Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [windows]

Windows refers to the Microsoft Windows series of operating systems.

1
vote
1answer
56 views

When can trapping be used?

This is the beginning of one of the functions inside NTDLL of Windows XP: MOV EDI,EDI PUSH EBP MOV EBP,ESP ... The book on reverse engineering I am reading(Eldad Eilam - Reversing: Secrets of ...
1
vote
0answers
22 views

Set Breakpoint on ActiveX Property Being Set (No Symbols)

A program is loading an VB6 based ActiveX control that has several property, for example ConnectionString. The application is dynamically generating the values it provides at runtime, so it is not ...
-1
votes
0answers
20 views

How can I debug the following Windows error: “The specified service does not exist as an installed service. (Exception from HRESULT: 0x80070424)”

I have an old program I want to run on a Windows machine inside a Virtualbox. However, I'm getting the following error: The specified service does not exist as an installed service. (Exception from ...
1
vote
1answer
102 views

How does ASLR in Windows work?

I had recently this situation where in a program I was debugging I found: 03CD38D4: 8B15 8C5FF703 MOV EDX, DWORD PTR DS:[3F75F8C] If I look for these bytes in the physical file I found nothing. I ...
0
votes
1answer
34 views

Remote debugger for Linux from one VM (IDA) to another (running the debuggee)

I want to debug a Linux program (ELF), but my IDA Pro is on a Windows 10 VM and I want to use remote debugging to debug the program on Ubuntu (also in a VM). So, is it possible to debug if both ...
0
votes
1answer
37 views

Finding “controller vibration” function in game

I want to build a "force feedback chair" for Need for Speed: Payback, so I thought about hooking the function responsible for the controller vibration and sending the motor speed parameter to a motor ...
0
votes
1answer
45 views

x64dbg - Conditional breakpoint based on function argument

How can I set a conditional breakpoint based on the argument of a function? I am trying to break on the windows function LoadLibraryExW: https://docs.microsoft.com/en-us/windows/desktop/api/...
0
votes
1answer
61 views

The callstack does not show the message handler

After clicking a button or doing anything which might generate a message to be translated and dispatched, why is that the callstack might not show the message handler? Say I am reversing an ...
-1
votes
0answers
54 views

Reverse Engineer the Galax RGB Lighting Utility

during the last week I tried to find a way to control the lighting on my Galax 1080Ti cause it's software sucks. I come up with this https://github.com/purpl3F0x/GalaxLightingControl . It needs the ...
0
votes
1answer
45 views

x64dbg “System” meaning

I'm a bit confused about what "system" refers to when looking at the callstack in x64dbg. Does it mean the code is currently being executed in ring0? I thought that only system calls are executed in ...
0
votes
1answer
130 views

How to export function from exe file?

I open exe file (running on Windows) in Ida , and saw a function (for example sub_ABC) that I want to export , so I can call this function from c# code. How can I export function that I Know the name ...
3
votes
1answer
115 views

How to wrap dump process and execute it in another PC

I debug exe file in Ida , and put breakpoint in some address. I want to create a dump of this process that I can continue running it in another Pc (without Ida) from the point I pause it with ...
2
votes
1answer
48 views

dongle check happen before a debugger start debugging

i'm trying to fake the test ( dongle exist ) but one problem that i encounter is that the application detect it before i start debugging it . this is what happen with more details : open( not ...
4
votes
3answers
153 views

How to run part of exe file that is being reversed

I reverse exe file with IDA, there is a function (that is running some other function) that I don't want to understand how it works, but I want to run it. How can I run an exe file from a specific ...
2
votes
1answer
130 views

What is the difference between kernelBase.dll and Kernel32.dll

What is the difference between kernelBase.dll and Kernel32.dll in system32 folder ? Why both of them implement WideCharToMultiByte ?
0
votes
1answer
75 views

Find address of kernel function

Let's say I have a kernel driver abc.sys. I do not have the symbols for abc.sys. In IDA, I find a function sub_1400AAAAA and I want to find this in WinDbg. I attach WinDbg (kd) and then type lm. I ...
0
votes
1answer
147 views

How to run ida in windows xp

I tried to install IDA 6.6 on Windows XP VM. After the installation I get that this is not a valid win 32 application. I search and found that IDA is not supported with Windows XP. How can I run IDA ...
4
votes
3answers
271 views

