Questions tagged [windows]
Windows refers to the Microsoft Windows series of operating systems.
82
questions
21
votes
1
answer
4k
views
Windows Wiki : Books and Tutorials [closed]
This post is for collecting all the best books and tutorials that exist dealing with windows specific reverse engineering techniques and concepts. The content will be added to the Windows wiki. Any ...
13
votes
3
answers
2k
views
How to prevent use of Resource editors
There are variety of tools that allow editing the resources of Windows executables.
These tools allow a very easy interface for changing the programs look and feel.
Replacing icons, text, menus can be ...
- 4,755
24
votes
2
answers
32k
views
How can I set a breakpoint for a button click?
I am trying to find what a button does, so I want to set a breakpoint to catch button click event. Is that possible?
Any tools or tricks to assist in this?
- 343
17
votes
1
answer
5k
views
COM interface methods
I'm reversing malware and it uses COM, which I evidently don't know. My question is how to find out what method is called using ppv (and objectstublessclient?)
push offset ppv ; Address of ...
- 173
15
votes
4
answers
4k
views
Debugging malware that will only run as a service
I'm trying to debug a malware sample that installs to a system as service and then will only start if it starts as a service. Other functions are still available without the service start, like ...
- 153
9
votes
2
answers
6k
views
What are the difference syscall and int 0x2E instructions?
From this question: How does the Windows Native API communicate with the kernel?
Here is an example of ZwClose(HANDLE Handle); system call in NTDLL.DLL in Windows 10 X86_64:
NtClose proc near
...
- 1,549
4
votes
1
answer
2k
views
/proc/self/maps equivalent on windows
I see that inspecting /proc/self/maps on Linux machines lets me see the pages that have been mapped in. As a result I can write a program to read and parse the pages it has mapped in.
How could one ...
user1743
6
votes
1
answer
2k
views
Is not valid win32 application. Why?
Now I'm developing an unpacker and reached testing stage. Sometimes I got a message which says that unpacked file is invalid Win32 executable, however it is not informative.
I would like to ask if ...
- 819
5
votes
1
answer
2k
views
What are good Windows anti-debug references? [closed]
What are good anti-debug references for Windows which help with manual unpacking, emulating, or sandboxing?
- 6,674
23
votes
2
answers
14k
views
How to reverse engineer simple usb device [windows -> linux]
I'd like to reverse engineer my usb beer-can refrigurator, which does connect via USB on windows and via simple GUI tray-tool can set/query temperature.
I was thinking about running virtualboxed ...
- 231
17
votes
4
answers
4k
views
How can you reliably unpack a Windows driver manually?
When you unpack manually a Windows user-mode executable, you can easily break at its EntryPoint (or TLS), then trace until you reach the original EntryPoint. However that's not possible with a packed ...
- 6,674
15
votes
3
answers
22k
views
Difference between DllMain and DllEntryPoint
I have a piece a malware to analyze. It is a DLL according to the IMAGE_FILE_HEADER->Characteristics. I was trying to do some dynamic analysis on it. I have done the following:
Run it with ...
- 491
12
votes
5
answers
29k
views
Are there any OllyDbg anti-debug/anti-anti-debug plugins what work with Windows 7 / NT 6.x?
Title says it all. I'm trying to RE a video game which is packed with Themida and the second I attach OllyDbg it crashes. When on XP, I can use StrongOD and PhantOm but neither of these work properly ...
- 223
9
votes
1
answer
4k
views
IDA pro and default windows (lib) functions
Why can't IDA Pro successfully determine which exact functions are called after successful disassembly of inline functions?
For example, statically linked functions like printf(), memcpy(), memset() ...
- 581
6
votes
2
answers
3k
views
How to import Windows DDK headers into IDA?
Currently I'm reversing a Windows driver, and there are a lot of structs IDA doesn't automatically recognize, which means I have to import them manually by parsing C header files.
However, there are ...
- 1,283
5
votes
2
answers
2k
views
How are addresses calculated from the values in x86 segment registers?
How are the 16-bit values in segment registers used to represent large memory addresses?
ES 0023 32bit 0(FFFFFFFF)
CS 001B 32bit 0(FFFFFFFF)
SS 0023 32bit 0(FFFFFFFF)
DS 0023 32bit 0(FFFFFFFF)
FS ...
- 83
4
votes
2
answers
2k
views
What could be the purpose of XORing esp with a global variable? (stack canary protection)
I am currently looking at a function inside a Win32 executable's main module. After allocating memory on the stack (sub esp) and saving some registers on the stack, the value of esp is XORed with a ...
