Skip to main content

Questions tagged [windows]

Windows refers to the Microsoft Windows series of operating systems.

Filter by
Sorted by
Tagged with
1 vote
0 answers
40 views

How to make a program start in Tray with reverse engineering?

The icon is already displayed in Tray. So maybe to block appearing the window only for launch. Or some nicer approach like switching launch parameters in exe (not available in the program settings). ...
oleedd's user avatar
  • 173
1 vote
1 answer
29 views

Is there a way to check how much of GB was written to hiberfil.sys (windows hibernation file)?

I switched from intel macbook to M3 for development work. The Intel one is used now by my wife for generic stuff, powered by Windows. The thing is that it has plenty of RAM, 64GB, way more than she ...
nachrichten's user avatar
1 vote
0 answers
29 views

Malware analysis windows file

During malware analysis , I was examining the sample in the cloud-service , but the clipboard copy was working from cloud machine to my local system. I believe there will be problem will happen when ...
Muthuji's user avatar
  • 11
1 vote
0 answers
16 views

Detect what app uses a comport - potentially for a vmware escape via a comport/named pipe ntoskrnl

How could I diagnose if this named pipe that goes to com1 in vmware (now to a txt file) is malware or a legitimate piece of software? Are there anyways to track what sends data to a comport in windows ...
rollsch's user avatar
  • 263
0 votes
1 answer
99 views

Removing a limit in Notepad

Windows Notepad has a limit: 1024 symbols - max string length. Download link: https://krakenfiles.com/view/uID2gzKW7K/file.html (189 KB) How to find this value to increase or remove? Where is it ...
oleedd's user avatar
  • 173
0 votes
0 answers
19 views

Dumping all import symbols from x64dbg

I want to export the symbol addresses from all loaded modules in x64dbg. I know I can do this DLL-by-DLL from the Symbols tab (click on one module > right click in table > Copy > Export Table)...
thejoelpatrol's user avatar
2 votes
1 answer
74 views

WinDbg command to retrieve TTBR registers for Aarch64?

Aarch64 architecture has the following registers, that contain physical base addresses for the virtual-to-physical translation tables for different exception levels: TTBR0_EL1, TTBR1_EL1, TTBR0_EL2, ...
c00000fd's user avatar
  • 1,711
0 votes
2 answers
74 views

Does a Windows MSI/installer function similarly to a portable file in PE format?

I'm trying to determine whether a Windows MSI or installer .exe is considered the same as a portable file .exe in the Portable Executable (PE) format, or if it's considered a dropper. What are the ...
0xh3xa's user avatar
  • 113
3 votes
1 answer
69 views

Any special meaning for this weird ObjectName value in Kernelbase.dll in Windows 10/11 passed to NtOpenKey

This function in kernelbase.dll : _ReadSettingsCache@8 proc near DestinationString= _UNICODE_STRING ptr -0F0h ObjectAttributes= _OBJECT_ATTRIBUTES ptr -0E8h KeyHandle= dword ptr -0D0h Handle= dword ...
chentiangemalc's user avatar
0 votes
1 answer
136 views

S30+ Game Development

How can I get started developing games for the S30+ operating system on Windows or Linux? I have a new nokia 150, which seems to run the correct operating system, although I'm not sure if this phone ...
Kynemix's user avatar
1 vote
0 answers
56 views

How to hook or call "non-native/non-exported functions"?

I wrote this simple application in C++ to learn about reverse engineering: #include <iostream> #include <windows.h> void PrintMessage(const char *message) { std::cout << message ...
Unknown X's user avatar
0 votes
0 answers
28 views

How to trigger calls and attach to functions on a running process?

I'm a software developer, with some knowledge in memory management but near zero experience in reverse engineering. I wonder if there is a way to detect which function a program calls at certain ...
Unknown X's user avatar
0 votes
0 answers
28 views

How to draw invisible entities (glow) with DX11?

I'm trying to understand how GLOW hacks work. In some games like CSGO you can just overwrite the memory address to 1 and glow chams are enabled. So you can see people through the walls like in this ...
kuhi's user avatar
  • 161
0 votes
0 answers
33 views

How does Windows determine dll address when using loadlibrary

First, sorry for my bad english. I'm trying to make emulator to emulating PE binary with unicorn emulator. My goal is place every dll in emulator that PE needed and hook some specific APIs. What I am ...
schnabel's user avatar
0 votes
0 answers
60 views

GetProcAddress on NTDLL functions not working via ROP

This is somewhat convoluted, but I will try to focus on the heart of the issue. We are trying to do GetProcAddress on a few NTDLL functions, and it is not working. We are doing this via ROP and in a ...
vg1925's user avatar
  • 1
0 votes
0 answers
83 views

How to get decryption keys from an offline player?

I am just starting to learn reverse engineering from lena lectures. I have 2 encrypted sample vids and an offline player which is able to decrypt the videos and play them, is there any way,I can get ...
No One In particular's user avatar
1 vote
1 answer
111 views

Why are these strings padded every other byte?

