Questions tagged [windows]

Windows refers to the Microsoft Windows series of operating systems.

Filter by
Sorted by
Tagged with
4 votes
1 answer
959 views

Windows 10 v.1803 boot failure after trying to install network kernel debugging with WinDbg Preview

I'm trying to set up kernel debugging on a physical hardware/desktop to test the new WinDbg Preview. Here's the steps: I'm using a desktop with Intel DG41TY board. Installed Windows 10 Pro build 1803....
0 votes
0 answers
2 views

Calling a function with a variable number of args from a proxy DLL

The program I'm messing with has builtin logging. Using a proxy DLL, I managed to activate it by calling the right functions from the real DLL. However, I got stuck at using the actual logging ...
1 vote
1 answer
21 views

Understanding disassembly information from Visual Studio's dumpbin and GNU's objdump

I usually write my code on Windows, and there are two different types of development environments, each providing their own tools to view the assembly code of an object file(*.obj) or executable (*....
4 votes
2 answers
17k views

Why my Resource Hacker doesn't work with some .EXE files

I use Resource Hacker Application for Reverse Engineering purposes, I've cracked 3 softwares by using this software, but it doesn't grab all .EXE, .DLL files. sometimes It says, This is not a valid ...
1 vote
0 answers
22 views

How to convert addresses shown by IDA when statically analyzing a DLL to real addresses in runtime

In a DLL I am trying to reverse there often is a reference to something I believe to be a fixed pointer (like a global var) which looks like dword_10038534. The references I am talking about look like ...
0 votes
1 answer
60 views

Frida hook multiple processes

There was such a situation. I run the frida hook on the process like this: frida -f '..\hack2\hackme.exe' -l .\start.js In the script itself I do this var moduleData = Process.getModuleByName("...
3 votes
1 answer
712 views

Why is ASLR not activated though IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE is set?

Even a minimal console Delphi program that has IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE set in its PE image does not use ASLR. GetProcessMitigationPolicy() returns a PROCESS_MITIGATION_ASLR_POLICY of 0. ...
0 votes
0 answers
13 views

How are system page map entries belonging to process's updated?

Every process has its own PML4 table, and the first 9 bits of the 48-bit virtual address describe the index of a PML4 entry. The first bit of the PML4 index is clear for user code and set for kernel ...
1 vote
1 answer
48 views

How to load a PDB file into x64dbg?

I want to see symbols in the disassembly wherever possible, and I have a PDB file for the .exe I'm debugging, but I can't find a way to load the PDB file from disk. Is it even possible?
13 votes
2 answers
4k views

How do the internals of a Windows update security patch work?

Wasn't sure where to ask this on stack exchange, so vote to close if you think it is in the wrong place. I am analyzing a Windows security patch. Having never examined a windows security patch, and ...
1 vote
1 answer
24 views

What are these Device Object Characteristics / Flags in Windows 10 ntoskrnl!IopParseDevice

In Windows 10 looking at ntoskrnl!IopParseDevice I'm trying to work out the name / purpose of the flags in this check, which seem to be testing for values in a DEVICE_OBJECT Characteristics property ...
0 votes
1 answer
24 views

IDA show xrefs in .pdata and nothing else

I'm debugging the Windows ARM64 version's EFI (bootaa64.efi). Using QEMU and GDB I was able to find that bootaa64.efi was stuck in one of the two functions BlKernelSp0SystemErrorHandler and ...
0 votes
5 answers
2k views

Advice about first steps on reversing windows kernel

I'll appreciate if anyone can give me a couple advices regarding kernel debugging/reversing. For instance if i want to know how the heap manager works what should i look for ? I have no experience ...
9 votes
1 answer
947 views

Red Alert 2 Windows 8 DirectDraw compatibility

The game Red Alert 2 runs on Windows 8, but as soon as I inject a DLL (via ddraw.dll or an extra DLL) it stops drawing buttons on the main menu. With the DLL it still work fine in windowed mode and it ...
3 votes
1 answer
1k views

What conditions can create the "Not a Valid Win32 Application" error message upon load?

I'm doing research on the PE format/Windows Loader and I am unable to locate specifics as to what creates the error "Not a valid Win32 Application" followed by a failure to load. I've tried changing ...
1 vote
0 answers
14 views

Why does OllyDbg label data segment as read only?

