Questions tagged [windows]

Windows refers to the Microsoft Windows series of operating systems.

Filter by
Sorted by
Tagged with
1 vote
0 answers
16 views

WinDbg Preview search is not returning results

I am attempting to manually unpack a malware sample. I am using the new WinDbg Preview (only thing that is available to download now). After letting the malware call VirtualAlloc I am trying to search ...
0 votes
0 answers
43 views

Why is Windows 10 still blocking me from running malware?

I am analyzing some malware on Windows 10. I installed FLARE VM, disabled tamper protection and disabled the virus scanner in the registry. However when I attempt to run a malware, Windows is still ...
0 votes
0 answers
21 views

IDA pro Error how to resolve this error

52C187F5: The instruction at 0x52C187F5 referenced memory at 0x4. The memory could not be read -> 00000004 (exc.code c0000005, tid 672) How to Solve this. I have seen sandbox reports in those the ...
3 votes
0 answers
33 views

Reverse engineer DPC Latency Checker tool to fix high Windows kernel timer latency

I need help with something very Windows/kernel-specific. I'm working on a fix for the high Kernel Timer Latency in Windows 10 2004 and higher. This problem was introduced between Insider Build 18950 ...
2 votes
0 answers
28 views

How does Windows Updates determine if the patches are compatible?

I am looking into Microsoft Windows updates, and how they are applied, after extracting the .msu file, we get some .cab files with patches (in PA30 format), and informations on the file attributes, ...
7 votes
1 answer
4k views

Where ES/GS/FS are pointing to?

As far as I know those segments are extra or general. But at which part of program memory they are actually pointing? If I undestand it correctly DS is poining at entry point of Dump, SS stands for ...
2 votes
3 answers
1k views

How to find the address (offset) of specific driver function

I am reversing Capcom driver and in IDA I have this list of functions: I want to set breakpoint on the function sub_10590 but I don't know what is the address of this function when I am doing live ...
3 votes
1 answer
201 views

Why can I inherit handles from WSASocketA and not from socket?

I'm trying to write some custom shellcode to obtain a shell from a program. Looking at the program intermodular calls, I found a call to socket(), and my initial plan was to use that to create a new ...
1 vote
1 answer
160 views

Reverse Engineering Go obfuscated binaries

I have been trying to understand the working of this go malware by reversing it, which can be found here , so basically this stuff takes a shellcode as an input, and converts it to an exe or dll file, ...
9 votes
2 answers
5k views

What are the difference syscall and int 0x2E instructions?

From this question: How does the Windows Native API communicate with the kernel? Here is an example of ZwClose(HANDLE Handle); system call in NTDLL.DLL in Windows 10 X86_64: NtClose proc near ...
3 votes
1 answer
2k views

How to unpack Armadillo protected software using x64dbg?

I am planning to reverse-engineer a Windows executable that has been protected with Armadillo. When I put the executable through Detect It Easy, the results show that the executable was protected with ...
3 votes
1 answer
99 views

Why is function in kernel32.dll jumping into a api-ms-win-core stub

I was trying to look into the implementation of GetVersion function in kernel32.dll. I was surprised to see that the GetVersion thunk is issuing a jump to API-MS-WIN-CORE-SYSINFO-L1-1-0.DLL::...
3 votes
1 answer
71 views

Windows 11: Interact with IDA pro when running in session 0

I am trying to debug a windows service, so I set IDA as the debugger of that service. But since services are running in session 0, I can't interact with IDA. Also in the latest windows version (e.g. ...
2 votes
1 answer
229 views

Windows UI freezes except the debugger itself when a breakpoint is hit in every debuggers I tried on a particular application

I'm trying to "trace" (just setting breakpoint, step in, step over to know how certain things work) an application. But if the application enters suspended state by using breakpoint, every ...
1 vote
1 answer
47 views

Capture and Replay

I was wondering if it was possible to create a python script that is able to capture and replay the instructions executed by a windows program for in depth analysis.
5 votes
1 answer
1k views

Windows 10 v.1803 boot failure after trying to install network kernel debugging with WinDbg Preview

I'm trying to set up kernel debugging on a physical hardware/desktop to test the new WinDbg Preview. Here's the steps: I'm using a desktop with Intel DG41TY board. Installed Windows 10 Pro build 1803....
2 votes
1 answer
58 views

The same notepad.exe runs in both WoW64 and x64 modes

When I run notepad.exe with x64dbg it runs as WOW64 process. But when I run it with x32dbg it runs as x64 process with x64 instructions. I am running it from the same directory C:\Windows\System32\...
2 votes
2 answers
165 views

Reverse function in .rdata field

I'm tracking a function called CreateIoCompletionPort in dns.exe. The import tab in IDA shows that it's imported from api-ms-win-core-io-l1-1-0.dll. However, it appears in .rdata section in the .dll ...
5 votes
1 answer
817 views

Why is ASLR not activated though IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE is set?