Get interface definition of undocumented COM objects

I have started exploring COM objects, initially I got to it from UAC bypass methods but I guess my question is general. The general question is: How can I get from (elevated) CLSID in the registry to ...
3
votes
1answer
83 views

Questions about enabling special pool on win32k

So there is win32k.sys, win32kbase.sys, win32kfull.sys in Windows 10 Does verifier /driver win32k.sys /flags 0x1 enable special pool on all three drivers? (win32k.sys is kinda like stub to other ...
1
vote
1answer
161 views

I want to decompile a exe and change the code to not need Admin to run

I want to decompile an .exe and change the code to not need Admin to run. I know that it does something with: <requestedPrivileges> <requestedExecutionLevel level="requireAdministrator" ...
3
votes
0answers
39 views

int 2eh instead of syscall/sysenter [duplicate]

I have been looking into ntdll.dll on windows 10 x64 bit, and i noticed a check inside the ntdll like this: So after testing some bit, it tries to execute the system call via int 2eh. I have tried to ...
12
votes
2answers
3k views

What kind of code would produce this assemby with loads of jump statements?

00EE16CC . E9 DFBB0000 JMP BinFile.00EED2B0 00EE16D1 . E9 64AF0000 JMP <JMP.&MSVCP140D.?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@> 00EE16D6 . E9 15DB0000 JMP BinFile....
2
votes
1answer
121 views

Finding the main function without symbols

for a C/C++ program compiled on windows using the x86 architecture, what is the best way to find the main function within disassembled code? I've found various answers to questions similar to this, ...
1
vote
0answers
67 views

Calling undocumented kernel functions directly (xxxSendInput and xxxMouseEventDirect)

In the core my question is about how to reverse engineer undocumented functions. I want to call the function "xxxMouseEventDirect" (located in win32kfull.sys). I have already been able to collect some ...
9
votes
3answers
572 views

Is there any way to get my own image base without calling any WinAPI functions, such as GetModuleHandle?

Is there any way to get the image base of an .exe without calling WinAPI functions (i.e. imported functions) so that it can't be easily viewed in a disassembler/debugger? I've been thinking of ...
2
votes
2answers
121 views

Wrong RVA values inside IMAGE_IMPORT_DESCRIPTOR

I load the entire PE into an std::vector<Byte> fileContent using std::fstream. Then I obtain the executable's dos header: IMAGE_DOS_HEADER* imageDosHeader = (IMAGE_DOS_HEADER*)fileContent.data(...
1
vote
0answers
40 views

getting %localappdata% in asm

I have an old windows x86 application that no longer works properly since windows 8. This app creates files within its own folders for things like app settings. Unfortunately, Microsoft no longer ...
2
votes
1answer
143 views

Why is the process crashing after executing my injected payload?

I tried the following payload for APC injection in Windows. It gets executed successfully(pops up a MessageBox) but the process crashes after the execution of payload. What could be the possible ...
0
votes
1answer
56 views

How to see all of my changes in idb?

Is there ant way to see all of my changes in idb file ? All of variable in psudo code that I changed here name, all the funxtion I rename. I want to see all of this
0
votes
1answer
74 views

how to find private Key and passphrase stored inside a program?

There are some files (drivers) that are encrypted, and these files are working in a program that is installed in my computer. The program using these files needs to decrypt them. I am sure that the ...
3
votes
1answer
35 views

Are the names of COFF Data Directories fixed?

I have a PE file (notepad), the NumberOfRvaAndSize value in the COFF header is 0x10, and there are 16 DataDirectory entries as expected. The documentation says that this value can change (though I've ...
7
votes
1answer
159 views

WHY and WHEN do we need SEH for buffer overflowing

In our course in university, we recently moved on from standard buffer-overflows to SEH based ones. My exploit is already ready and working thanks to some nice tutorials, although I am still not sure ...
0
votes
2answers
198 views

Syscall from ntdll.dll

I am begginer in RE and also in Win NT world. I used IDA to disassemble ntdll.dll from Win XP SP 3. I care about non oficially documented function NtCreatePort which creates LPC port. I would find out ...
3
votes
2answers
345 views

What are the difference syscall and int 0x2E instructions?

