Questions tagged [windows]
Windows refers to the Microsoft Windows series of operating systems.
784
questions
1
vote
0
answers
16
views
WinDbg Preview search is not returning results
I am attempting to manually unpack a malware sample. I am using the new WinDbg Preview (only thing that is available to download now). After letting the malware call VirtualAlloc I am trying to search ...
- 111
0
votes
0
answers
43
views
Why is Windows 10 still blocking me from running malware?
I am analyzing some malware on Windows 10. I installed FLARE VM, disabled tamper protection and disabled the virus scanner in the registry. However when I attempt to run a malware, Windows is still ...
- 111
0
votes
0
answers
21
views
IDA pro Error how to resolve this error
52C187F5: The instruction at 0x52C187F5 referenced memory at 0x4. The memory could not be read -> 00000004 (exc.code c0000005, tid 672)
How to Solve this.
I have seen sandbox reports in those the ...
3
votes
0
answers
33
views
Reverse engineer DPC Latency Checker tool to fix high Windows kernel timer latency
I need help with something very Windows/kernel-specific.
I'm working on a fix for the high Kernel Timer Latency in Windows 10 2004 and higher. This problem was introduced between Insider Build 18950 ...
- 31
2
votes
0
answers
28
views
How does Windows Updates determine if the patches are compatible?
I am looking into Microsoft Windows updates, and how they are applied, after extracting the .msu file, we get some .cab files with patches (in PA30 format), and informations on the file attributes, ...
- 151
7
votes
1
answer
4k
views
Where ES/GS/FS are pointing to?
As far as I know those segments are extra or general. But at which part of program memory they are actually pointing? If I undestand it correctly DS is poining at entry point of Dump, SS stands for ...
- 11.6k
2
votes
3
answers
1k
views
How to find the address (offset) of specific driver function
I am reversing Capcom driver and in IDA I have this list of functions:
I want to set breakpoint on the function sub_10590 but I don't know what is the address of this function when I am doing live ...
CommunityBot
- 1
3
votes
1
answer
201
views
Why can I inherit handles from WSASocketA and not from socket?
I'm trying to write some custom shellcode to obtain a shell from a program.
Looking at the program intermodular calls, I found a call to socket(), and my initial plan was to use that to create a new ...
- 136
1
vote
1
answer
160
views
Reverse Engineering Go obfuscated binaries
I have been trying to understand the working of this go malware by reversing it, which can be found here , so basically this stuff takes a shellcode as an input, and converts it to an exe or dll file, ...
CommunityBot
- 1
9
votes
2
answers
5k
views
What are the difference syscall and int 0x2E instructions?
From this question: How does the Windows Native API communicate with the kernel?
Here is an example of ZwClose(HANDLE Handle); system call in NTDLL.DLL in Windows 10 X86_64:
NtClose proc near
...
- 5
3
votes
1
answer
2k
views
How to unpack Armadillo protected software using x64dbg?
I am planning to reverse-engineer a Windows executable that has been protected with Armadillo.
When I put the executable through Detect It Easy, the results show that the executable was protected with ...
- 185
3
votes
1
answer
99
views
Why is function in kernel32.dll jumping into a api-ms-win-core stub
I was trying to look into the implementation of GetVersion function in kernel32.dll.
I was surprised to see that the GetVersion thunk is issuing a jump to API-MS-WIN-CORE-SYSINFO-L1-1-0.DLL::...
CommunityBot
- 1
3
votes
1
answer
71
views
Windows 11: Interact with IDA pro when running in session 0
I am trying to debug a windows service, so I set IDA as the debugger of that service.
But since services are running in session 0, I can't interact with IDA. Also in the latest windows version (e.g. ...
- 3,093
2
votes
1
answer
229
views
Windows UI freezes except the debugger itself when a breakpoint is hit in every debuggers I tried on a particular application
I'm trying to "trace" (just setting breakpoint, step in, step over to know how certain things work) an application. But if the application enters suspended state by using breakpoint, every ...
CommunityBot
- 1
1
vote
1
answer
47
views
Capture and Replay
I was wondering if it was possible to create a python script that is able to capture and replay the instructions executed by a windows program for in depth analysis.
- 10.6k
5
votes
1
answer
1k
views
Windows 10 v.1803 boot failure after trying to install network kernel debugging with WinDbg Preview
I'm trying to set up kernel debugging on a physical hardware/desktop to test the new WinDbg Preview. Here's the steps:
I'm using a desktop with Intel DG41TY board.
Installed Windows 10 Pro build 1803....
CommunityBot
- 1
2
votes
1
answer
58
views
The same notepad.exe runs in both WoW64 and x64 modes
When I run notepad.exe with x64dbg it runs as WOW64 process. But when I run it with x32dbg it runs as x64 process with x64 instructions. I am running it from the same directory C:\Windows\System32\...
- 185
2
votes
2
answers
165
views
Reverse function in .rdata field
I'm tracking a function called CreateIoCompletionPort in dns.exe. The import tab in IDA shows that it's imported from api-ms-win-core-io-l1-1-0.dll.
