Questions tagged [windows-10]
The windows-10 tag has no usage guidance.
42
questions
0
votes
1
answer
55
views
How to manual copy mp4 file?
I have tried using some popular editors like: sublime text, notepad++ to open mp4 file and after copy content of it. After copy, I added the mp4 extension to the newly copied file. As a result, the ...
- 333
0
votes
0
answers
53
views
Reversing SYSTEM Process
I'm doing some vulnerability research against a Windows server application that serves some update files that clients can download. Using TcpView/netstat, I can see that there is an open port ...
- 3
0
votes
0
answers
70
views
Why is Windows 10 still blocking me from running malware?
I am analyzing some malware on Windows 10. I installed FLARE VM, disabled tamper protection and disabled the virus scanner in the registry. However when I attempt to run a malware, Windows is still ...
- 131
5
votes
1
answer
375
views
Why is function in kernel32.dll jumping into a api-ms-win-core stub
I was trying to look into the implementation of GetVersion function in kernel32.dll.
I was surprised to see that the GetVersion thunk is issuing a jump to API-MS-WIN-CORE-SYSINFO-L1-1-0.DLL::...
- 205
-1
votes
1
answer
170
views
My IDA have 2 different address for same code How to change it
I am a novice for use ida pro and I do not know I change some settings that are maked left analyse address wrong.How I fix it?Thanks
- 1
1
vote
0
answers
91
views
How to reverse an import function?
I'm reversing windows .sys file and an import function RtlLookupEntryHashTable appears in my target functions. I want to know the pseudocode of it. How to achieve this?
.text:00000001C00218C2 ...
- 313
2
votes
1
answer
149
views
Getting "Flow analysis was incomplete, some code may be missing" on WinDbg
I wanted to perform static analysis on the Win32 function CreateFileW, so I loaded kernel32.dll using WinDbg and perform the command uf kernel32!CreateFileW.
But I am seeing the following output ...
- 205
3
votes
0
answers
238
views
Why can't I view certain USER32.dll API calls in the disassembly?
I'm trying to understand and patch the GUI in Microsoft Edge. When I look at the disassembly in 2 different debuggers (x64dbg and cutter), the API calls responsible for much of the GUI functionality ...
- 31
2
votes
1
answer
435
views
Windows UI freezes except the debugger itself when a breakpoint is hit in every debuggers I tried on a particular application
I'm trying to "trace" (just setting breakpoint, step in, step over to know how certain things work) an application. But if the application enters suspended state by using breakpoint, every ...
4
votes
1
answer
1k
views
Is it possible to fake being joined to a domain in Windows 10?
I'm dealing with a malware sample from a pentest that will only execute properly if the system is a member of the target organization's Windows Active Directory domain.
Rather than standing up my own ...
- 151
3
votes
2
answers
1k
views
Is there a way to decompress a Fody-Costura generated exe in c#?
There is a program that is possibly a RAT, and I would like to view the source code.
After opening the .exe in dnSpy, I was able to tell that it was compressed with Fody-Costura. (https://github.com/...
- 35
0
votes
0
answers
1k
views
Ghidra unable to find the JDK
Unzipped the ghidra application. When I run the .bat file I get the following message
LaunchSupport expected 2 to 4 arguments but got 1
LaunchSupport expected 2 to 4 arguments but got 1
LaunchSupport ...
1
vote
0
answers
80
views
Finding which binary (library, driver, etc) caused an event log
I found some events in the Windows Event Log, and I was wondering which binary caused them.
The event I am curious about is Event ID 27 from Hyper-V
Hyper-V launch failed; the Hyper-V boot loader was ...
- 89
-1
votes
1
answer
2k
views
A Process does not list on x64dbg attach list
I'm learning RE with x64dbg on Windows10.
It does not list a process in the running process list that I want to attach.
The Process is running 32-bit crackme application for learning.
It was created ...
- 141
2
votes
0
answers
115
views
Figuring out Win10 ShellMenuHost/StartMenuHost cache data relation for Tiles
I have a weird bug that causes this crap:
There are plenty of dumb "solutions" a-la "turn it off and on" but none of them work and/or relevant, the shell apps simply refuse to ...
- 141
2
votes
0
answers
127
views
Accessing Windows 10 Feedback Hub Data
I'm trying to make a website that displays the feedback from the Windows 10 Feedback Hub but i have met a roadblock. I'm using Fiddler 4 (Fiddler Everywhere doesn't have support for UWP yet and ...
- 21
0
votes
0
answers
291
views
x64dbg how to find name of DLL not found
I have a program that hangs at start on my Window 10 system but runs ok on a VM running a vanilla Windows 10 system.
Using x64dbg I get to an error where it states a DLL is not found.
I have been ...
1
vote
0
answers
44
views
PE Format - How can I delete IMAGE_IAT_DIRECTORY and the app still runs fine?
I’m doing a small research regarding PE files and while I drilled every related question or the documentation itself I couldn’t explain this issue.
Why can I go to CFF explorer or some other PE ...
- 133
4
votes
1
answer
317
views
Where do mouse/keyboard GUI inputs get queued or stored?
Where do mouse-clicks in a program's GUI window/menus (Windows OS) get stored in memory? Is there some sort of input/GUI "queue" similar to Windows messages queuing?
I'm wondering if it'd be possible ...
- 169
0
votes
1
answer
1k
views
c++ reading process memory with injected DLL
The reading works fine until it reaches base+27.058.176(bytes) address. At this address VirtualProtect() failes with error 487 (Attempt to access invalid address).
Why does it return this error? Btw ...
- 11
6
votes
3
answers
2k
views
Reverse engineer Listen to this device on Windows - Reverse engineer Windows when there's no API
I'm writing an Autohotkey script to toggle Listen to this device for my microphone, without interacting with a GUI.
