Questions tagged [windows]

Windows refers to the Microsoft Windows series of operating systems.

Filter by
Sorted by
Tagged with
2
votes
0answers
37 views

How to disassemble win32 function RegSetValueExW?

I have opened up advapi32.dll in IDA and found out that RegSetValueExW is just a jump to RegSetValueExW_0. And RegSetValueExW_0 seems to be an extern. How do I actually disassemble RegSetValueExW_0?
-1
votes
0answers
29 views

Windows PE File Where is the table located SEH?

I compile the file using MSVC. I am aware of the existence of the exception directory, but it is empty in my file. Although the code contains four SEH handlers. I wonder where, in this case, the ...
3
votes
1answer
47 views

Unable to attach into mysterious PID

I have a suspicious process. I found it by ProcessHacker's network tab. ProcessHacker display the process as Unknown. The process listening into a constant port number that's also not found by ...
2
votes
1answer
66 views

Extracting strings from binary files (.exe)

This question has been asked quite a lot especially on stackoverflow, but the solutions/replies are not clear or extensive. What I`m looking for is to build what Strings does from Sysinternals. My ...
2
votes
1answer
54 views

How to find sleep() in ollydbg or IDA or ghidra

I have a program which converts videos from a proprietary format into mp4. The conversion is very slow and CPU utilization is less than 1%. I'm able to speed up the conversion process via Cheat Engine'...
1
vote
1answer
44 views

Disassembly call function offset from RIP

I am writing a program where I map an .exe PE file in memory and I "dissect" it. I am disassembling the .text section of the target executable, using the distorm disassembler. CALL ...
5
votes
1answer
3k views

How to find WndProc using x64dbg?

I'm trying to find a WndProc from explorer.exe that is handling these messages, I've found with Spy++: <000001> 00000000000B01C8 P message:0xC02B [Registered:"SHELLHOOK"] wParam:00000025 lParam:...
1
vote
2answers
197 views

Call function by ebp

When I looking at exe file with Ida I see call dword ptr [ebp -70p] What is that? Why this function calling by ebp and not call sub_0xabcd How can I know which function is that to enter to this ...
0
votes
2answers
45 views

Import header files in IDA to get the struct definitions?

I am reversing a program that has a lot of internal structs in it. The problem is that there are a lot of structs, so i can't import them manually using local types->insert. Lets say i have some ...
0
votes
1answer
24 views

Find out version of statically linked MFC from an exe

I have an exe with symbols stripped that I am trying to reverse engineer. I know the library is linked with MFC but I don't know which version. (Therefore, I can't use something like FLIRT signatures ...
0
votes
0answers
53 views

Can I reverse engineer original file names?

I'm new to IT and I turned my external hard-drive into a windows boot disc. I managed to recover files with testdisc & photorec_win. The downside is I got more than I bargened for and I have twice ...
1
vote
1answer
57 views

Merging a large number of segments in IDA Pro

I'm working with a memory dump of a protected win32 program. Something causing me a lot of pain is the program being split into roughly 3,000 contiguous small segments (i.e. instead of just .text and ....
0
votes
0answers
34 views

new to malware analysis and disassembly. dotpeek has been helpful. is this unreadable code due to SuppressIldasmAttribute?

just getting into rev engineering malware. i want to get to source on my own. i could use run.any or VT but that's no fun. any reason why this is unreadable the way it is? is it due to the module ...
0
votes
0answers
43 views

WMI Spoofing by Fastprox.dll Hooking

I m trying to spoof WMI output by hooking the fastprox.dll. Here is the code I m working on: typedef HRESULT(__stdcall* tGetFunc)(IWbemClassObject*, LPCWSTR, LONG, VARIANT*, CIMTYPE*, long*); static ...
0
votes
1answer
49 views

PE Self Injection Not Working

I'm working on different PE Injection technique. I want inject PE file into virtual memory of current executable. After that, I want execute injected PE file, I wrote inject code but my method is not ...
0
votes
1answer
45 views

How much of the kernel does remote kernel debugging allow you to debug?