However, it appears in .rdata section in the .dll ...
- 10.6k
5
votes
1
answer
817
views
Why is ASLR not activated though IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE is set?
Even a minimal console Delphi program that has IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE set in its PE image does not use ASLR.
GetProcessMitigationPolicy() returns a PROCESS_MITIGATION_ASLR_POLICY of 0.
...
CommunityBot
- 1
2
votes
1
answer
49
views
How does this Is64BitOS pointer-arithmetic-based function work?
Reversed this function. It works. But stepping through I can't figure out how. Why does this work?
bool _Is64BitOS(void) {
unsigned int version = *(unsigned int*)0x7FFE026C;
unsigned int ...
- 10.6k
5
votes
2
answers
605
views
Fixing/recompiling a heavily control flow obfuscated function
I've recently come across a binary that has been obfuscated with a very obscure protection.
Obfuscation
From what I understand, the obfuscator is effective in several ways.
Multiple JMPs via relative ...
- 10.6k
2
votes
1
answer
69
views
Getting "Flow analysis was incomplete, some code may be missing" on WinDbg
I wanted to perform static analysis on the Win32 function CreateFileW, so I loaded kernel32.dll using WinDbg and perform the command uf kernel32!CreateFileW.
But I am seeing the following output ...
CommunityBot
- 1
6
votes
1
answer
234
views
Reconstructing Assembly Truth Map
So I recently read [1] which evaluates several disassemblers. The truth/test binaries are generated by the SPEC CPU 2006 Benchmark suite. The authors provide detailed build instructions for the ELF ...
CommunityBot
- 1
1
vote
1
answer
2k
views
How to find main() of Windows EXE with Ghidra?
I'm new to Ghidra, my goal is to add localizations for a small EXE program. The program was written in Visual Studio and has Russian dialogs, which I like to convert to English.
I've loaded the EXE ...
CommunityBot
- 1
1
vote
1
answer
101
views
How to access files stored in mouse?
I own a Razer Mamba Elite mouse. After plugging it in to the usb port, an software installation window shows up. Basically it's the Razer software to manage device's options such as profiles, macros, ...
- 61
1
vote
1
answer
126
views
Forcing a legacy Windows application to use an older version of ntdll.dll
There is this old Windows application I've been using for more than a decade now: DesktopEarth. It got its last update in 2015 and the author's website is offline now, but it's been running fine on ...
- 449
1
vote
0
answers
47
views
How to decrypt data during runtime before executing and then encrypting it back
I was doing some research and came across the term protectors. From my understanding is they encrypt a file to be protected but run it without an issue. During its execution it is able to decrypt the ...
- 11
1
vote
0
answers
42
views
What is the following code will do after modifying it? [closed]
The following commands will change the files information gatherosstate.exe file. From looking at the hex values I can interpret that there are nop (0x00). The file changed in windows terminal.
But ...
2
votes
1
answer
78
views
How to call Windows console in ASM and printf some values there?
Is there a working way to embed the windows console in disasm code? I tried AllocConsole with GetStdHandle or AttachConsole with PID of an existing console but it didn't work. I have tried printf ...
- 21
1
vote
1
answer
123
views
What are latest research in reverse engineering?
I am searching research papers related to reverse engineering between 2020 and 2022 but did not found good papers with latest research in the direction of reverse engineering.
So, what are the latest ...
- 10.6k
4
votes
2
answers
4k
views
Real PE32(+) entry point - is it documented anywhere?
Microsoft documentation gives WinMain() as the entry point for a Windows program, but unlike DllMain() it seems to be a pure fiction arranged by the compiler-provided startup code.
I've looked at the ...
- 107
3
votes
1
answer
240
views
Win32 x86 prologue disassembly
I have the following disassembly of a function prologue with comments. I'm unclear on what the author means in this line of disassembly "lea edi,[ebp-0xcc] ; getting the lowest address of stack ...
- 103
2
votes
1
answer
35
views
generate code execution/cpu time flame-graph of library DLL (Noob question)
I have a library DLL which I'm trying to analyze, and I have a basic understanding of its function and behavior (and can modify some input to affect how long certain operations will take to execute/...
- 15.7k
1
vote
0
answers
40
views
How to obtain import name from disassembled assembly
I'm trying to create my own tools for reverse engineering PE. I have some assembly codes that I fetched from a clone of objdump for a program. Sometimes I see call instructions such as :
callq *...
- 11
2
votes
1
answer
218
views
Instructions to compare two strings
I made a list of which instructions compare two strings in disassembly so that when I get to intermodular calls in x64dbg, I can simply type this instructions to see if there is a comparison have been ...
2
votes
1
answer
341
views
Function pointer and symbols in Ghidra
I am using Ghidra and I see that when it uses function pointers it never shows the paraments that are being sent to the function(In IDA pro, it always show the parameters). How can I fix that it will ...
CommunityBot
- 1
2
votes
1
answer
56
views
How to investigate in a program of type /SUBSYSTEM:NATIVE that crashes with the RtlFreeAnsiString API?
