Questions tagged [windows]
Windows refers to the Microsoft Windows series of operating systems.
675
questions
0
votes
0answers
17 views
Smart Battery Issues, a RE Quest?
TL;DR: Perhaps this doesn't sound like a RE post at first, but it's kind of moving in that direction. Essentially, I replaced the battery in my Surface laptop with 2x different new batteries, and they ...
0
votes
0answers
20 views
Thread keeps generating page fault
So i was recently trying to exploit a kernel mode driver (HEVD) and I encountered a problem which doesn't make sense to me.
After i jumped to my shellcode (which resides in usermode), the thread keeps ...
0
votes
0answers
26 views
Fuzzing Third Party Windows Drivers
I want to contribute to vendors while learning how to be a security researcher, and I was wondering: How can I fuzz third party windows drivers? (For instance, those that come with cpu/gpu and similar ...
0
votes
2answers
51 views
CaptureBAT equivalent on Windows 10?
Hello RE community on stack !
I am a beginner, so please pardon any commonplace errors
I am looking to run CaptureBAT on a Windows 10 VM, to capture network activity of different kinds of Malwares
I ...
0
votes
0answers
21 views
How does the Windows HID attribute IOCTLs work in Windows? [closed]
I am reverse engineering a driver that implements HID for the purposes of searching for vulnerabilities.
The main IOCTLs it implements are all from the HID minidriver libraries in the WDK.
I am in ...
0
votes
0answers
41 views
Patching a program in IDA
I've opened a simple Hello World program in IDA (Pro 7.5) like that:
global _main
extern _printf
section .text
_main:
push message
call _printf
add esp, 4
push ...
1
vote
1answer
122 views
Arrays assembly
I'm reversing my C array's programs where I'm storing numbers in arrays like this...
int marks[5];
marks[0] = 1;
marks[1] = 3;
marks[2] = 2;
marks[3] = 7;
marks[4] = 9;
so the compiler showing me the ...
1
vote
1answer
33 views
Where are the .NET IL bytes stored in an .NET executable?
When i compile a c# code, it compiles into a .NET executable, that only imports _CorExeMain from mscoree.dll, now my questions are :
Is _CorExeMain the interpreter that fetches ILs and executes their ...
0
votes
0answers
24 views
Renesas Chip reverse engineer mcu
I need to access MCU (the MCU is the Renesas R5H30211) – goal is to reset a register value to 24 as card counts down to 0 for each cycle – I want to reset the card.
Can anyone help with this, I do ...
0
votes
0answers
49 views
How to Find Password/ Bypass Password in a Switch Statement using IDA
I'm new to reverse engineering, wondering how access or bypass the password contained in the switch statement ?
File Link
1
vote
0answers
19 views
Program closes when running Charles proxy
I came across an program that closes itself when I run Charles proxy and if I'm running charles before the progran it won't run. Anyone know what type of security if this and can it be reversed?
...
0
votes
0answers
84 views
Confusion about if statement in disassembly
I recently got into reverse engineering applications for fun. Can someone please help me with this if statement.
140005914 75 38 JNZ LAB_14000594e
140005916 48 8b 4 MOV ...
0
votes
1answer
34 views
idb file and IDA
I've just received from a friend a *.idb file concerning the pe file i'd like to disassemble in IDA. What the file is and how can i load/use it with the exe linked with it in IDA?
0
votes
0answers
38 views
IDA adding a new code
Is it possible to add a new assembler code lines in IDA to a opened, disassembled pe file?
For e.g. having such disassembled code in IDA:
global _main
extern _printf
section .text
_main:...
0
votes
2answers
40 views
Pe file code starting address
When i load an exe in the IDA the assembled code always starts at 00401000 address. Does it mean that in pe files the code always starts at that specific address?
0
votes
1answer
49 views
Disassembling Hello World program in IDA
I've de-compiled in IDA 7.0 (freeware version) such a simple c program (compiled in the Microsoft Visual Studio Community 2019):
#include <stdio.h>
#include <string.h >
char* sayHello(...
1
vote
1answer
92 views
How to find encrypted strings in an executable?