From this question: How does the Windows Native API communicate with the kernel? Here is an example of ZwClose(HANDLE Handle); system call in NTDLL.DLL in Windows 10 X86_64: NtClose proc ...
0
votes
1answer
87 views

Windows : Which process sent TCP/IP packet?

How do I find out which process has sent TCP/IP network packet? Are there some tools that can easily do this? Like in Linux.
1
vote
1answer
117 views

VirtualProtect failed to revert protections on mrdata section of ntdll, why?

i perform a loop in assembly where i am parsing the sections of ntdll change their memory permissions with VirtualProtect and then revert them back to their original permissions. the code looks like ...
0
votes
1answer
162 views

IDAPython Script works from “Script File” but not when run with -S from Terminal

I'm trying to run an IDAPython script in IDA 7.1 on Windows 10 and it runs just fine when I run it from the Script File... command, but if when I run it from the command line it isn't working properly....
3
votes
1answer
85 views

Is there a tool to reconstruct .reloc section?

Seems like unpacking UPX manually is not a trivial task any more, due to ASLR and the need to recover the relocation table. So, before reinventing the wheel, I'd like to know if there's already some ...
1
vote
1answer
46 views

RtlCheckSandboxedToken

Does anyone know what is the purpose of RtlCheckSandboxedToken() in ntdll.dll, i cannot find any documentation, its prototype is: NTSYSAPI NTSTATUS NTAPI RtlCheckSandboxedToken( _In_opt_ HANDLE ...
1
vote
1answer
74 views

How to set hardware breakpoint by value?

I want to set in IDA breakpoint when a specific value is written on the stack. I know how to set hardware breakpoint, but I can set it only by address.
0
votes
2answers
77 views

How are images found inside DLLs accessed? [closed]

Sometimes a program displays images that don't exist as jpegs or bmps that come with the program so they have to be residing inside the exe itself or inside a DLL that comes with the program. So My ...
1
vote
1answer
148 views

Game's anti-cheat complains when driver test-signing mode is on

I use Windows 7 64 bit, thus in order to load a test-signed driver, I need to enable test-signing mode. My driver bypasses some of the game's anti-cheat features to allow me to run a debugger and ...
1
vote
2answers
127 views

How to reach functions triggered by non-standard buttons?

I've already read related posts such as: link1: https://stackoverflow.com/questions/24138087/how-can-i-set-a-breakpoint-for-a-button-click-using-ollydbg link2: How can I set a breakpoint for a button ...
1
vote
1answer
112 views

Injecting exe file into process fails on windows 7 but works on windows 10 / Execution library function fails, access denied

I'm trying to inject my executable payload into remote process. I allocated memory in remote process, I converted raw payload using RVA addressing. I applied relocations and imports table. When I'm ...
0
votes
1answer
42 views

How to protect memory area, not segment or page!

I want to protect the certain memory area, like 0x12345678 ~ 0x12345679. so if another thread accesses to that area, I want to generate exception. To solve my problem, I've found and used ...
2
votes
1answer
89 views

Missing kernel32.dll in import table

I have very basic application which is console app dispaying message box. In Visual Studio I change following options: - C/C++ -> SecurityCheck -> Disable Security Check (/GS-) - Linker -> ...
1
vote
1answer
59 views

Is there any way to call function instead of breakpoint, when certain memory area is accessed or register value is matched?

I am studying assembly and hooking. I know how to hook x86 assembly now. so if any thread goes to certain address which is overwritten with my code, it automatically returns to my function. I think ...
1
vote
1answer
117 views

What is ObjectStublessClientXX in ole32dll?

When I do dynamic reversing I saw usage with ObjectStublessClientXX in ole32.dll . What is that function? What does it do? Is there any way that it supposed to transfer message between 2 processes? ...
0
votes
1answer
119 views

When to create a keygen versus when to bypass the security jumps

I am a newbie reverse engineer. I was wondering: assuming I want to crack a program (With the permission of the author of course) and I have detected the Assembly where the program begins to check the ...
2
votes
1answer
252 views

Trap Flag - Anti-debugging trick

I am trying to reverse a program which is employing some kind of anti-debugging trick based on the use of SEHs and the TF. The code stars with: So apparently it's generating an exception with XOR ...