Skip to main content

Questions tagged [windows-10]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0 votes
0 answers
48 views

Reversing SYSTEM Process

I'm doing some vulnerability research against a Windows server application that serves some update files that clients can download. Using TcpView/netstat, I can see that there is an open port ...
BobNewby's user avatar
0 votes
0 answers
70 views

Why is Windows 10 still blocking me from running malware?

I am analyzing some malware on Windows 10. I installed FLARE VM, disabled tamper protection and disabled the virus scanner in the registry. However when I attempt to run a malware, Windows is still ...
Jason Crosby's user avatar
5 votes
1 answer
369 views

Why is function in kernel32.dll jumping into a api-ms-win-core stub

I was trying to look into the implementation of GetVersion function in kernel32.dll. I was surprised to see that the GetVersion thunk is issuing a jump to API-MS-WIN-CORE-SYSINFO-L1-1-0.DLL::...
caramel1995's user avatar
-1 votes
1 answer
169 views

My IDA have 2 different address for same code How to change it

I am a novice for use ida pro and I do not know I change some settings that are maked left analyse address wrong.How I fix it?Thanks
moshui Z's user avatar
1 vote
0 answers
89 views

How to reverse an import function?

I'm reversing windows .sys file and an import function RtlLookupEntryHashTable appears in my target functions. I want to know the pseudocode of it. How to achieve this? .text:00000001C00218C2 ...
anonymous bear's user avatar
2 votes
1 answer
137 views

Getting "Flow analysis was incomplete, some code may be missing" on WinDbg

I wanted to perform static analysis on the Win32 function CreateFileW, so I loaded kernel32.dll using WinDbg and perform the command uf kernel32!CreateFileW. But I am seeing the following output ...
caramel1995's user avatar
3 votes
0 answers
231 views

Why can't I view certain USER32.dll API calls in the disassembly?

I'm trying to understand and patch the GUI in Microsoft Edge. When I look at the disassembly in 2 different debuggers (x64dbg and cutter), the API calls responsible for much of the GUI functionality ...
n0rmalguy011's user avatar
2 votes
1 answer
428 views

Windows UI freezes except the debugger itself when a breakpoint is hit in every debuggers I tried on a particular application

I'm trying to "trace" (just setting breakpoint, step in, step over to know how certain things work) an application. But if the application enters suspended state by using breakpoint, every ...
Meigyoku Thmn's user avatar
4 votes
1 answer
1k views

Is it possible to fake being joined to a domain in Windows 10?

I'm dealing with a malware sample from a pentest that will only execute properly if the system is a member of the target organization's Windows Active Directory domain. Rather than standing up my own ...
Sean W.'s user avatar
  • 151
3 votes
2 answers
1k views

Is there a way to decompress a Fody-Costura generated exe in c#?

There is a program that is possibly a RAT, and I would like to view the source code. After opening the .exe in dnSpy, I was able to tell that it was compressed with Fody-Costura. (https://github.com/...
Nqndi's user avatar
  • 35
0 votes
0 answers
1k views

Ghidra unable to find the JDK

Unzipped the ghidra application. When I run the .bat file I get the following message LaunchSupport expected 2 to 4 arguments but got 1 LaunchSupport expected 2 to 4 arguments but got 1 LaunchSupport ...
Amit wadhwa's user avatar
1 vote
0 answers
78 views

Finding which binary (library, driver, etc) caused an event log

I found some events in the Windows Event Log, and I was wondering which binary caused them. The event I am curious about is Event ID 27 from Hyper-V Hyper-V launch failed; the Hyper-V boot loader was ...
Marco's user avatar
  • 89
-1 votes
1 answer
2k views

A Process does not list on x64dbg attach list

I'm learning RE with x64dbg on Windows10. It does not list a process in the running process list that I want to attach. The Process is running 32-bit crackme application for learning. It was created ...
KiYugadgeter's user avatar
2 votes
0 answers
103 views

Figuring out Win10 ShellMenuHost/StartMenuHost cache data relation for Tiles

I have a weird bug that causes this crap: There are plenty of dumb "solutions" a-la "turn it off and on" but none of them work and/or relevant, the shell apps simply refuse to ...
KreonZZ's user avatar
  • 141
2 votes
0 answers
127 views

