Questions tagged [windows]

Windows refers to the Microsoft Windows series of operating systems.

Filter by
Sorted by
Tagged with
0
votes
0answers
28 views

How are programs like 'StartAllBack' and 'T-Clock' developed?

There are many programs like StartAllBack and its predecessor StartIsBack which somehow modifies different aspects of Windows Shell (explorer.exe). How are these hook points discovered in the first ...
0
votes
0answers
26 views

Remote debugging with Binary Ninja on Windows possible?

Quick background -- I cannot start the .exe from a debugger; I need to attach after the fact. Binary Ninja's debugging plugin only allows attaching to a remote debug server and not a process. The ...
-1
votes
0answers
38 views

Finding registry keys/values using IDA PRO

It's been a while since I've started optimizing my Windows 10 and the great way how to do it, is by using IDA PRO by looking for "strings" from .sys or .dll files. Problem is, that I need to ...
0
votes
2answers
145 views

Why are certain functions from kernel32.dll always imported?

I've been noticing this for a while. Functions like IsDebuggerPresent and GetModuleHandle are always present in a binary's import directory structure. I assume is the Window's dynamic linker, but ...
3
votes
0answers
36 views

Is it possible to fake being joined to a domain in Windows 10?

I'm dealing with a malware sample from a pentest that will only execute properly if the system is a member of the target organization's Windows Active Directory domain. Rather than standing up my own ...
0
votes
1answer
93 views

How to unpack Armadillo protected software using x64dbg?

I am planning to reverse-engineer a Windows executable that has been protected with Armadillo. When I put the executable through Detect It Easy, the results show that the executable was protected with ...
0
votes
1answer
68 views

Windows User Identification / HWID Limiting

I've been playing a game that has an HWID limit and a bunch of other limitations, such as: a) Cannot be ran in a VM b) Cannot be ran using Sandboxie and other Sandbox environments c) Limits 3 ...
0
votes
1answer
121 views

How do I interpret this double offset?

While looking at that old game I've found a class CStr that is used in an unusual (to me) manner. Most of the times a member of CStr is used, it's done as follows. In both cases, this is a CStr *. ...
0
votes
0answers
21 views

How to extract an AutoIT script when tools fail to extract it?

Lets say you have a Autoit malware (windows executable, autoit v3), and you want to extract the script from it. But tools such as exe2aut fail to extract it. What would you do? is there any place in ...
0
votes
2answers
135 views

How to prevent File Modification in C++

so i want to protect my software against reverse-engineering and i want to add checksum verification to prevent patching the binary but the problem that if i added a checksum verification the binary ...
0
votes
1answer
57 views

Change manifest file using ResourceHacker CLI

I want to automate some manifest file changes (change requestedExecutionLevel level to requireAdministator from asInvoker) so I have to use ResourceHacker CLI. I have managed to extract the resources ...
0
votes
1answer
20 views

Cant Save .exe using reflixil and Red Gate Reflector 10.3

First off all im pretty new to Reverse Engineering. Im Stuck on Saving my Project. When i want to save the Assembly as .exe file Reflexil says cant save, the specified Method is not supported. I tried ...
1
vote
0answers
21 views

Send file or non-printable character in Immunity Debugger arguments

I am a beginner in Reverse Engineering. I am on Windows and using Immunity Debugger. I would like to send my payload on the .exe file. The payload contains non-printable characters. How I can launch ...
0
votes
1answer
85 views

Proxy dll doesn't load the original dll

I have relatively simple code here for the proxy DllMain() function: BOOL APIENTRY DllMain(HMODULE hDll, DWORD reason, LPVOID reserved) { if (reason != DLL_PROCESS_ATTACH) { return TRUE; } ...
1
vote
2answers
77 views

Can't figure out a crash in IDA "The memory could not be read -> 00000710 (exc.code c0000005, tid 20612)"

I'm trying to debug out a game. Basically, the Steam version works perfectly but the GOG version (which is 8kb smaller) has an annoying problem where for some people (which happen to be me) the game ...
0
votes
0answers
52 views

Ghidra: Identify and display a struct broken into multiple smaller fields

Me vs the 90s game, part two. I'm trying to figure out how the game detects the current date, since that part doesn't work correctly anymore. At some point, GetLocalTime() from kernel32.dll gets ...
0
votes
0answers
26 views

There is a course in which they teach you to use WinAFL?