This is a theoretical question because I've never set up remote kernel debugging before -- but I will do at some point, which should hopefully answer some of the experimental questions I have. What ...
-1
votes
0answers
38 views

Recommendations for C++ Junk Code Generator / Obfuscator

Is there any recommendations for open-sourced C++ junk code generator? I would like to add junk code to my application. I've tried to download this tool but couldn't download :( Thanks a bunch for ...
0
votes
0answers
18 views

Set standard input/output to a process using NtCreateProcessEx

In the official Windows API function CreateProcessA is possible set or change the standar input and output of the process vía LPSTARTUPINFO structure. How can do this using the undocumented function ...
0
votes
1answer
71 views

Why a single “nop” crashed the game?

I hope answer to my question is not game/app specific and can be answered in communities like this. So, I tried to use some internal functions of a game, like pick a target. No malicious intentions, ...
0
votes
1answer
33 views

Switch between debuggers while paused on a breakpoint

Is it possible to switch between debuggers and preserve where you are paused? Often times I find myself wanting to use a feature from a different debugger while paused in a specific context as each of ...
0
votes
2answers
92 views

CaptureBAT equivalent on Windows 10?

Hello RE community on stack ! I am a beginner, so please pardon any commonplace errors I am looking to run CaptureBAT on a Windows 10 VM, to capture network activity of different kinds of Malwares I ...
1
vote
1answer
52 views

does mov DWORD PTR 32[rsp], 5 means mov DWORD PTR [rsp+32], 5?

I am learning about windows x64 calling convention, where the first four arguments are passed to registers and left arguments are passed through the stack. To see it, I checked the assembly of the ...
3
votes
1answer
146 views

Reconstructing Assembly Truth Map

So I recently read [1] which evaluates several disassemblers. The truth/test binaries are generated by the SPEC CPU 2006 Benchmark suite. The authors provide detailed build instructions for the ELF ...
0
votes
2answers
57 views

kd live local debugging !pte and db don't work (only shows context of the debugger for all contexts), but !vtop works

Says the PDPT and PDs of the process are at the same physcial frames (pfns) in both processes. The first process is winword.exe and the second process is calc.exe The virtual address in the first case ...
1
vote
1answer
209 views

Adding a static variable to Windows DLL

I'm trying to patch a function in a Windows x86 DLL, however it turned out that I need a static variable to store some state that wasn't correctly preserved by the original executable across calls. I ...
2
votes
3answers
228 views

Injecting C++ code, while also maximizing compatibility with other injections

Using the New Vegas Script Extender C++ API for Fallout New Vegas, I am able to write to the process' memory directly at runtime through a .dll plugin that's loaded by the NVSE injector. But it is not ...
0
votes
0answers
49 views

Reversing Windows binary to find where the error is with Ollydbg

I've some experience with gdb and debugging in Linux environment (I'm studying computer science at University and I'm able to handle bof in Linux). The problem now is on a Windows program. I start it ...
0
votes
0answers
24 views

How to apply complete type information from PDB for multiple images in one IDA database?

IDA is capable of loading multiple images/DLLs into the same database. In this scenario, ntdll.dll and kernel.dll have been loaded additionally to the main target .exe-file into the database. On top ...
0
votes
3answers
100 views

How to find the address (offset) of specific driver function

I am reversing Capcom driver and in IDA I have this list of functions: I want to set breakpoint on the function sub_10590 but I don't know what is the address of this function when I am doing live ...
0
votes
0answers
50 views

SSL pinning and bypass

I'm currently investigating one very suspicious app on my system (Windows 10 x64 bit). I wanted to try and understand outgoing https traffic it utilizes by trying to MITM it using Fiddler but as I ...
0
votes
1answer
129 views

'local call from' in x64dbg

In OllyDbg there was a thing called "local call from xxx,xxx,xxx,xxx ... " which helps me know from where a function is being called in the entire module. Does such a feature exist in x64dbg as well?
0
votes
0answers
23 views

Smart Battery Issues, a RE Quest?

TL;DR: Perhaps this doesn't sound like a RE post at first, but it's kind of moving in that direction. Essentially, I replaced the battery in my Surface laptop with 2x different new batteries, and they ...
1
vote
1answer
2k views

Reversing a program with dongle

So I'm learning Reverse Engineering / Software cracking. I have a program that I am practicing on that requires a dongle in order for the program to start. From looking through the disassembly ...
1
vote
1answer
63 views

.dll file pull source from compiled study?