2
votes
3
answers
1k
views
Debug program using peculiar anti-debugging technique
In my BA thesis, I wanted to present a program for Windows, using various anti-debugging techniques.
One of them, which I came up on my own (possibly it is well known, but I didn't find it anywhere) ...
- 3,369
1
vote
1
answer
771
views
What is ObjectStublessClientXX in ole32dll?
When I do dynamic reversing I saw usage with ObjectStublessClientXX in ole32.dll .
What is that function? What does it do?
Is there any way that it supposed to transfer message between 2 processes? ...
- 523
70
votes
3
answers
14k
views
What is the purpose of 'mov edi, edi'?
I see this instruction in the beginning of several Windows programs.
It's copying a register to itself, so basically, this acts as a nop.
What's the purpose of this instruction?
- 4,755
56
votes
7
answers
153k
views
How to know in which language/technology program (.exe) is written?
How to understand if exe/dll is written in C++/.Net/Java or in any other language. I tried to use Dependency walker but not able to get required information.
- 927
30
votes
4
answers
13k
views
Can I statically link (not import) the Windows system DLLs?
I have compiled following C source code in VS2010 console project.
#include <stdio.h>
int main(int argc, char* argv[]){
printf("hello world\n");
return 0;
}
then I used /MT option for ...
- 593
24
votes
1
answer
13k
views
What's 'fs:[0]' doing and how can I execute it step by step?
In a 32 bits Windows binary, I see this code:
push next
push fs:[0]
mov fs:[0], esp
int3
...
next:
I see that something happens on the int3 (an error), but I don't understand why,...
- 6,674
20
votes
9
answers
7k
views
Determining if a file is managed code or not
How can I quickly tell if a EXE or DLL I have is managed code or not?
I spent some time recently trying to disassemble a file and then later learned through some traces in the code that I could have ...
- 373
18
votes
3
answers
12k
views
Are there any tools or scripts for identifying compression algorithms in executables?
I know there are tools for identifying common ciphers and hash algorithms in code, but are there any similar scripts / tools / plugins for common compression algorithms such as gzip, deflate, etc? ...
- 1,252
18
votes
5
answers
8k
views
Is there any simple open source Windows packer?
There are great questions here about different types of packers and that is very interesting to me. I would like to try my hand at reverse engineering one. Since I am very new to this, I would like ...
- 183
15
votes
4
answers
7k
views
INT 2D Anti-Forensic Method
Inclusion of an INT 2D instruction appears to be a fairly common anti-debugging tactic used by Windows malware authors. From what I understand, it causes a process to act differently when a debugger ...
- 253
13
votes
5
answers
18k
views
Freely available resource hacking applications
I am using Resource Hacker as a tool to extract out resources like icon, images, etc. from .dll or .exe file. In addition, I am using it to crack some small Windows application. However, it does not ...
11
votes
1
answer
2k
views
Kernel level Dynamic Binary Instrumentation
Is there anything like PIN or DynamoRIO to instrument at Kernel level? The platforms I'm more interested on are Windows and OSX.
- 4,425
11
votes
1
answer
6k
views
Dll injection and GetProcAddress with the winapi
So i just read a little bit about how one would go about for injecting a dll into a running program on Wikipedia (the CreateRemoteThread idea). I followed the steps described and eventually got it ...
- 369
10
votes
2
answers
2k
views
Is there an easy way to detect if the SSDT has been patched from a memory dump?
The SSDT is a dispatch table inside the Windows NT kernel, and it is used for handling calls to various internal kernel APIs. Often malware will change addresses in the SSDT in order to hook certain ...
- 1,252
10
votes
1
answer
3k
views
Anti-debugging techniques - Preventing me from setting a memory and hardware breakpoint. How can I bypass that?
I'm debugging this process which has a lot of anti debugging techniques in it, and I faced something new which I don't know how to bypass yet.
Changing the code dynamically causes exceptions to occur ...
- 668
9
votes
2
answers
4k
views
Where is ntdll.dll?
I am trying to get the base address of ntdll.dll over the PEB. So, what I did was to dump the PEB (d fs:[30]). Then, I tried to get to PEB_LDR_DATA over the offset 0xC. Over the offset 0x1C of ...
- 443
8
votes
1
answer
2k
views
How does the Windows Native API communicate with the kernel?
The windows Native API (Ntdll.dll) is a user-mode library. However, it is the final user-mode library that interfaces with the kernel. How does it actually interface with the kernel and bridge the gap ...
