Questions tagged [windows]

Windows refers to the Microsoft Windows series of operating systems.

Filter by
Sorted by
Tagged with
1 vote
1 answer
83 views

Unix system with windows-style registry

When trying to determine the filesystem of a firmware image using binwalk, I encountered a strange combination. The binwalk is returning a lot of Unix paths, but some of them contain a typical windows-...
3 votes
3 answers
1k views

How can I enumerate and hook into a Windows 10 RPC interface?

Suppose that I have a certain Windows service that I know exposes a local RPC interface. I want to create a client program that calls into these procedures; however, I do not have the source code for ...
1 vote
1 answer
481 views

Reverse Engineering Go obfuscated binaries

I have been trying to understand the working of this go malware by reversing it, which can be found here , so basically this stuff takes a shellcode as an input, and converts it to an exe or dll file, ...
0 votes
0 answers
36 views

Windows boot sequence operation

I am targeting at creating software for the Windows pre-boot environment but I have hard time finding conclusive information about how it operates. For background: this software will communicate with ...
5 votes
1 answer
116 views

Replace a function in a Windows 32-bit binary with a custom C function

I am reverse engineering a Windows game from 1995 using Ghidra, and I'm currently documenting all the decompiled functions. My goal is to replace a function in the original binary with a custom C ...
1 vote
0 answers
154 views

IDA pro Error how to resolve this error

52C187F5: The instruction at 0x52C187F5 referenced memory at 0x4. The memory could not be read -> 00000004 (exc.code c0000005, tid 672) How to solve this? I have seen sandbox reports in those the ...
4 votes
3 answers
5k views

How to find the starting address of text section of a DLL inside a process? (64 bit)

There was a question about this a year ago, but the answer doesn't explain how to do it in C/C++: How to find start of .text section? I'm not talking about module start address, which we can get ...
0 votes
0 answers
32 views

Audio problem rushing?

After using a new Pc for some time, suddendly a problem with the Audio occured. While listening music with Headphones, some rushing noise appeared. I tried to narrow down the problem : Checking the ...
1 vote
2 answers
239 views

advapi32.dll changes name of function during forwarding of exports

I'm trying myself at writing a manual mapper, for injection of DLLs into other processes. I've come to the point, where I've written a simple "Hello World" .dll, that I'm trying to inject ...
1 vote
1 answer
72 views

Should shell32.dll be in executable search path for winword.exe with WinDBG?

I'm threat hunting and I'm curious if there should be a shell32.dll in the executable search path in windbg for winword.exe.
6 votes
3 answers
1k views

Reverse engineer Listen to this device on Windows - Reverse engineer Windows when there's no API

I'm writing an Autohotkey script to toggle Listen to this device for my microphone, without interacting with a GUI. I thought it would be a simple registry key being modified so I used RegShot to ...
0 votes
1 answer
90 views

Need help understanding why Netflix prevents me from downloading with VPN

When using Netflix via the Windows desktop app with a VPN, streaming movies works fine but downloading does not. The download gets automatically paused, and after a minute it shows error code DL1-...
0 votes
1 answer
66 views

How to convert variable to struct member in IDA?

I'm working on a windows program which is walking PEB Ldr list. the related types are as follows: struct LDR_DATA_TABLE_ENTRY { LIST_ENTRY InLoadOrderLinks; // offset = 0, size = 0x10 ...
0 votes
0 answers
34 views

Exe self-modifies strings searched in debugger

I'm studying a Windows binary file and while searching for some string I noticed the EXE modifies the searched string, e.g., if I search "This is a string", it's modified to "his is a ...
5 votes
1 answer
292 views

Why is function in kernel32.dll jumping into a api-ms-win-core stub

I was trying to look into the implementation of GetVersion function in kernel32.dll. I was surprised to see that the GetVersion thunk is issuing a jump to API-MS-WIN-CORE-SYSINFO-L1-1-0.DLL::...
1 vote
1 answer
534 views

How can I extract the password from an installer/self-extracting archive?

I have an installer/self-extracting archive. The executable file has an embedded ZIP archive into it (like many other installers). The ZIP archive is encrypted with a password. The installer DOES NOT ...
4 votes
2 answers
2k views

Is it possible to download program database (PDB) files of Microsoft Windows binaries without installing any software?