Forgive me I’m new, and not a programmer but I am needing to see if this is possible. I have a study in my trading platform I had built a long time ago, lost the original, but have the compiled .dll ...
0
votes
0answers
23 views

Thread keeps generating page fault

So i was recently trying to exploit a kernel mode driver (HEVD) and I encountered a problem which doesn't make sense to me. After i jumped to my shellcode (which resides in usermode), the thread keeps ...
0
votes
0answers
31 views

Fuzzing Third Party Windows Drivers

I want to contribute to vendors while learning how to be a security researcher, and I was wondering: How can I fuzz third party windows drivers? (For instance, those that come with cpu/gpu and similar ...
0
votes
0answers
48 views

Patching a program in IDA

I've opened a simple Hello World program in IDA (Pro 7.5) like that: global _main extern _printf section .text _main: push message call _printf add esp, 4 push ...
1
vote
1answer
45 views

Where are the .NET IL bytes stored in an .NET executable?

When i compile a c# code, it compiles into a .NET executable, that only imports _CorExeMain from mscoree.dll, now my questions are : Is _CorExeMain the interpreter that fetches ILs and executes their ...
1
vote
1answer
129 views

Arrays assembly

I'm reversing my C array's programs where I'm storing numbers in arrays like this... int marks[5]; marks[0] = 1; marks[1] = 3; marks[2] = 2; marks[3] = 7; marks[4] = 9; so the compiler showing me the ...
0
votes
0answers
28 views

Renesas Chip reverse engineer mcu

I need to access MCU (the MCU is the Renesas R5H30211) – goal is to reset a register value to 24 as card counts down to 0 for each cycle – I want to reset the card. Can anyone help with this, I do ...
1
vote
1answer
362 views

Analyzing Windows kernel driver

I'm trying to analyze some Windows kernel driver. What I want to achieve is full execution trace, from driver entry to end point. Driver is heavily virtualized and contains multiple anti-debugging ...
0
votes
0answers
60 views

How to Find Password/ Bypass Password in a Switch Statement using IDA

I'm new to reverse engineering, wondering how access or bypass the password contained in the switch statement ? File Link
3
votes
1answer
175 views

Catch connection string between exe and mdb

I have an exe file that read and write from a local DB file. I checked this file with Detect It Easy and it shows that this is a mdb file. I can open this file with microsoft access, and watch all ...
0
votes
0answers
86 views

Confusion about if statement in disassembly

I recently got into reverse engineering applications for fun. Can someone please help me with this if statement. 140005914 75 38 JNZ LAB_14000594e 140005916 48 8b 4 MOV ...
1
vote
0answers
19 views

Program closes when running Charles proxy

I came across an program that closes itself when I run Charles proxy and if I'm running charles before the progran it won't run. Anyone know what type of security if this and can it be reversed? ...
0
votes
1answer
43 views

idb file and IDA

I've just received from a friend a *.idb file concerning the pe file i'd like to disassemble in IDA. What the file is and how can i load/use it with the exe linked with it in IDA?
0
votes
0answers
39 views

IDA adding a new code

Is it possible to add a new assembler code lines in IDA to a opened, disassembled pe file? For e.g. having such disassembled code in IDA: global _main extern _printf section .text _main:...
0
votes
2answers
45 views

Pe file code starting address

When i load an exe in the IDA the assembled code always starts at 00401000 address. Does it mean that in pe files the code always starts at that specific address?
0
votes
1answer
51 views

Disassembling Hello World program in IDA

I've de-compiled in IDA 7.0 (freeware version) such a simple c program (compiled in the Microsoft Visual Studio Community 2019): #include <stdio.h> #include <string.h > char* sayHello(...
1
vote
1answer
138 views

How to find encrypted strings in an executable?

I am trying to reverse engineer an executable. I am using Process explorer to dump all strings present in the exe image, and from the process's RAM when it is running. The two dumps return a ...

1
2 3 4 5
14