I would like to know if there is a course that begins in a basic way, such as how to use winAFL to find bugs in app desktop.
0
votes
1answer
216 views

How to find main() of Windows EXE with Ghidra?

I'm new to Ghidra, my goal is to add localizations for a small EXE program. The program was written in Visual Studio and has Russian dialogs, which I like to convert to English. I've loaded the EXE ...
-1
votes
1answer
52 views

How to find bugs in a modern desktop application with reverse enginnering?

I would like to clarify the context for the question: I have studied different types of exploiting but all the studies I have carried out were with command line programs and with functions that I ...
0
votes
0answers
25 views

How to replace the modified/corrupted module image on the original in the memory dump

I'm analyzing a windows kernel crash. I have instrumented “USBPORT.sys" kernel module for collecting metrics. I named the instrumented version of the module "TARGET_MODULE". After I ...
0
votes
0answers
91 views

What kind of code creates this function call pattern?

While using WinDbg: u/uf to disassemble functions in ntoskrnl.exe there are functions that are used in system calls and exception handling that have these weird function call patterns and I can't ...
4
votes
1answer
175 views

Fixing/recompiling a heavily control flow obfuscated function

I've recently come across a binary that has been obfuscated with a very obscure protection. Obfuscation From what I understand, the obfuscator is effective in several ways. Multiple JMPs via relative ...
1
vote
1answer
76 views

Want to use win API hooking to detect wmi query string? But can't find IWbemServices::ExecQuery in fastprox.dll

I want to implement WMI query detection function using apimon plugin in sandbox https://github.com/tklengyel/drakvuf To do it,I have to get the DLL symbol file. But I can't locate the IWbemServices::...
0
votes
0answers
35 views

Is it possible to Direct3D 9 debug DLL in an app using the release version

I have an application using d3d9.dll, but I want to figure out which functions it calls to gain insight. Since online tools I have found are incompatible with my app (32-bit d3d9), is it instead ...
0
votes
1answer
44 views

CreateFileA returning invalid handle when file exists

I was working on a practice binary. It opens the file at C:/WINDOWS/system32/filename#123.dat, if the file does not exist, the check compares the result to -1 (An invalid handle). However, even after ...
1
vote
0answers
43 views

Reversing Logitech G933 Battery Charge Values

I have a Logitech G933 headset. I replaced the stock battery with a larger capacity. The headset now lasts many hours longer than it was originally designed, and the software is configured to give ...
2
votes
1answer
99 views

How to get thread start address in Windows?

I'm writing thread finder in module. My goal is find all threads in process and find threads currently working address locations. Like image on below. I do this goal with NtQueryInformationThread API. ...
1
vote
1answer
67 views

Identifying/debugging code parts responsible for features in Windows

New to the area, i am trying to identify the code responsible for example for the search functionality in Windows when you start typing in the start menu. What are some generic ways of identifying the ...
1
vote
1answer
54 views

Why is process object is shown as desktop object in nt!_object_type

I try to extract the object type of notepad.exe in windbg but the nt!_object_type is showing it as Desktop object instead of Process object. Any idea why is it so? 4: kd> !process 0 0 notepad.exe ...
0
votes
0answers
134 views

Windows time travel debugging performance bottleneck

First of all I wan to be clear, that this question is not about the collection performance, but indexing performance. What is the performance bottleneck of the indexing step? Some context: Action in ...
2
votes
1answer
36 views

Why some process has empty nt!_object_type

I try to extra the nt!_object_type of notepad.exe process. But seems like it's empty. Is it some process has no object type? Correction for my screenshot above for using the EPROCESS address to ...
1
vote
1answer
92 views

Run ntoskrnl.exe with qemu

We can run linux and similar unix kernels uing qemu -kernel parameter. Is there any way to do the same with NT kernel? I could not find a way to test even reactos kernelwith qemu. Also can .efi files ...
0
votes
1answer
27 views

Can't add tracing in IDA, showing it in gray

I added read/write trace to a program. I was able to record the trace with IDA for the first time. When I run it again, it didn't work. I tried to do what I did on the first time, adding the read/...
1
vote
1answer
69 views

How to load modules symbols to IDA while debugging a process

I am debugging a program that I compiled. This program calls SetWindowTextW. When I am debugging it with IDA I can step into this function, but it doesn't recognize anything there: If I will load ...
1
vote
0answers
24 views

On Windows, when is a PTE a VAD prototype PTE (with address 0xFFFFFFFF0000) instead of a prototype-pointer PTE?