- 1,800
8
votes
1
answer
5k
views
How to investigate Windows 32/64bit (WOW64) transition
There is surprisingly little information about Windows WOW64 mechanism.
I'm trying to investigate it.
So when we have system call in 32-land, it calls an address that is stored in FS, which leads us ...
- 263
8
votes
1
answer
3k
views
What are general guide lines for reversing COM objects
I'm interested in revers engineer COM objects. How can I find interfaces that a particular object implements if I know what interface it is?
Please tell if I need to change or rephrase the question.
- 3,002
8
votes
2
answers
2k
views
How to Attach debugger or start analysis of process that is debugging itself?
I need and advice on how to start an analysis, connect with debugger to a process that is already debugging itself. Are there any tools/plugins/techniques that might help during the analysis?
UPDATE
...
- 3,002
8
votes
1
answer
5k
views
How tools like PEiD find out the compiler and its version.
How tools like PEiD and CFF explorer find out the compiler and its version.
I am analyzing a executable file. Which shows: Borland Delphi 3.0
But the section names .text .rsrc. Which is usually ...
- 81
8
votes
3
answers
1k
views
Working with DOS .COM files
What can I do to reverse engineer a DOS .COM file? As far as debugging goes, I've looked DEBUG and DEBUGX from the creators of FreeDOS, as well as the default DEBUG command that comes with Windows. ...
- 862
8
votes
1
answer
6k
views
How does services.exe trigger the start of a service?
I'm trying to work out the internals of how a Windows process starts and maintains communication with services.exe. This is on Windows 8 x64, but if you have tips for Windows 7 that is fine too.
So ...
- 1,225
7
votes
2
answers
5k
views
How to Fix a memory dump of a dll - so i dynamically reverse it using olly \ ida
I need to analyze a memory dump of a malware module, unfortunately the sample is not the original dll, but the dump of the dll from the memory.
Now fixing the sections headers is fairly easy - i just ...
- 668
7
votes
1
answer
5k
views
Where ES/GS/FS are pointing to?
As far as I know those segments are extra or general. But at which part of program memory they are actually pointing? If I undestand it correctly DS is poining at entry point of Dump, SS stands for ...
- 253
6
votes
1
answer
7k
views
Finding address from function name
By checking the human-readable strings in my target application, I found several interesting function names:
...
DataIntegrityError
GetObjectIdsOfDuplicateLinksErrors
GetInvalidClusterIdsExists
Main
...
- 275
6
votes
1
answer
3k
views
How to make type libraries from Windows 10 SDK and DDK?
I want to make type libraries from Windows 10 SDK and DDK version 16299 and/or 17134. I saw this tutorial TILIB - utility to create type libraries for IDA. Then I downloaded it from IDA Support: ...
- 1,549
6
votes
3
answers
6k
views
Does code injected into process memory always belong to a page with RWX access?
I've seen a few memory forensics tutorials, which start by looking for injected code in the "victim's" process memory. They always seem to find the injected code in pages which have RWX access (i.e. ...
- 828
6
votes
2
answers
1k
views
Reverse engineer Listen to this device on Windows - Reverse engineer Windows when there's no API
I'm writing an Autohotkey script to toggle Listen to this device for my microphone, without interacting with a GUI.
I thought it would be a simple registry key being modified so I used RegShot to ...
- 111
5
votes
2
answers
20k
views
Why my Resource Hacker doesn't work with some .EXE files
I use Resource Hacker Application for Reverse Engineering purposes, I've cracked 3 softwares by using this software, but it doesn't grab all .EXE, .DLL files.
sometimes It says, This is not a valid ...
- 293
5
votes
1
answer
6k
views
How to change address in the hex view in IDA debugger?
I'm just learning the IDA pro debugger, so I apologize if this is something simple. Say, if I opened a debugee process and started stepping through it with a debugger (WinDbg) and then want to look up ...
- 1,517
4
votes
2
answers
1k
views
What is this hidden stack used by syscalls on Windows?
I've noticed there is a memory region in user mode on Windows 7 x64 WOW64 that changes during syscalls. It is located quite low in the address space and has the characteristics of a stack, i.e. it ...
- 153
4
votes
2
answers
2k
views
Is it possible to download program database (PDB) files of Microsoft Windows binaries without installing any software?
I want to download the .pdb files of Windows binaries (e.g., notpad.exe) on machines where the user doesn't have admin rights, nor has any debugger available. I was wondering if it is possible to ...
- 189