Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [windows-10]

The tag has no usage guidance.

0
votes
2answers
41 views

.00cfg section in the PE file

What's that .00cfg section that is being added by Visual Studio 2017 to PE32+ binary files (for x64 builds)? I'm assuming it stands for "Control Flow Guard" section. It is relatively small and mostly ...
1
vote
1answer
38 views

How are __argc and __wargv globals exported from a 64-bit PE file compiled with Visual Studio?

I need to inject my code into a 64-bit process. I'm wondering, how can I access __argc and __wargv global variables once in the injected process? Are they always present at a static/preset address?
2
votes
1answer
61 views

Debug a windows service entry without windbg

An answer to a similar question here mentions that the entry of a windows service can be patched to allow attaching a debugger (in my case x64dbg). Google searches on the topic are all related to ...
3
votes
1answer
107 views

How to debug slow Windows API calls?

My machine at work has recently been updated to Windows 10, from Windows 7, and it has become incredibly slow. The IT has installed a bunch of new tools for security and protection after the upgrade ...
0
votes
0answers
60 views

Strip digital signature check mechanism from windows

I had hex-edited the Windows kernel binary c:\windows\system32\ntoskrnl.exe to fix some assembly bytes in the way i need it. And i want to boot it. However i encounter 0xc0000428 error, saying Windows ...
2
votes
1answer
68 views

ntoskrnl checksum mismatch

I had hex-edited windows kernel file c:\windows\system32\ntoskrnl.exe to fix some assembly bytes in the way i need it. System wont boot because of STATUS_IMAGE_CHECKSUM_MISMATCH error (0xC0000221; ...
1
vote
0answers
119 views

Windbg: How to directly view GS:[0x60]

Win10x64: In Windbg, how may I view a pointer to the PEB by directly using GS:[0x60] (and not by Windbg extensions)? To test, I assembled a program via masm64 that throws an interrupt, clears r8 then ...
2
votes
3answers
267 views

What are the .cpp files in IDA disassembly [duplicate]

I opened wsl.exe in IDA Pro v7 and follow some strings. I saw some strings with .cpp extension. Can anyone explain what are those .cpp file in that disassembly? Where can I find it? Are those hidden ...
1
vote
0answers
53 views

How do I hook API to get realtime stock price data?

How I can hook SSL API from proprietary software. I want to extract realtime stock price data from stock trade software that provided by securities company. There is no API in this software. And ...
16
votes
4answers
2k views

How to reverse engineer a Windows 10 UWP app?

I wanted to see what Microsoft are doing when you click "Restart now" button in their Settings -> Update window on Windows 10: Somehow the results are not the same what is available via ...
1
vote
3answers
2k views

Run PE File - (Executable) From Memory

Would be grateful for your suggestion.Trying to run a 32/64bit on (Windows 10- 64 bit /Visual studio) program which tries to run an executable from memory.This is for my learning purpose. #include &...
3
votes
2answers
805 views

How can I receive DbgPrint messages in windbg on windows 10

I have been googling and I feel this answer should be a simple one. I think that the keywords are however, too generic and are bringing up a lot of things related but not what I am looking for. I am ...