Even a minimal console Delphi program that has IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE set in its PE image does not use ASLR. GetProcessMitigationPolicy() returns a PROCESS_MITIGATION_ASLR_POLICY of 0. ...
2 votes
1 answer
49 views

How does this Is64BitOS pointer-arithmetic-based function work?

Reversed this function. It works. But stepping through I can't figure out how. Why does this work? bool _Is64BitOS(void) { unsigned int version = *(unsigned int*)0x7FFE026C; unsigned int ...
5 votes
2 answers
605 views

Fixing/recompiling a heavily control flow obfuscated function

I've recently come across a binary that has been obfuscated with a very obscure protection. Obfuscation From what I understand, the obfuscator is effective in several ways. Multiple JMPs via relative ...
2 votes
1 answer
69 views

Getting "Flow analysis was incomplete, some code may be missing" on WinDbg

I wanted to perform static analysis on the Win32 function CreateFileW, so I loaded kernel32.dll using WinDbg and perform the command uf kernel32!CreateFileW. But I am seeing the following output ...
6 votes
1 answer
234 views

Reconstructing Assembly Truth Map

So I recently read [1] which evaluates several disassemblers. The truth/test binaries are generated by the SPEC CPU 2006 Benchmark suite. The authors provide detailed build instructions for the ELF ...
1 vote
1 answer
2k views

How to find main() of Windows EXE with Ghidra?

I'm new to Ghidra, my goal is to add localizations for a small EXE program. The program was written in Visual Studio and has Russian dialogs, which I like to convert to English. I've loaded the EXE ...
1 vote
1 answer
101 views

How to access files stored in mouse?

I own a Razer Mamba Elite mouse. After plugging it in to the usb port, an software installation window shows up. Basically it's the Razer software to manage device's options such as profiles, macros, ...
1 vote
1 answer
126 views

Forcing a legacy Windows application to use an older version of ntdll.dll

There is this old Windows application I've been using for more than a decade now: DesktopEarth. It got its last update in 2015 and the author's website is offline now, but it's been running fine on ...
1 vote
0 answers
47 views

How to decrypt data during runtime before executing and then encrypting it back

I was doing some research and came across the term protectors. From my understanding is they encrypt a file to be protected but run it without an issue. During its execution it is able to decrypt the ...
1 vote
0 answers
42 views

What is the following code will do after modifying it? [closed]

The following commands will change the files information gatherosstate.exe file. From looking at the hex values I can interpret that there are nop (0x00). The file changed in windows terminal. But ...
2 votes
1 answer
78 views

How to call Windows console in ASM and printf some values there?

Is there a working way to embed the windows console in disasm code? I tried AllocConsole with GetStdHandle or AttachConsole with PID of an existing console but it didn't work. I have tried printf ...
1 vote
1 answer
123 views

What are latest research in reverse engineering?

I am searching research papers related to reverse engineering between 2020 and 2022 but did not found good papers with latest research in the direction of reverse engineering. So, what are the latest ...
4 votes
2 answers
4k views

Real PE32(+) entry point - is it documented anywhere?

Microsoft documentation gives WinMain() as the entry point for a Windows program, but unlike DllMain() it seems to be a pure fiction arranged by the compiler-provided startup code. I've looked at the ...
3 votes
1 answer
240 views

Win32 x86 prologue disassembly

I have the following disassembly of a function prologue with comments. I'm unclear on what the author means in this line of disassembly "lea edi,[ebp-0xcc] ; getting the lowest address of stack ...
2 votes
1 answer
35 views

generate code execution/cpu time flame-graph of library DLL (Noob question)

I have a library DLL which I'm trying to analyze, and I have a basic understanding of its function and behavior (and can modify some input to affect how long certain operations will take to execute/...
1 vote
0 answers
40 views