I compiled a very simple example of an application of type /SUBSYSTEM:NATIVE writing "hello world".
It is launched thanks to the "BootExecute" key. The program works without errors....
- 10.6k
3
votes
2
answers
399
views
Injecting C++ code, while also maximizing compatibility with other injections
Using the New Vegas Script Extender C++ API for Fallout New Vegas, I am able to write to the process' memory directly at runtime through a .dll plugin that's loaded by the NVSE injector. But it is not ...
CommunityBot
- 1
0
votes
0
answers
82
views
x32dbg : exe with different code address when running
I have a 32 bits exe that works only when there is a specific usb flash disk inserted. On my new laptop, I only have a single USB port, so I want to make it works without the original key, or from a &...
- 131
13
votes
5
answers
18k
views
Freely available resource hacking applications
I am using Resource Hacker as a tool to extract out resources like icon, images, etc. from .dll or .exe file. In addition, I am using it to crack some small Windows application. However, it does not ...
- 10.6k
2
votes
0
answers
153
views
How find all kernel functions called by a driver in windows 11
I am working on a highly obfuscated driver that is virtualized. In an attempt to work on this driver I asked a question about some python scripts which turned out not to be effective at all so I ...
- 23
3
votes
1
answer
104
views
Exact copy of USB flash drive
I have a USB flash drive, with 2 partitions : one is read only and contains a Windows software, and the second is read/write for user data.
In order to not damage this precious key, I want to do a ...
- 206
4
votes
1
answer
2k
views
How can I modify binary image resource data?
I've been hacking and modding software for years, and have learned a lot, but there are still a few things that vex me - this is one such case.
I have noticed that some PEs contain an RCData section ...
- 111
3
votes
1
answer
983
views
How do I unpack a file protected by MPRESS?
I have a file that is protected by MPRESS packer and I want to know how to unpack it on Windows. Is there a specific program for that or something else? I am new to this so every help is appreciated.
- 399
1
vote
1
answer
252
views
How to disassemble an entire function in Windbg?
I am trying to disassemble the function ExAcquireFastMutex using WinDbg but it gives me only 8 rows:
3: kd> u nt!ExAcquireFastMutex
nt!ExAcquireFastMutex:
fffff805`456e3820 4053 push ...
- 15.7k
0
votes
1
answer
70
views
Find out which struct RaGetUnitStorageDeviceProperty use by reverse engineering
I am trying to find out which struct storport!RaGetUnitStorageDeviceProperty uses by myself. I know I can use google and find out the correct answer is _RAID_UNIT_EXTENSION. However i want to do it ...
- 15.7k
0
votes
0
answers
34
views
Is there any way to get old Windows kernel drivers?
I'm working through "Practical Reverse Engineering" and absolutely loving it so far. However, some of the exercises involve "decompiling" some Windows kernel files (like ...
2
votes
1
answer
153
views
STATUS_PRIVILEGED_INSTRUCTION 0xc0000096 from kernel mode code?
Running a kernel driver I wrote. The driver includes:
mov rax, cr0
btr rax, 10h
mov cr0, rax
to clear WP bit in cr0. Curiously the last instruction faults and causes a bluescreen, ...
- 10.6k
1
vote
1
answer
74
views
Finding Correct Segment From An Address For Windows 3.1 EXE in IDA Pro
We have an EXE that IDA pro lists the following segments:
Name Start End R W X D L Align Base Type Class AD es ss ds fs gs
cseg01 00000000 0000EA50 ? ? ? . ...
- 921
2
votes
0
answers
81
views
Are system dlls like NTDLL and KERNELBASE etc. are always loaded at the same address on a per-session basis?
If I am understanding, code and read only sections of common DLLs are given system-wide section objects for which each process gets its own section view, in order to save physical memory. As such even ...
Hot Network Questions
- Rewrite with definitional equality and dependent types
- Annuity money is not insured?
- Would an XNA based organism be immune to all pathogens?
- What is the profession called of someone who color grades films?
- How to quickly generate rectangles in place of text
- Sorting a List Based on a Given Order
- The Maharsha accusing Rav Pappa!
- Heating of B-70 vs. SR-71
- Reducing exact SVP to exact SIVP
- Are tower controllers trained on not overloading pilots with complex taxi instructions while landing?
- Converting epoch time format saved in a text file to human friendly format
- Word for a choice that is not really a choice
- Where do I hook up a speaker in this schematic?
- Galactic Empress with nude female guards book
- Depleted uranium shells in the Russian nuclear doctrine
- Discrepancy in Numbers 33:31 and Deuteronomy 10:6
- What was the most inconsequential failure on an STS mission recorded in mission reports?
- Coworker Posted Private Chat Message in a Public Group
- Correcting p-value in multiple regression
- What do these tire markings mean?
- Can I cover the electrical box and wires with a frame?
- What is the cause of this error adding align* environment in a forest tree node?
- Issue translating sentence from familia romana
- Can Latin do Noun-Noun Adjuncts?