I am trying to reverse engineer an executable.
I am using Process explorer to dump all strings present in the exe image, and from the process's RAM when it is running.
The two dumps return a ...
1
vote
1answer
41 views
far jump do not point to instruction?
My title is kind of ambiguous and not sure if it is true, Hence the question mark at the end.
Basically, I was trying to trace windows printf in NASM to identify "what is the last call/function ...
1
vote
1answer
63 views
.dll file pull source from compiled study?
Forgive me I’m new, and not a programmer but I am needing to see if this is possible.
I have a study in my trading platform I had built a long time ago, lost the original, but have the compiled .dll ...
1
vote
1answer
30 views
What is the role of PAGE section in windows Drivers?
I have seen many drivers with a section named PAGE, but couldn't find good enough information on it, what is the role of this section?
1
vote
1answer
55 views
Using windows 10 for malware analysis
I want to ask can I use windows 10 for malware analysis, I'm asking this because I see many reversers and analysts using windows 7 for this purpose. Can anyone please guide me?
2
votes
3answers
70 views
Where Can I Get .PDB files for Windows OS Components?
I want to take a look at some components of the Windows OS in IDA, such as ntoskrnl.exe and some of the Windows API .DLLs. I understand there is a Microsoft symbol server, but I am not sure how to ...
4
votes
1answer
70 views
Statically recovering thunks in Windows x86_64 DLL
I just started working my way to reversing Windows binaries and I stumbled upon the Import Address Table. When reversing a particular DLL I encountered many thunk-functions which all supposedly ...
0
votes
1answer
45 views
Is it possible for a process to debug itself?
What happens if you try to debug yourself ? I mean, does the process crash ?
If it is possible, how would you implement it ?
I have tried launching x64dbg and I can't attach to my own x64dbg process.
...
0
votes
0answers
23 views
Ollydbg skippingover breakpoint
I am new to the ollydbg world- I am in the middle of injecting shellcode (created with msfvenom...) into a small PE, and during debugging, I can't get it to halt at the breakpoints I set.
If I run the ...
1
vote
0answers
42 views
Acquire command line of remote process in Windows OS
I'd like to use C/C++/CS API to get the command line that invoked another process according to PID.
I've seen that this is done in processHacker that is an openSource project, but I couldn't find the ...
2
votes
2answers
139 views
Where to get started with reverse engineering a usb video device on Windows?
I have a piece of proprietary hardware that I'm trying to reverse engineer and write a cross-platform open-source driver for. This device has an IR camera on it, and it seems to be using the UVC ...
1
vote
2answers
77 views
Figuring out encryption technique of network connection
I am trying to reverse a virtualized program (using VMProtect 3.4.x). I decided to hook certain functions of the program such as the winsocks library send() and recv().
This is how it looks like:
[...
1
vote
1answer
146 views
Is it possible to download program database (PDB) files of Microsoft Windows binaries without installing any software?
I want to download the .pdb files of Windows binaries (e.g., notpad.exe) on machines where the user doesn't have admin rights, nor has any debugger available. I was wondering if it is possible to ...
2
votes
0answers
101 views
Accessing Windows 10 Feedback Hub Data
I'm trying to make a website that displays the feedback from the Windows 10 Feedback Hub but i have met a roadblock. I'm using Fiddler 4 (Fiddler Everywhere doesn't have support for UWP yet and ...
1
vote
0answers
46 views
Windows: Is it possible to mix FastIoDispatch with the registration of IOCTLs?
I am reverse engineering a Windows device driver. My main previous experience was with drivers I had written before, or toy drivers from tutorials.
I started reversing the driver by searching for ...
1
vote
1answer
56 views
How to keep symbols when taking memory snapshot with IDA?
When i take memory snapshot with IDA to try to analyze it statically later, the problem is there are a lot of symbols that get lost when i dump the memory, how can i solve this?
for example this is ...
1
vote
0answers
27 views
Instruction-level hooking library for win32?
I am looking for instruction-level hooking library for win32 x86/x64.
I want to write hook insertion and hook implementation code in C/C++ (compiled into dll).