I thought it would be a simple registry key being modified so I used RegShot to ...
- 111
4
votes
2
answers
5k
views
Is there a tool to reverse engineer UWP apps, similar to dnSpy for .NET?
I've been long fascinated with dnSpy and how easily it can reverse engineer .NET apps into a readable C#. So I was wondering if there's a similar tool to RE Windows 10 UWP apps?
For instance, I tried ...
- 1,751
0
votes
0
answers
132
views
Intel Pin assertion failed: RTN_Valid(x)
I am working on modifying my Intel Pin based tool. As before I am using VS2015 on Windows 10. Previously, I have been testing a tool on the same system where I build it and it worked just fine. The ...
- 124
4
votes
3
answers
6k
views
How to find the starting address of text section of a DLL inside a process? (64 bit)
There was a question about this a year ago, but the answer doesn't explain how to do it in C/C++:
How to find start of .text section?
I'm not talking about module start address, which we can get ...
- 232
1
vote
1
answer
1k
views
Why address 7FFE0308 always gets compared in 64bit applications before making a syscall in Ntdll?
So there was a question asked before about this :
What are the difference syscall and int 0x2E instructions?
and it has two answer, one says that is just a way to check if we are in a 32 bit or 64 ...
- 518
0
votes
0
answers
3k
views
How to generate exe from compiled Python files?
I have extracted compiled files from exe (executable in windows) using
PyInstaller Extractor script.
In Resultant folder, i have got was pyc files bundled in pyz folder.
Then I decompiled files (...
- 21
2
votes
0
answers
684
views
How can I spoof WMI data?
I want to add a fake KB to the OS, and see it using wmic qfe list. So do you know how can I create a faked KB? Or if it is possible to cause WMI to report a specific KB?
- 121
3
votes
3
answers
2k
views
How can I enumerate and hook into a Windows 10 RPC interface?
Suppose that I have a certain Windows service that I know exposes a local RPC interface. I want to create a client program that calls into these procedures; however, I do not have the source code for ...
- 113
0
votes
0
answers
30
views
How to retrace Database Changes from a Software
i need to retrace database changes by an specific application.
The database is really big(~8GB) and contains over 300 tables, and some of the tables have > 100 columns. Another Problem is, that the ...
- 1
6
votes
1
answer
497
views
Returning to usermode shellcode from windows kernel (Win10)
I have written a kernel exploit (for the latest Win10 64bit) that executes (or returns to from the kernel) token stealing shellcode, which is placed in the VirtulAlloc'ed memory in the userland.
The ...
- 329
4
votes
3
answers
4k
views
Get interface definition of undocumented COM objects
I have started exploring COM objects, initially I got to it from UAC bypass methods but I guess my question is general. The general question is: How can I get from (elevated) CLSID in the registry to ...
- 143
2
votes
2
answers
3k
views
.00cfg section in the PE file
What's that .00cfg section that is being added by Visual Studio 2017
to PE32+ binary files (for x64 builds)? I'm assuming it stands for
"Control Flow Guard" section. It is relatively small and mostly ...
- 1,751
2
votes
1
answer
226
views
How are __argc and __wargv globals exported from a 64-bit PE file compiled with Visual Studio?
I need to inject my code into a 64-bit process. I'm wondering, how can I access __argc and __wargv global variables once in the injected process?
Are they always present at a static/preset address?
- 1,751
4
votes
1
answer
3k
views
Debug a windows service entry without windbg
An answer to a similar question here mentions that the entry of a windows service can be patched to allow attaching a debugger (in my case x64dbg). Google searches on the topic are all related to ...
- 422
3
votes
1
answer
2k
views
How to debug slow Windows API calls?
My machine at work has recently been updated to Windows 10, from Windows 7, and it has become incredibly slow. The IT has installed a bunch of new tools for security and protection after the upgrade ...
- 149
4
votes
1
answer
602
views
ntoskrnl checksum mismatch
I had hex-edited windows kernel file c:\windows\system32\ntoskrnl.exe to fix some assembly bytes in the way i need it.
System wont boot because of STATUS_IMAGE_CHECKSUM_MISMATCH error (0xC0000221; ...
- 143
2
votes
1
answer
3k
views
Windbg: How to directly view GS:[0x60]
Win10x64: In Windbg, how may I view a pointer to the PEB by directly using GS:[0x60] (and not by Windbg extensions)?
To test, I assembled a program via masm64 that throws an interrupt, clears r8 then ...
- 368
2
votes
3
answers
826
views
What are the .cpp files in IDA disassembly [duplicate]
I opened wsl.exe in IDA Pro v7 and follow some strings. I saw some strings with .cpp extension. Can anyone explain what are those .cpp file in that disassembly? Where can I find it? Are those hidden ...
- 1,579
1
vote
0
answers
80
views
How do I hook API to get realtime stock price data?
How I can hook SSL API from proprietary software.
I want to extract realtime stock price data from stock trade software that provided by securities company.
There is no API in this software. And ...
- 141
35
votes
4
answers
17k
views
How to reverse engineer a Windows 10 UWP app?
I wanted to see what Microsoft are doing when you click "Restart now" button in their Settings -> Update window on Windows 10:
Somehow the results are not the same what is available via ...
- 1,751
2
votes
5
answers
13k
views
Run PE File - (Executable) From Memory
Would be grateful for your suggestion.Trying to run a 32/64bit on (Windows 10- 64 bit /Visual studio) program which tries to run an executable from memory.This is for my learning purpose.
#include &...
- 21
2
votes
2
answers
15k
views
How can I receive DbgPrint messages in windbg on windows 10
I have been googling and I feel this answer should be a simple one. I think that the keywords are however, too generic and are bringing up a lot of things related but not what I am looking for.
I am ...
- 793