Accessing Windows 10 Feedback Hub Data

I'm trying to make a website that displays the feedback from the Windows 10 Feedback Hub but i have met a roadblock. I'm using Fiddler 4 (Fiddler Everywhere doesn't have support for UWP yet and ...
Dar's user avatar
  • 21
0 votes
0 answers
279 views

x64dbg how to find name of DLL not found

I have a program that hangs at start on my Window 10 system but runs ok on a VM running a vanilla Windows 10 system. Using x64dbg I get to an error where it states a DLL is not found. I have been ...
MrMajorThorburn's user avatar
1 vote
0 answers
44 views

PE Format - How can I delete IMAGE_IAT_DIRECTORY and the app still runs fine?

I’m doing a small research regarding PE files and while I drilled every related question or the documentation itself I couldn’t explain this issue. Why can I go to CFF explorer or some other PE ...
FigureItOut's user avatar
4 votes
1 answer
317 views

Where do mouse/keyboard GUI inputs get queued or stored?

Where do mouse-clicks in a program's GUI window/menus (Windows OS) get stored in memory? Is there some sort of input/GUI "queue" similar to Windows messages queuing? I'm wondering if it'd be possible ...
Coldblackice's user avatar
0 votes
1 answer
1k views

c++ reading process memory with injected DLL

The reading works fine until it reaches base+27.058.176(bytes) address. At this address VirtualProtect() failes with error 487 (Attempt to access invalid address). Why does it return this error? Btw ...
Created's user avatar
  • 11
6 votes
3 answers
2k views

Reverse engineer Listen to this device on Windows - Reverse engineer Windows when there's no API

I'm writing an Autohotkey script to toggle Listen to this device for my microphone, without interacting with a GUI. I thought it would be a simple registry key being modified so I used RegShot to ...
Shayan's user avatar
  • 111
4 votes
2 answers
4k views

Is there a tool to reverse engineer UWP apps, similar to dnSpy for .NET?

I've been long fascinated with dnSpy and how easily it can reverse engineer .NET apps into a readable C#. So I was wondering if there's a similar tool to RE Windows 10 UWP apps? For instance, I tried ...
c00000fd's user avatar
  • 1,691
0 votes
0 answers
132 views

Intel Pin assertion failed: RTN_Valid(x)

I am working on modifying my Intel Pin based tool. As before I am using VS2015 on Windows 10. Previously, I have been testing a tool on the same system where I build it and it worked just fine. The ...
aGGeRReS's user avatar
  • 124
4 votes
3 answers
6k views

How to find the starting address of text section of a DLL inside a process? (64 bit)

There was a question about this a year ago, but the answer doesn't explain how to do it in C/C++: How to find start of .text section? I'm not talking about module start address, which we can get ...
Mery Ted's user avatar
  • 232
1 vote
1 answer
918 views

Why address 7FFE0308 always gets compared in 64bit applications before making a syscall in Ntdll?

So there was a question asked before about this : What are the difference syscall and int 0x2E instructions? and it has two answer, one says that is just a way to check if we are in a 32 bit or 64 ...
OneAndOnly's user avatar
0 votes
0 answers
3k views

How to generate exe from compiled Python files?

I have extracted compiled files from exe (executable in windows) using PyInstaller Extractor script. In Resultant folder, i have got was pyc files bundled in pyz folder. Then I decompiled files (...
RS Gamer's user avatar
2 votes
0 answers
659 views

How can I spoof WMI data?

I want to add a fake KB to the OS, and see it using wmic qfe list. So do you know how can I create a faked KB? Or if it is possible to cause WMI to report a specific KB?
AHS's user avatar
  • 121
3 votes
3 answers
2k views

How can I enumerate and hook into a Windows 10 RPC interface?