I have reviewed several sources on this PTE type, including Windows internals and the following: http://blog.rekall-forensic.com/2014/10/windows-virtual-address-translation-and.html https://thalium....
1
vote
0answers
19 views

Whats the difference between a MiNotMapped PFN entry with all 1s, and a MiNonCached PFN entry with all 0s and a 0 PteAddress?

On host (UEFI legacy mode): lkd> !pfn 0xf0 PFN 000000F0 at address FFFFFA8000002D00 flink FFFFFFFFFFFFFFFF blink / share count FFFFFFFFFFFFFFFF pteaddress FFFFFFFFFFFFFFFF ...
2
votes
0answers
65 views

How to disassemble win32 function RegSetValueExW?

I have opened up advapi32.dll in IDA and found out that RegSetValueExW is just a jump to RegSetValueExW_0. And RegSetValueExW_0 seems to be an extern. How do I actually disassemble RegSetValueExW_0?
3
votes
1answer
124 views

Unable to attach into mysterious PID

I have a suspicious process. I found it by ProcessHacker's network tab. ProcessHacker display the process as Unknown. The process listening into a constant port number that's also not found by ...
2
votes
1answer
155 views

Extracting strings from binary files (.exe)

This question has been asked quite a lot especially on stackoverflow, but the solutions/replies are not clear or extensive. What I`m looking for is to build what Strings does from Sysinternals. My ...
2
votes
1answer
100 views

How to find sleep() in ollydbg or IDA or ghidra

I have a program which converts videos from a proprietary format into mp4. The conversion is very slow and CPU utilization is less than 1%. I'm able to speed up the conversion process via Cheat Engine'...
1
vote
1answer
108 views

Disassembly call function offset from RIP

I am writing a program where I map an .exe PE file in memory and I "dissect" it. I am disassembling the .text section of the target executable, using the distorm disassembler. CALL ...
0
votes
2answers
128 views

Import header files in IDA to get the struct definitions?

I am reversing a program that has a lot of internal structs in it. The problem is that there are a lot of structs, so i can't import them manually using local types->insert. Lets say i have some ...
0
votes
1answer
33 views

Find out version of statically linked MFC from an exe

I have an exe with symbols stripped that I am trying to reverse engineer. I know the library is linked with MFC but I don't know which version. (Therefore, I can't use something like FLIRT signatures ...
0
votes
0answers
59 views

Can I reverse engineer original file names?

I'm new to IT and I turned my external hard-drive into a windows boot disc. I managed to recover files with testdisc & photorec_win. The downside is I got more than I bargened for and I have twice ...
1
vote
1answer
76 views

Merging a large number of segments in IDA Pro

I'm working with a memory dump of a protected win32 program. Something causing me a lot of pain is the program being split into roughly 3,000 contiguous small segments (i.e. instead of just .text and ....
0
votes
0answers
116 views

WMI Spoofing by Fastprox.dll Hooking

I m trying to spoof WMI output by hooking the fastprox.dll. Here is the code I m working on: typedef HRESULT(__stdcall* tGetFunc)(IWbemClassObject*, LPCWSTR, LONG, VARIANT*, CIMTYPE*, long*); static ...
0
votes
1answer
58 views

How much of the kernel does remote kernel debugging allow you to debug?

This is a theoretical question because I've never set up remote kernel debugging before -- but I will do at some point, which should hopefully answer some of the experimental questions I have. What ...
0
votes
0answers
49 views

new to malware analysis and disassembly. dotpeek has been helpful. is this unreadable code due to SuppressIldasmAttribute?

just getting into rev engineering malware. i want to get to source on my own. i could use run.any or VT but that's no fun. any reason why this is unreadable the way it is? is it due to the module ...
0
votes
0answers
40 views

Set standard input/output to a process using NtCreateProcessEx

In the official Windows API function CreateProcessA is possible set or change the standar input and output of the process vía LPSTARTUPINFO structure. How can do this using the undocumented function ...
0
votes
1answer
87 views

Why a single "nop" crashed the game?

I hope answer to my question is not game/app specific and can be answered in communities like this. So, I tried to use some internal functions of a game, like pick a target. No malicious intentions, ...

1
2 3 4 5
15