Questions tagged [windows]

Windows refers to the Microsoft Windows series of operating systems.

Filter by
Sorted by
Tagged with
1
vote
1answer
29 views

far jump do not point to instruction?

My title is kind of ambiguous and not sure if it is true, Hence the question mark at the end. Basically, I was trying to trace windows printf in NASM to identify "what is the last call/function ...
0
votes
0answers
37 views

.dll file pull source from compiled study?

Forgive me I’m new, and not a programmer but I am needing to see if this is possible. I have a study in my trading platform I had built a long time ago, lost the original, but have the compiled .dll ...
1
vote
1answer
26 views

What is the role of PAGE section in windows Drivers?

I have seen many drivers with a section named PAGE, but couldn't find good enough information on it, what is the role of this section?
1
vote
1answer
52 views

Using windows 10 for malware analysis

I want to ask can I use windows 10 for malware analysis, I'm asking this because I see many reversers and analysts using windows 7 for this purpose. Can anyone please guide me?
2
votes
3answers
64 views

Where Can I Get .PDB files for Windows OS Components?

I want to take a look at some components of the Windows OS in IDA, such as ntoskrnl.exe and some of the Windows API .DLLs. I understand there is a Microsoft symbol server, but I am not sure how to ...
4
votes
1answer
62 views

Statically recovering thunks in Windows x86_64 DLL

I just started working my way to reversing Windows binaries and I stumbled upon the Import Address Table. When reversing a particular DLL I encountered many thunk-functions which all supposedly ...
0
votes
1answer
44 views

Is it possible for a process to debug itself?

What happens if you try to debug yourself ? I mean, does the process crash ? If it is possible, how would you implement it ? I have tried launching x64dbg and I can't attach to my own x64dbg process. ...
0
votes
0answers
19 views

Ollydbg skippingover breakpoint

I am new to the ollydbg world- I am in the middle of injecting shellcode (created with msfvenom...) into a small PE, and during debugging, I can't get it to halt at the breakpoints I set. If I run the ...
1
vote
0answers
42 views

Acquire command line of remote process in Windows OS

I'd like to use C/C++/CS API to get the command line that invoked another process according to PID. I've seen that this is done in processHacker that is an openSource project, but I couldn't find the ...
1
vote
2answers
97 views

Where to get started with reverse engineering a usb video device on Windows?

I have a piece of proprietary hardware that I'm trying to reverse engineer and write a cross-platform open-source driver for. This device has an IR camera on it, and it seems to be using the UVC ...
1
vote
2answers
75 views

Figuring out encryption technique of network connection

I am trying to reverse a virtualized program (using VMProtect 3.4.x). I decided to hook certain functions of the program such as the winsocks library send() and recv(). This is how it looks like: [...
1
vote
1answer
104 views

Is it possible to download program database (PDB) files of Microsoft Windows binaries without installing any software?

I want to download the .pdb files of Windows binaries (e.g., notpad.exe) on machines where the user doesn't have admin rights, nor has any debugger available. I was wondering if it is possible to ...
2
votes
0answers
94 views

Accessing Windows 10 Feedback Hub Data

I'm trying to make a website that displays the feedback from the Windows 10 Feedback Hub but i have met a roadblock. I'm using Fiddler 4 (Fiddler Everywhere doesn't have support for UWP yet and ...
1
vote
0answers
41 views

Windows: Is it possible to mix FastIoDispatch with the registration of IOCTLs?

I am reverse engineering a Windows device driver. My main previous experience was with drivers I had written before, or toy drivers from tutorials. I started reversing the driver by searching for ...
1
vote
1answer
54 views

How to keep symbols when taking memory snapshot with IDA?

When i take memory snapshot with IDA to try to analyze it statically later, the problem is there are a lot of symbols that get lost when i dump the memory, how can i solve this? for example this is ...
1
vote
0answers
27 views

Instruction-level hooking library for win32?

I am looking for instruction-level hooking library for win32 x86/x64. I want to write hook insertion and hook implementation code in C/C++ (compiled into dll). (Therefore instrumentation tools are ...
2
votes
1answer
47 views

Are offsets within a loaded dll always the same relative to each other?