How to obtain import name from disassembled assembly

I'm trying to create my own tools for reverse engineering PE. I have some assembly codes that I fetched from a clone of objdump for a program. Sometimes I see call instructions such as : callq *...
2 votes
1 answer
218 views

Instructions to compare two strings

I made a list of which instructions compare two strings in disassembly so that when I get to intermodular calls in x64dbg, I can simply type this instructions to see if there is a comparison have been ...
2 votes
1 answer
341 views

Function pointer and symbols in Ghidra

I am using Ghidra and I see that when it uses function pointers it never shows the paraments that are being sent to the function(In IDA pro, it always show the parameters). How can I fix that it will ...
2 votes
1 answer
56 views

How to investigate in a program of type /SUBSYSTEM:NATIVE that crashes with the RtlFreeAnsiString API?

I compiled a very simple example of an application of type /SUBSYSTEM:NATIVE writing "hello world". It is launched thanks to the "BootExecute" key. The program works without errors....
3 votes
2 answers
399 views

Injecting C++ code, while also maximizing compatibility with other injections

Using the New Vegas Script Extender C++ API for Fallout New Vegas, I am able to write to the process' memory directly at runtime through a .dll plugin that's loaded by the NVSE injector. But it is not ...
0 votes
0 answers
82 views

x32dbg : exe with different code address when running

I have a 32 bits exe that works only when there is a specific usb flash disk inserted. On my new laptop, I only have a single USB port, so I want to make it works without the original key, or from a &...
13 votes
5 answers
18k views

Freely available resource hacking applications

I am using Resource Hacker as a tool to extract out resources like icon, images, etc. from .dll or .exe file. In addition, I am using it to crack some small Windows application. However, it does not ...
2 votes
0 answers
153 views

How find all kernel functions called by a driver in windows 11

I am working on a highly obfuscated driver that is virtualized. In an attempt to work on this driver I asked a question about some python scripts which turned out not to be effective at all so I ...
3 votes
1 answer
104 views

Exact copy of USB flash drive

I have a USB flash drive, with 2 partitions : one is read only and contains a Windows software, and the second is read/write for user data. In order to not damage this precious key, I want to do a ...
4 votes
1 answer
2k views

How can I modify binary image resource data?

I've been hacking and modding software for years, and have learned a lot, but there are still a few things that vex me - this is one such case. I have noticed that some PEs contain an RCData section ...
3 votes
1 answer
983 views

How do I unpack a file protected by MPRESS?

I have a file that is protected by MPRESS packer and I want to know how to unpack it on Windows. Is there a specific program for that or something else? I am new to this so every help is appreciated.
1 vote
1 answer
252 views

How to disassemble an entire function in Windbg?

I am trying to disassemble the function ExAcquireFastMutex using WinDbg but it gives me only 8 rows: 3: kd> u nt!ExAcquireFastMutex nt!ExAcquireFastMutex: fffff805`456e3820 4053 push ...
0 votes
1 answer
70 views

Find out which struct RaGetUnitStorageDeviceProperty use by reverse engineering

I am trying to find out which struct storport!RaGetUnitStorageDeviceProperty uses by myself. I know I can use google and find out the correct answer is _RAID_UNIT_EXTENSION. However i want to do it ...
0 votes
0 answers
34 views

Is there any way to get old Windows kernel drivers?

I'm working through "Practical Reverse Engineering" and absolutely loving it so far. However, some of the exercises involve "decompiling" some Windows kernel files (like ...
2 votes
1 answer
153 views

STATUS_PRIVILEGED_INSTRUCTION 0xc0000096 from kernel mode code?

Running a kernel driver I wrote. The driver includes: mov rax, cr0 btr rax, 10h mov cr0, rax to clear WP bit in cr0. Curiously the last instruction faults and causes a bluescreen, ...
1 vote
1 answer
74 views

Finding Correct Segment From An Address For Windows 3.1 EXE in IDA Pro

We have an EXE that IDA pro lists the following segments: Name Start End R W X D L Align Base Type Class AD es ss ds fs gs cseg01 00000000 0000EA50 ? ? ? . ...
2 votes
0 answers
81 views

Are system dlls like NTDLL and KERNELBASE etc. are always loaded at the same address on a per-session basis?

If I am understanding, code and read only sections of common DLLs are given system-wide section objects for which each process gets its own section view, in order to save physical memory. As such even ...

1
2 3 4 5
16