't find the function in IDA but I can find the symbol named tcpip!IppInitializePathSet. How ...
1 vote
1 answer
92 views

x86 weird register call

I am digging with disassembler inside old game (release year 2002) and something is bugging me, I noticed it has a bunch of... questionable instructions. One of the things it does is calling imported ...
1 vote
0 answers
75 views

x64 Windows: Why is ExAllocatePool stepping on the caller's stack?

I am playing around with windbg on a 64-bit machine and noticed something interesting: nt!ExAllocatePool: ... sub rsp, 0xd0 ... mov qword ptr [rsp+0xf8], rbx Windows only allocated ...
0 votes
0 answers
54 views

Is there any available source code which is Windows 64 bit compatible that can disassemble binary code?

I'm writing a program that takes as input a single byte of binary (machine code from code segment) and converts it into assembly. I've done some searching online but have yet to find anything helpful. ...
  • 1
0 votes
0 answers
50 views

How to reverse an import function?

I'm reversing windows .sys file and an import function RtlLookupEntryHashTable appears in my target functions. I want to know the pseudocode of it. How to achieve this? .text:00000001C00218C2 ...
0 votes
0 answers
33 views

Need help finding a windows struct

What I know about it: struct unknown_struct { struct _KAPC apc; struct _KEVENT event; char unknown[2056]; }; So first a kernel apc struct then a kernel event struct and the total size is ...
2 votes
1 answer
70 views

Getting "Flow analysis was incomplete, some code may be missing" on WinDbg

I wanted to perform static analysis on the Win32 function CreateFileW, so I loaded kernel32.dll using WinDbg and perform the command uf kernel32!CreateFileW. But I am seeing the following output ...
6 votes
4 answers
3k views

Do I have to learn computer architecture for underestanding or doing reverse engineering?

I am completely noob in reverse engineering, and I've just started to learn it. Now I have this question in my mind, that does a reverse engineer use any computer architecture knowledge for doing his/...
0 votes
0 answers
47 views

windbg shows different instruction at address when you set the breakpoints in 2 different breaks but not the same break (nvd3d9wrapx thunk in user32)

In the first example I only set a breakpoint on user32!CreateWindowExW In the second example, I set 2 breakpoints at the same time on user32!CreateWindowExW and notepad!WinMain In the 3rd example I ...
1 vote
1 answer
495 views

Why is JMP ESP required in buffer overflow?

I was reading this article by Hackers Grimoire on Windows buffer overflow attacks. The article made sense, except for the part where the author searched for a DLL (.dll) file which contained a JMP ESP ...
3 votes
1 answer
1k views

How do I unpack a file protected by MPRESS?

I have a file that is protected by MPRESS packer and I want to know how to unpack it on Windows. Is there a specific program for that or something else? I am new to this so every help is appreciated.
  • 31
1 vote
0 answers
42 views

How do I read/edit a .xuk file extension?

I am trying to reverse engineer a license key for some software, the company that made it went out of business. In doing so, if you didn't already have the key their $50,000 machines become ...
  • 11
2 votes
1 answer
348 views

Function pointer and symbols in Ghidra

I am using Ghidra and I see that when it uses function pointers it never shows the paraments that are being sent to the function(In IDA pro, it always show the parameters). How can I fix that it will ...
  • 31
0 votes
1 answer
51 views

ida jumping to address I can't see in driver

When I open this driver in IDA i can't seem to see the instructions that this jmp at 0x1400DC46D jumps to. I've tried to undefine bytes and re-analyze the function but it then ends up will garbage. ...
  • 21

1
2 3 4 5
16