If I load a dll in 2 different processes, will the offsets calculations within one process hold for the other process? I'm currently trying to patch the import table of a dll, once injected into a ...
1
vote
2answers
55 views

How to attach IDA Window back to be part of the IDA main window

I accidently maximized the functions Window and now it is de attached from the main window: How can I attach it back to be part of the main window? I tried to drag it but it doesn't work. Also re ...
0
votes
1answer
53 views

How to resolve major function numbers to their name while reversing windows drivers?

I'm reversing some windows drivers, and IDA never converts numbers to their corresponding major function name like IRP_MJ_CREATE = 0x00, how can i force this? is there anyway i can convert a number to ...
0
votes
0answers
43 views

How to discover how a program gets keyboard input?

I'm reversing a windows x86 binary that I can't figure out how the program is getting the keyboard input. I've searched for the windows api functions I was used to but the program doesn't call them. ...
2
votes
2answers
126 views

How to show KUSER_SHARED_DATA members in decompiled C code?

Here is a sample C code which prints Windows version directly from address of KUSER_SHARED_DATA. Tested in Windows 10 only. The raw memory address differ in Windows version but that's not the point. #...
1
vote
1answer
87 views

Does the operating system you use matter?

people recommend windows for reverse engineering, I don't want to install windows as a virtual machine because they are laggy and I already have windows 10 as host, is it possible to use linux vm that ...
0
votes
0answers
32 views

Forcing embedded libcurl to disable SSL verification

I am trying to decrypt HTTPs communications in a binary that I know has been statically linked with cURL. How can I force curl to not verify SSL certificates for fiddler to intercept? I am using the ...
0
votes
3answers
71 views

How to find the address (offset) of specific driver function

I am reversing Capcom driver and in IDA I have this list of functions: I want to set breakpoint on the function sub_10590 but I don't know what is the address of this function when I am doing live ...
1
vote
1answer
64 views

How to find out what stack frame EBP belongs to

i'm newbie to all the subject of RE so this question may sound easy. on OllyDbg i see a lot of references to EBP & i can not understand to which stack frame does EBP belongs to, since there are ...
0
votes
2answers
156 views

how to use class member function defined in a exe within a dll

I have an executable (.exe) containing some classes and functions definition and plan on using those functions from within a DLL, although I know to call a regular C style function using calling ...
0
votes
0answers
72 views

IDA IDC script does not seem to work

I am trying to measure code coverage for a malware sample linked here. I am using DynamoRIO's(7.1.0-1) drcov utility to get an ASCII log. The log file is linked here. I am then using Dynapstalker to ...
2
votes
1answer
169 views

How to start out in reversing?

I'm new in reversing and I'd like a lot to learn about it. I have little to no knowledge about it. Is still worth to learn x86 Assembly? Since almost everything these days work on x64 architecture. ...
0
votes
0answers
41 views

String as constant , even not visible in disassembler

I was reading this article Where I saw that while reversing the WinRAR I saw that the x64dbg is not able to search for a string in all modules "evaluation copy". but why is that happening. ...
0
votes
0answers
31 views

Module name in the export table of a PE image

One of the fields of the PE export table is the image name, see screenshot below for an example. This name is part of the file, even though I can rename it to any other name after it's compiled. My ...
0
votes
0answers
21 views

What is the meaning of call ds:ApiName[registry*constant] in IDA .asm files?

I have a dataset of .ASM files generated by IDA (dont have the corresponding file) now there are a lot of calls like this : .text:00637114 5F pop edi .text:...
0
votes
1answer
55 views

Static Binary in Windows

I am learning more about binary exploitation on windows. But I saw while revering a binary that you can create static binaries in windows too just like in Linux. It was really ugly. if I would be on ...
2
votes
1answer
49 views

Structure of operand bytes in .NET call and data access IL instructions?

I tried googling but couldn't find any good source that explains the structure of memory access instructions like ldstr and call instructions for example based on experience, the last byte of API/...
1
vote
0answers
47 views

Ways of creating a new thread on Windows

I'd like to know about every possible way how a thread can be created in a process at the lowest possible level. There are loads of WinAPI-s to create a thread, but as far as I know all of them ends ...
0
votes
0answers
24 views

Watching a TLS Slot value in x64dbg

I am new to reverse engineering and I was trying to debug why a 3rd party application was crashing when I m injecting my DLL in it. (There are some cases where it didn't crash) So I was able to figure ...
0
votes
1answer
82 views

How to track output parameters in disassembly?