I'm working on this problem: Challenge 53 When compiling with cl c53.c /Fac53.asm /MD in VS2019 X86 Development Console and loading the .exe into OllyDbg, I found OllyDbg labels all segments of c53 as ...
4 votes
1 answer
205 views

Reconstructing Assembly Truth Map

So I recently read [1] which evaluates several disassemblers. The truth/test binaries are generated by the SPEC CPU 2006 Benchmark suite. The authors provide detailed build instructions for the ELF ...
0 votes
1 answer
833 views

How to find main() of Windows EXE with Ghidra?

I'm new to Ghidra, my goal is to add localizations for a small EXE program. The program was written in Visual Studio and has Russian dialogs, which I like to convert to English. I've loaded the EXE ...
0 votes
0 answers
19 views

How to initiate usb connection as usb display

I'm trying to essentially make an hdmi dummy plug to trick the computer into thinking there is a second monitor. I am planning on doing it by having a raspberry pi pico act as a usb monitor. (much ...
1 vote
1 answer
60 views

Why is Visual Studio compiling my EXE file with an entry point that is not in the file?

So I am trying to open my test app EXE file in ollydbg to study the assembly, the stack, registers and all that stuff for educational purposes and it gives me this message saying that the entry point ...
0 votes
0 answers
18 views

How to download previous releases that were published on Windows Store?

Often it's useful when Reverse Engineering to compare releases to one another. Windows Store has previously been unpopular, but is getting increasing use. Utilities like https://github.com/microsoft/...
4 votes
2 answers
3k views

How to do Global DLL injection

How can one go about injection of a DLL into every process? Can SetwindowsHookEx() do the trick? Does AppInit_DLLs work as it used to?
2 votes
2 answers
368 views

Call function by ebp

When I looking at exe file with Ida I see call dword ptr [ebp -70p] What is that? Why this function calling by ebp and not call sub_0xabcd How can I know which function is that to enter to this ...
1 vote
1 answer
91 views

Instructions to compare two strings

I made a list of which instructions compare two strings in disassembly so that when I get to intermodular calls in x64dbg, I can simply type this instructions to see if there is a comparison have been ...
0 votes
1 answer
117 views

.dll file pull source from compiled study?

Forgive me, I’m new, and not a programmer, but I am needing to see if this is possible. I have a study in my trading platform I had built a long time ago, lost the original, but have the compiled .dll ...
1 vote
1 answer
55 views

funcion calls extern function without body

I wanted to look at how does the Windows API get the size of a file, so I opened kernel32.dll in a disassembler. I searched for GetFileSizeEx, and it seems to call a stub(?), but the disassembler ...
2 votes
3 answers
319 views

Injecting C++ code, while also maximizing compatibility with other injections

Using the New Vegas Script Extender C++ API for Fallout New Vegas, I am able to write to the process' memory directly at runtime through a .dll plugin that's loaded by the NVSE injector. But it is not ...
4 votes
0 answers
687 views

Page Fault Handler in Windows

Like almost all of my questions, I feel like I'm missing something / I understood something the wrong way, so help me figure out where I'm wrong with this. When a Page Fault occurs and nt!KiTrap0E ...
2 votes
2 answers
507 views

Analyzing Windows kernel driver

I'm trying to analyze some Windows kernel driver. What I want to achieve is full execution trace, from driver entry to end point. Driver is heavily virtualized and contains multiple anti-debugging ...
1 vote
0 answers
44 views

Reverse engineering unknown data file

I have a set of datafiles that I want to reverse engineer which are used by a software that controls my heating system. I want to extract the commands to then use these commands in my home automation ...
0 votes
3 answers
506 views

How to find the address (offset) of specific driver function

I am reversing Capcom driver and in IDA I have this list of functions: I want to set breakpoint on the function sub_10590 but I don't know what is the address of this function when I am doing live ...
0 votes
0 answers
17 views

Phoenix Exploit Education, Powershell script not working the error: '-netdev:user: invalid option','vmlinuz-4.9.0-8-amd64': No such file or directory

I tried these 2 scripts to set up phoenix from Exploit-Education but faced the below errors could not find any other script online one was from https://blog.lamarranet.com/index.php/exploit-education-...
0 votes
0 answers
78 views

How to identify if an .exe packed by VMProtect has virtualization enabled?