(Therefore instrumentation tools are ...
2
votes
1answer
48 views
Are offsets within a loaded dll always the same relative to each other?
If I load a dll in 2 different processes, will the offsets calculations within one process hold for the other process?
I'm currently trying to patch the import table of a dll, once injected into a ...
1
vote
2answers
61 views
How to attach IDA Window back to be part of the IDA main window
I accidently maximized the functions Window and now it is de attached from the main window:
How can I attach it back to be part of the main window? I tried to drag it but it doesn't work. Also re ...
0
votes
1answer
57 views
How to resolve major function numbers to their name while reversing windows drivers?
I'm reversing some windows drivers, and IDA never converts numbers to their corresponding major function name like IRP_MJ_CREATE = 0x00, how can i force this? is there anyway i can convert a number to ...
0
votes
0answers
44 views
How to discover how a program gets keyboard input?
I'm reversing a windows x86 binary that I can't figure out how the program is getting the keyboard input.
I've searched for the windows api functions I was used to but the program doesn't call them.
...
2
votes
2answers
149 views
How to show KUSER_SHARED_DATA members in decompiled C code?
Here is a sample C code which prints Windows version directly from address
of KUSER_SHARED_DATA. Tested in Windows 10 only. The raw memory address
differ in Windows version but that's not the point.
#...
1
vote
1answer
89 views
Does the operating system you use matter?
people recommend windows for reverse engineering, I don't want to install windows as a virtual machine because they are laggy and I already have windows 10 as host, is it possible to use linux vm that ...
0
votes
0answers
36 views
Forcing embedded libcurl to disable SSL verification
I am trying to decrypt HTTPs communications in a binary that I know has been statically linked with cURL. How can I force curl to not verify SSL certificates for fiddler to intercept? I am using the ...
0
votes
3answers
77 views
How to find the address (offset) of specific driver function
I am reversing Capcom driver and in IDA I have this list of functions:
I want to set breakpoint on the function sub_10590 but I don't know what is the address of this function when I am doing live ...
1
vote
1answer
64 views
How to find out what stack frame EBP belongs to
i'm newbie to all the subject of RE so this question may sound easy.
on OllyDbg i see a lot of references to EBP & i can not understand to which stack frame does EBP belongs to, since there are ...
0
votes
2answers
180 views
how to use class member function defined in a exe within a dll
I have an executable (.exe) containing some classes and functions definition and plan on using those functions from within a DLL, although I know to call a regular C style function using calling ...
0
votes
0answers
74 views
IDA IDC script does not seem to work
I am trying to measure code coverage for a malware sample linked here. I am using DynamoRIO's(7.1.0-1) drcov utility to get an ASCII log. The log file is linked here. I am then using Dynapstalker to ...
2
votes
1answer
174 views
How to start out in reversing?
I'm new in reversing and I'd like a lot to learn about it. I have little to no knowledge about it. Is still worth to learn x86 Assembly? Since almost everything these days work on x64 architecture. ...
0
votes
0answers
43 views
String as constant , even not visible in disassembler
I was reading this article Where I saw that while reversing the WinRAR I saw that the x64dbg is not able to search for a string in all modules "evaluation copy". but why is that happening. ...
0
votes
0answers
33 views
Module name in the export table of a PE image
One of the fields of the PE export table is the image name, see screenshot below for an example.
This name is part of the file, even though I can rename it to any other name after it's compiled.
My ...
0
votes
0answers
22 views
What is the meaning of call ds:ApiName[registry*constant] in IDA .asm files?
I have a dataset of .ASM files generated by IDA (dont have the corresponding file)
now there are a lot of calls like this :
.text:00637114 5F pop edi
.text:...
0
votes
1answer
56 views
Static Binary in Windows
I am learning more about binary exploitation on windows. But I saw while revering a binary that you can create static binaries in windows too just like in Linux. It was really ugly. if I would be on ...
2
votes
1answer
51 views
Structure of operand bytes in .NET call and data access IL instructions?
I tried googling but couldn't find any good source that explains the structure of memory access instructions like ldstr and call instructions
for example based on experience, the last byte of API/...