I have the following disassembly of winload!CmpFindNlsData function and I need to check the output parameters of this function. P.S.: CmpFindNLSData(int a1<eax>, int a2, PUNICODE_STRING ...
0
votes
1answer
34 views

How are processes assigned a virtual base address

So I'm trying to understand how a process is assigned a base address once its loaded into memory. If I understand correctly each process has its own virtual address space, and each virtual address is ...
0
votes
1answer
73 views

What is physical address on a pe reader?

What is physical address on a Pe file? I had search on the microsoft website article about pe files and don't have found anything.
1
vote
1answer
84 views

Trying to reverse engineer CmpFindNlsData of winload

I have a basic understanding of assembly language and I'm unable to perfectly define the algorithm of winload!CmpFindNlsData looking at the disassembly. Basically I need to understand how NLS data is ...
2
votes
0answers
53 views

Ghidra is mishandling a field access

I have a program which decompiles in Ghidra to include the line temp_5f2f2f81bc = *(CPedIntelligence **)(&DAT_000010c0 + (longlong)pCVar2); temp_5f2f2f81bc is a CPedIntelligence*. pCVar2 is a ...
4
votes
1answer
164 views

Why does PE ImageBase address change in memory?

I'm reversing a malicious 32-bit x86 Windows executable. Statically reviewing PE headers in Ghidra, I see that ImageBase is set to 0x400000 as expected. However, when the binary is loaded into memory, ...
0
votes
1answer
86 views

ASLR in Linux Vs Windows

I am quite new in binary exploitation. I am doing a lot of beginners exercise here. I am confused about ASLR. I tried some binary exploitation thing in Linux. It was recommended that I should stop ...
3
votes
1answer
67 views

reason of padding in exploit

I was doing vulnserver bufferflow exploit. I saw a tutorial where the he makes a payload to exploit the server. Take a look at the exploit: #!/usr/bin/python import socket target_ip = "10.0.2....
0
votes
0answers
43 views

Reverse engineering a “Crypto++/CryptoPP” Windows Service using Ghidra

I'm new the reversing scene (and this site!). I recently got interested in seeing how Windows Services tick, and discovered a weird encryption scheme. The binary isn't obfuscated at all (at least, it ...
1
vote
1answer
58 views

Finding mapped memory page flags in Radare2

I have a memory dump of notepad.exe. Radare's iS to print sections gives me the mapped files (executable and it's dll's) as well as the many sections simply marked 'Memory_Section', which from what I ...
0
votes
0answers
34 views

Windows pintool mismatch between call/ret instructions

So i've been trying to write a pintool that monitors call/ret instructions but i've noticed that threre was a significant inconsistency between the two. For example ret instructions without previous ...
0
votes
0answers
65 views

How to find and edit the source of a string in a DX11 game's exe/files (debug build of the game available)

I want to find and edit the values for the motion blur effect in Naruto: Ultimate Ninja Storm 3 on PC (Windows, DX11) to be more in line with the PS3 version (and the other Storm games on PC as well). ...
1
vote
1answer
98 views

how could i follow a system call from a dll -> kernel driver syscall

basically i would like to follow (system calls / internal calls) that basically lands in the kernel i would like for example to debug a specific dll ex : ntdll.dll and follow it to (NtXXX) function ...
1
vote
0answers
30 views

PE Format - How can I delete IMAGE_IAT_DIRECTORY and the app still runs fine?

I’m doing a small research regarding PE files and while I drilled every related question or the documentation itself I couldn’t explain this issue. Why can I go to CFF explorer or some other PE ...
0
votes
2answers
65 views

Where do arguments 5 and 6 go in this Microsoft x64 function call?

I'm disassembling a working-as-expected compiled C program (MS/Windows x64, MinGW gcc 10.1.0). In the main function, I have the following call which passes 6 arguments to the function DotProduct: ... /...

1
2 3 4 5
14