Suppose that I have a certain Windows service that I know exposes a local RPC interface. I want to create a client program that calls into these procedures; however, I do not have the source code for ...
user25972's user avatar
  • 113
0 votes
0 answers
30 views

How to retrace Database Changes from a Software

i need to retrace database changes by an specific application. The database is really big(~8GB) and contains over 300 tables, and some of the tables have > 100 columns. Another Problem is, that the ...
frTsf3f's user avatar
6 votes
1 answer
492 views

Returning to usermode shellcode from windows kernel (Win10)

I have written a kernel exploit (for the latest Win10 64bit) that executes (or returns to from the kernel) token stealing shellcode, which is placed in the VirtulAlloc'ed memory in the userland. The ...
Jaewon Min's user avatar
4 votes
3 answers
4k views

Get interface definition of undocumented COM objects

I have started exploring COM objects, initially I got to it from UAC bypass methods but I guess my question is general. The general question is: How can I get from (elevated) CLSID in the registry to ...
Anton.P's user avatar
  • 143
2 votes
2 answers
3k views

.00cfg section in the PE file

What's that .00cfg section that is being added by Visual Studio 2017 to PE32+ binary files (for x64 builds)? I'm assuming it stands for "Control Flow Guard" section. It is relatively small and mostly ...
c00000fd's user avatar
  • 1,691
2 votes
1 answer
222 views

How are __argc and __wargv globals exported from a 64-bit PE file compiled with Visual Studio?

I need to inject my code into a 64-bit process. I'm wondering, how can I access __argc and __wargv global variables once in the injected process? Are they always present at a static/preset address?
c00000fd's user avatar
  • 1,691
4 votes
1 answer
3k views

Debug a windows service entry without windbg

An answer to a similar question here mentions that the entry of a windows service can be patched to allow attaching a debugger (in my case x64dbg). Google searches on the topic are all related to ...
Twifty's user avatar
  • 422
3 votes
1 answer
2k views

How to debug slow Windows API calls?

My machine at work has recently been updated to Windows 10, from Windows 7, and it has become incredibly slow. The IT has installed a bunch of new tools for security and protection after the upgrade ...
Ali's user avatar
  • 149
4 votes
1 answer
593 views

ntoskrnl checksum mismatch

I had hex-edited windows kernel file c:\windows\system32\ntoskrnl.exe to fix some assembly bytes in the way i need it. System wont boot because of STATUS_IMAGE_CHECKSUM_MISMATCH error (0xC0000221; ...
xakepp35's user avatar
  • 143
2 votes
1 answer
3k views

Windbg: How to directly view GS:[0x60]

Win10x64: In Windbg, how may I view a pointer to the PEB by directly using GS:[0x60] (and not by Windbg extensions)? To test, I assembled a program via masm64 that throws an interrupt, clears r8 then ...
grepNstepN's user avatar
2 votes
3 answers
821 views

What are the .cpp files in IDA disassembly [duplicate]

I opened wsl.exe in IDA Pro v7 and follow some strings. I saw some strings with .cpp extension. Can anyone explain what are those .cpp file in that disassembly? Where can I find it? Are those hidden ...
Biswapriyo's user avatar
  • 1,569
1 vote
0 answers
80 views

How do I hook API to get realtime stock price data?

How I can hook SSL API from proprietary software. I want to extract realtime stock price data from stock trade software that provided by securities company. There is no API in this software. And ...
KiYugadgeter's user avatar
34 votes
4 answers
17k views

How to reverse engineer a Windows 10 UWP app?

I wanted to see what Microsoft are doing when you click "Restart now" button in their Settings -> Update window on Windows 10: Somehow the results are not the same what is available via ...
c00000fd's user avatar
  • 1,691
2 votes
5 answers
13k views

Run PE File - (Executable) From Memory

Would be grateful for your suggestion.Trying to run a 32/64bit on (Windows 10- 64 bit /Visual studio) program which tries to run an executable from memory.This is for my learning purpose. #include &...
Chandra's user avatar
  • 21
2 votes
2 answers
15k views

How can I receive DbgPrint messages in windbg on windows 10

I have been googling and I feel this answer should be a simple one. I think that the keywords are however, too generic and are bringing up a lot of things related but not what I am looking for. I am ...
LUser's user avatar
  • 793