I am interested in reverse engineering a few parts of an .exe application (windows 32-bit executable) that downloads some documents from a server and decrypts them locally in memory. Using PE EXE ...
0 votes
1 answer
601 views

How to unpack Armadillo protected software using x64dbg?

I am planning to reverse-engineer a Windows executable that has been protected with Armadillo. When I put the executable through Detect It Easy, the results show that the executable was protected with ...
0 votes
1 answer
2k views

Reversing a program with dongle

So I'm learning Reverse Engineering / Software cracking. I have a program that I am practicing on that requires a dongle in order for the program to start. From looking through the disassembly ...
1 vote
1 answer
71 views

Windows UI freezes except the debugger itself when a breakpoint is hit in every debuggers I tried on a particular application

I'm trying to "trace" (just setting breakpoint, step in, step over to know how certain things work) an application. But if the application enters suspended state by using breakpoint, every ...
-2 votes
1 answer
218 views

Windows reverse engineered?

Have read in some Discord channel, that Windows was reverse engineered. Does anybody here have knowledge about such reverse engineered Windows version? If it really exists, where can it be downloaded?
0 votes
1 answer
87 views

Understanding the meaning of EBP + 0xffff98b4

I'm currently reverse-engineering an old game from 2003 to extend its functionality. I have now found what I am looking for and since it was written in C++ I'm trying to re-create the used classes. I ...
2 votes
1 answer
300 views

Change manifest file using ResourceHacker CLI

I want to automate some manifest file changes (change requestedExecutionLevel level to requireAdministator from asInvoker) so I have to use ResourceHacker CLI. I have managed to extract the resources ...
0 votes
0 answers
46 views

How can i reconstruct a full PE from a memory injected PE that only has IAT + sections content?

I have a injected PE (kernel mode rootkit to be exact) that only has the IAT table, which basically only stores the addresses of some kernel functions in an array which is referenced inside its code, ...
1 vote
2 answers
36 views

Cant Save .exe using reflixil and Red Gate Reflector 10.3

First off all im pretty new to Reverse Engineering. Im Stuck on Saving my Project. When i want to save the Assembly as .exe file Reflexil says cant save, the specified Method is not supported. I tried ...
1 vote
1 answer
1k views

How would I find a color's memory address? (Beginner)

I'm an absolute beginner (just started learning about process memory a few hours ago). I'm trying to find the memory address for the color of Color 1 in mspaint using x64dbg. I know it's black, so I'...
28 votes
4 answers
12k views

Can I statically link (not import) the Windows system DLLs?

I have compiled following C source code in VS2010 console project. #include <stdio.h> int main(int argc, char* argv[]){ printf("hello world\n"); return 0; } then I used /MT option for ...
0 votes
1 answer
169 views

How do I get all sections in a PE file using C++?

So I am wondering how can I get all sections and their info from a dumped PE file on the disk, using C++. I have the entire PE loaded on a buffer, the NT headers, and hopefully the DOS headers. I need ...
17 votes
4 answers
5k views

Server-side Query interception with MS SQL Server

I'm researching into intercepting queries that arrive at the SQL Server 2008 process. SQLOS architecture is divided in the following system DLLs: sqlmin.dll: Storage, replication, security features,...
0 votes
1 answer
41 views

One class with different sizes

After looking at some basic examples of how C++ classes are compiled by MSVC, I tried to apply the knowledge to a DLL I'm working on. While searching for a class to start with, I came across ...
1 vote
1 answer
60 views

Unknown usage of dwLength and SsHandle members in PEB_LDR_DATA

I've been implementing some Windows internals code and when I have tried to document this structure I have not been able to do so because of those two members. I can't find anything about them. This ...
0 votes
0 answers
63 views

Reverse engineering Samsung Quick share UWP app

I want to make the Samsung Quick Share app work on my PC which is not from Samsung. So which DLL file would I have to reverse engineer to bypass that restriction, and how to get full access to UWP ...
1 vote
1 answer
311 views

Adding a static variable to Windows DLL

I'm trying to patch a function in a Windows x86 DLL, however it turned out that I need a static variable to store some state that wasn't correctly preserved by the original executable across calls. I ...
0 votes
0 answers
27 views

How to redirect connections by an exe file to a specific external ip address

I have an exe program that connects randomly to one of the 4 addresses 188.39.21.82...83...84...85 out of which only 82 works Currently I blocked the remaining addresses using Windows 10 Firewall ...

1
2 3 4 5
15