I want to download the .pdb files of Windows binaries (e.g., notpad.exe) on machines where the user doesn't have admin rights, nor has any debugger available. I was wondering if it is possible to ...
0 votes
2 answers
291 views

The executable file makes a unique ID from each individual PC. Can anyone decipher from where the file makes these unique IDs?

The file generates random unique ID. It says hardware ID but I couldn't find it in product key, BIOS serial number or anywhere. I used IDA but I couldn't get from where the file creates the code. Even ...
0 votes
0 answers
85 views

from executable to assembly source code?

let's say i have an ".exe program" and i want to disassemble it and get "disassembled code" . my question is => can i maintain and organize that "disassembled code" ...
0 votes
1 answer
56 views

unable to figure out how a windbg extension work

I'm trying to figure out how the below windbg extension works !ndiskd.nbl addr -hexcap(or -data) kd> !ndiskd.nbl ffffce8c96bde070 -hexcap # NET_BUFFER_LIST ffffce8c96bde070 # NET_BUFFER ...
0 votes
3 answers
102 views

how to stop windbg when register value changes

I'm using windbg to find the memory of a specific structure in windows. The way is to look at certain values stored in stack and registers in entry function. I notice that register ax holds that value ...
1 vote
0 answers
50 views

Process stuck on the entry point

I'm trying to patch an old game (1998-ish) that runs on windows 95 and windows XP to make it compatible with windows 11. The current problem with it is that when running the exe file nothing seems to ...
0 votes
1 answer
69 views

Tool to analyze .obj files (not COFF) created with /LTCG

This Microsoft article states that: When building with LTCG, the compiler front end doesn't invoke the back end. Instead, it emits an OBJ file with IL in it. It bears repeating: this IL is not the ...
2 votes
2 answers
209 views

How can I find the buffer of CryptGenRandom?

I am trying to analyze the CryptGenRandom algorithm on my Windows 10 laptop. According to Niels Ferguson's Whitepaper called 'The Windows 10 random number generation infrastructure', the ...
0 votes
0 answers
54 views

Pe file import binding

I'm learning a bit about PE files. The thing I've struggling a bit now it the First Thunk and Original First Thunk fields. To understand the difference between them I've read this post and that ...
0 votes
0 answers
73 views

windbg fail to load symbol with UNC store

I'm debugging a qemu windows machine in docker and the windbg shows the file is missing. Windbg is attached to qemu kd> .sympath Symbol search path is: srv* Expanded Symbol search path is: cache*;...
1 vote
0 answers
87 views

Where can I find the files from Ghidra symbol tree?

I have decompiled a .dll file with Ghidra. At the left, I see the symbol tree. In the symbol tree, there is a tab imports. This tab contains external .dll files. Where can I find the location of these ...
1 vote
0 answers
79 views

Inject a MessageBox to the PE file

I'd like to patch some Windows PE file to show just simple MessageBox. Taking into account that the PE in question doesn't import the MessageBoxA function if I'm right that all i need to do is to add ...
2 votes
1 answer
162 views

Marking DAT section as shellcode in ghidra

I have a binary that loads a DAT section as code (calls ((code **) DAT_something)(0, 2)), and I'd like to be able to disassemble the DAT_something data region. Currently, when looking at the ...
0 votes
0 answers
39 views

Firmware not attached to WinDBG while debugging Windows boot process

I'm attempting to reproduce the cve-2022-21894 poc for educational purposes, however I'm getting stuck at the "hvloader" phase. The debugger cannot attach to the boot process. Short ...
0 votes
0 answers
33 views

How can I make a quick tracer for a PE file?

INTRODUCTION: I made my tracer on the event debug loop, but after I compared its speed characteristics with the same PinTool or similar tools, I realized that my tracer is several dozen times slower ...
0 votes
0 answers
57 views

How to inject (a lot of) code into a running program?