I've seen this multiple times, through various apps and snooping of hex values. Character strings but every other value is actually a null byte. This particular example is with API Monitor, but I'm ...
Katastic Voyage's user avatar
0 votes
0 answers
39 views

How to embed PE files to another PE files

So what I want to do basically is what BDFproxy does on the go, I want to modify a file (on the disk) to embed another PE in it and have both working, it does not matter if they work concurrently or ...
LuckyCoder3607's user avatar
0 votes
0 answers
58 views

Windows kernel Dev

I'm writing a basic program that'd allow me to list the running processes on a windows system but by simply trying to go through the ActiveProcessLinks of the _EPROCESS structure.The problem I'm ...
Essole's user avatar
  • 1
0 votes
0 answers
41 views

Microsoft Teams web client: how does Teams knows if a device is allowed or not

In my company I am able to use Ms Teams only inside windows but when I try from a Virtual machine (Hyper-V) running linux it says that this device is not allowed. So how can the Teams Server knows ...
Vince Ricosti's user avatar
1 vote
0 answers
75 views

trying to understand how Redboot ransomware works

this sample is able to drop exes though I'm not sure how the report indicates it calls CreateFileW though changing the call's outcome doesn't work is Redboot using heaven's gate (or another technique) ...
ALsec's user avatar
  • 11
1 vote
0 answers
88 views

Is it possible to run Ida pro in a docker container?

I've got a script that runs IDA pro on a file, the problem is that I need to run that script in a windows docker container. I've got the script working fine, but I can't get the program to run in the ...
Anthony's user avatar
  • 11
1 vote
1 answer
181 views

reverse engineer a 32bit windows executable for a password that unlocks secret message

I need to find a password to access the secret: ❯ strings -n 10 win32.exe !Tip: Ida Free can decompile to c++! .rdata$voltmd .rdata$zzzdbg Bad password length! Wrong password! Congratulations! The ...
schnitzel's user avatar
0 votes
0 answers
40 views

How can I find the part of cmd.exe that processes windows batch commands before they're executed?

I'm able to find the ReadConsoleInputW commands for pause and reading input for commands but I'm unable to find the actual processing of the commands. I'm using x64dbg but I'm fairly new to Reverse ...
user19244091's user avatar
0 votes
0 answers
53 views

Executable Opcodes of Windows Image File Seem Offset from My Calculations

Background: I'm trying to manually disassemble a practice executable file for practice. https://github.com/stryker2k2/dbg-demo/blob/master/assem/assem_0x00.asm Issue: When I take a look at what I ...
Liam Hanrahan's user avatar
0 votes
0 answers
38 views

How do I modify Windows 98's "SETUP.EXE" file?

I'm currently trying to make a mod of Windows 98. I successfully modified the autorun.exe file, but now, I'm trying to edit setup.exe, and I've run into some problems. I first tried it in Resource ...
TOWF's user avatar
  • 1
2 votes
1 answer
101 views

Unix system with windows-style registry

When trying to determine the filesystem of a firmware image using binwalk, I encountered a strange combination. The binwalk is returning a lot of Unix paths, but some of them contain a typical windows-...
Suske Lambik's user avatar
1 vote
0 answers
53 views

Windows boot sequence operation

I am targeting at creating software for the Windows pre-boot environment but I have hard time finding conclusive information about how it operates. For background: this software will communicate with ...
Claude's user avatar
  • 11
0 votes
0 answers
32 views

Audio problem rushing?

After using a new Pc for some time, suddendly a problem with the Audio occured. While listening music with Headphones, some rushing noise appeared. I tried to narrow down the problem : Checking the ...
Jack's user avatar
  • 1
0 votes
1 answer
146 views

How to convert variable to struct member in IDA?

I'm working on a windows program which is walking PEB Ldr list. the related types are as follows: struct LDR_DATA_TABLE_ENTRY { LIST_ENTRY InLoadOrderLinks; // offset = 0, size = 0x10 ...
H3d9's user avatar
  • 3
0 votes
0 answers
40 views

Exe self-modifies strings searched in debugger

I'm studying a Windows binary file and while searching for some string I noticed the EXE modifies the searched string, e.g., if I search "This is a string", it's modified to "his is a ...
lopan's user avatar
  • 1
0 votes
0 answers
192 views

Need help understanding why Netflix prevents me from downloading with VPN

When using Netflix via the Windows desktop app with a VPN, streaming movies works fine but downloading does not. The download gets automatically paused, and after a minute it shows error code DL1-...
Verpous's user avatar
  • 101
0 votes
0 answers
138 views

from executable to assembly source code?