I've seen a number of tutorials on changing several binary digits of an executable, like changing assembly je to jn. But what I want to add new functionalities. #include <iostream> #include <...
0 votes
0 answers
23 views

Windows Library description number

Windows Libraries that engage in Library Hijacking, typically have a number in their library description field. What is this field? How does Windows Process it and is there a mapping of int32-like ...
1 vote
0 answers
57 views

Windbg command .call usage and syntax

I'm using Windbg to track all functions that could result in the blue screen errors. My method is to call certain suspects manually through windbg .call command. However, I always got syntax error. ...
1 vote
2 answers
155 views

Identifying file-access functions used by explorer.exe

I'm trying to write a Windows 10 64-bit rootkit that runs on userland and hides files using IAT hooking. I managed to accomplish that on cmd.exe by hooking FindFirstFileW and FindNextFileW imported ...
0 votes
0 answers
48 views

Emulation program broke because game updated from 32 bit to 64 bit

I have no idea who the developers of the emulator are; so I have no way to reach out to them for a fix. I'm hoping to find someone here who would be willing to take a look at the emulator to see what ...
2 votes
1 answer
85 views

What triggers RIP_EVENT?

The documentation for the Windows Debugger API mentions a debug event called RIP_EVENT. It offers little explanation of what a RIP_EVENT is, only stating that the structure "contains the error ...
4 votes
2 answers
206 views

Malware analysis - Debugger hangs at HttpSendRequestA

I'm reverse engineering a malware that at some point tries to connect to http://api.ipify.org in order to get the IP address of the infected PC. I was able to replicate this behaviour with a small ...
1 vote
0 answers
69 views

How to develop an anti-debug library which allow users to debug their own programs but not the library?

I'm going to publish a library which guarded by anti-debug ,(ptrace_trackme for Linux and isDebuggerPresent for windows). The down side of this library is: users would be abled to debug their own ...
2 votes
0 answers
222 views

What is the meaning of call ds:ApiName[registry*constant] in IDA .asm files?

I have a dataset of .ASM files generated by IDA (dont have the corresponding file) ‌And there are a lot of calls like this : .text:00637114 5F pop edi .text:...
4 votes
1 answer
463 views

Reverse engineer DPC Latency Checker tool to fix high Windows kernel timer latency

I need help with something very Windows/kernel-specific. I'm working on a fix for the high Kernel Timer Latency in Windows 10 2004 and higher. This problem was introduced between Insider Build 18950 ...
2 votes
0 answers
54 views

i want to know how to tracing a exe's http responses and log them

I want to "crack" this cheat loader protected by thermedia and I had someone do it before but lost contact with them and, now I would like to learn to do it myself. and they said a basic way ...
2 votes
0 answers
62 views

Need help extracting AP_Pack .obb files

I'm trying to extract the files for the series of 4 games - Sorcery!, which are in the format .obb. Thanks to a Hex editor I saw that the .obb was an AP_Pack, and looking for more information on the ...
20 votes
9 answers
8k views

Determining if a file is managed code or not

How can I quickly tell if a EXE or DLL I have is managed code or not? I spent some time recently trying to disassemble a file and then later learned through some traces in the code that I could have ...
6 votes
1 answer
1k views

Windows 10 v.1803 boot failure after trying to install network kernel debugging with WinDbg Preview

I'm trying to set up kernel debugging on a physical hardware/desktop to test the new WinDbg Preview. Here's the steps: I'm using a desktop with Intel DG41TY board. Installed Windows 10 Pro build 1803....
5 votes
2 answers
9k views

Tracing function calls in x64dbg

I'm new with x64dbg and want to know if there is any way to get the trace of a functions inside a module? I've used trace over option, but basically it just traces all the insturctions but doesn't "...
4 votes
2 answers
458 views

Forcing a legacy Windows application to use an older version of ntdll.dll

There is this old Windows application I've been using for more than a decade now: DesktopEarth. It got its last update in 2015 and the author's website is offline now, but it's been running fine on ...
1 vote
1 answer
909 views

IDA Pro: Converting structure to decimal

I'm new with IDA pro and have little problem. Right click on some data in .rdata brings options in which I can convert, In that window D means decimal B means binary and so on, but I have multiple Ds ...
4 votes
1 answer
111 views

Replacing a function in a 1995 Windows 32-bit binary using Frida causes crash

I am working with a 1995 Windows 32-bit binary compiled with Watcom, which uses the Watcom calling convention. I am trying to replace a simple string length calculation function in the binary using ...
2 votes
0 answers
29 views

How is the language of a font glyph determined?

A glyph holds data such as its name and contour points. But how do you determine where the characters of one language end and another begins? Is there a written standard that says language X starts at ...

1
2 3 4 5
17