let's say i have an ".exe program" and i want to disassemble it and get "disassembled code" . my question is => can i maintain and organize that "disassembled code" ...
0x00001F's user avatar
0 votes
3 answers
329 views

how to stop windbg when register value changes

I'm using windbg to find the memory of a specific structure in windows. The way is to look at certain values stored in stack and registers in entry function. I notice that register ax holds that value ...
anonymous bear's user avatar
0 votes
1 answer
59 views

unable to figure out how a windbg extension work

I'm trying to figure out how the below windbg extension works !ndiskd.nbl addr -hexcap(or -data) kd> !ndiskd.nbl ffffce8c96bde070 -hexcap # NET_BUFFER_LIST ffffce8c96bde070 # NET_BUFFER ...
anonymous bear's user avatar
1 vote
0 answers
64 views

Process stuck on the entry point

I'm trying to patch an old game (1998-ish) that runs on windows 95 and windows XP to make it compatible with windows 11. The current problem with it is that when running the exe file nothing seems to ...
Yair Derry's user avatar
0 votes
1 answer
108 views

Tool to analyze .obj files (not COFF) created with /LTCG

This Microsoft article states that: When building with LTCG, the compiler front end doesn't invoke the back end. Instead, it emits an OBJ file with IL in it. It bears repeating: this IL is not the ...
langlauf.io's user avatar
  • 1,560
0 votes
0 answers
78 views

Pe file import binding

I'm learning a bit about PE files. The thing I've struggling a bit now it the First Thunk and Original First Thunk fields. To understand the difference between them I've read this post and that ...
Daros911's user avatar
  • 115
0 votes
0 answers
141 views

windbg fail to load symbol with UNC store

I'm debugging a qemu windows machine in docker and the windbg shows the file is missing. Windbg is attached to qemu kd> .sympath Symbol search path is: srv* Expanded Symbol search path is: cache*;...
anonymous bear's user avatar
1 vote
0 answers
178 views

Where can I find the files from Ghidra symbol tree?

I have decompiled a .dll file with Ghidra. At the left, I see the symbol tree. In the symbol tree, there is a tab imports. This tab contains external .dll files. Where can I find the location of these ...
Riemann's user avatar
  • 83
2 votes
2 answers
265 views

How can I find the buffer of CryptGenRandom?

I am trying to analyze the CryptGenRandom algorithm on my Windows 10 laptop. According to Niels Ferguson's Whitepaper called 'The Windows 10 random number generation infrastructure', the ...
Riemann's user avatar
  • 83
1 vote
0 answers
152 views

Inject a MessageBox to the PE file

I'd like to patch some Windows PE file to show just simple MessageBox. Taking into account that the PE in question doesn't import the MessageBoxA function if I'm right that all i need to do is to add ...
Daros911's user avatar
  • 115
0 votes
0 answers
38 views

How can I make a quick tracer for a PE file?

INTRODUCTION: I made my tracer on the event debug loop, but after I compared its speed characteristics with the same PinTool or similar tools, I realized that my tracer is several dozen times slower ...
Swoke's user avatar
  • 11
0 votes
0 answers
55 views

Firmware not attached to WinDBG while debugging Windows boot process

I'm attempting to reproduce the cve-2022-21894 poc for educational purposes, however I'm getting stuck at the "hvloader" phase. The debugger cannot attach to the boot process. Short ...
gergeerew's user avatar
0 votes
0 answers
96 views

How to inject (a lot of) code into a running program?

I've seen a number of tutorials on changing several binary digits of an executable, like changing assembly je to jn. But what I want to add new functionalities. #include <iostream> #include <...
Gqqnbig's user avatar
  • 133
0 votes
0 answers
28 views

Windows Library description number

Windows Libraries that engage in Library Hijacking, typically have a number in their library description field. What is this field? How does Windows Process it and is there a mapping of int32-like ...
melsk's user avatar
  • 1
1 vote
0 answers
95 views

Windbg command .call usage and syntax

I'm using Windbg to track all functions that could result in the blue screen errors. My method is to call certain suspects manually through windbg .call command. However, I always got syntax error. ...
anonymous bear's user avatar
1 vote
2 answers
240 views

Identifying file-access functions used by explorer.exe

I'm trying to write a Windows 10 64-bit rootkit that runs on userland and hides files using IAT hooking. I managed to accomplish that on cmd.exe by hooking FindFirstFileW and FindNextFileW imported ...
one_hell_of_a_guy's user avatar
1 vote
1 answer
726 views

How can I extract the password from an installer/self-extracting archive?

I have an installer/self-extracting archive. The executable file has an embedded ZIP archive into it (like many other installers). The ZIP archive is encrypted with a password. The installer DOES NOT ...
ARGYROU MINAS's user avatar
2 votes
1 answer
165 views

What triggers RIP_EVENT?

The documentation for the Windows Debugger API mentions a debug event called RIP_EVENT. It offers little explanation of what a RIP_EVENT is, only stating that the structure "contains the error ...
tomysshadow's user avatar

1
2 3 4 5
17