Questions tagged [windows]

Windows refers to the Microsoft Windows series of operating systems.

Filter by
Sorted by
Tagged with
0 votes
0 answers
26 views

How can I prevent NDIS in Windows 10 from turning off the NIC in Fast Startup Mode? [closed]

According to Microsoft documentation, fast startup involves hibernation (S4), and the NDIS driver is responsible for powering the ports in fast startup mode (turning off the NIC). Is there any way to ...
Antinet's user avatar
0 votes
0 answers
30 views

Is there an effective way to reverse engineer the way this plagiarized thesis was constructed?

The following AI ethics plagiarist has received hundreds of thousands of dollars for AI ethics research: $300000 for EXPLAIN (2022-25) where he is the primary investigator for Umeå University. Funded ...
Petey's user avatar
  • 1
0 votes
1 answer
58 views

Need help understanding why Netflix prevents me from downloading with VPN

When using Netflix via the Windows desktop app with a VPN, streaming movies works fine but downloading does not. The download gets automatically paused, and after a minute it shows error code DL1-...
Verpous's user avatar
  • 101
-1 votes
0 answers
75 views

Decompiling SkiFree (An attempt) [duplicate]

Excuse me, I am just liking to use the SkiFree source code for my very own purpose. The purpose is basically adding my own enemies and stuff to it (with it's own functions) rather than replacing the ...
Picaboo3's user avatar
0 votes
0 answers
74 views

from executable to assembly source code?

let's say i have an ".exe program" and i want to disassemble it and get "disassembled code" . my question is => can i maintain and organize that "disassembled code" ...
0x00001F's user avatar
0 votes
3 answers
71 views

how to stop windbg when register value changes

I'm using windbg to find the memory of a specific structure in windows. The way is to look at certain values stored in stack and registers in entry function. I notice that register ax holds that value ...
anonymous bear's user avatar
0 votes
1 answer
55 views

unable to figure out how a windbg extension work

I'm trying to figure out how the below windbg extension works !ndiskd.nbl addr -hexcap(or -data) kd> !ndiskd.nbl ffffce8c96bde070 -hexcap # NET_BUFFER_LIST ffffce8c96bde070 # NET_BUFFER ...
anonymous bear's user avatar
1 vote
0 answers
49 views

Process stuck on the entry point

I'm trying to patch an old game (1998-ish) that runs on windows 95 and windows XP to make it compatible with windows 11. The current problem with it is that when running the exe file nothing seems to ...
Yair Derry's user avatar
0 votes
1 answer
62 views

Tool to analyze .obj files (not COFF) created with /LTCG

This Microsoft article states that: When building with LTCG, the compiler front end doesn't invoke the back end. Instead, it emits an OBJ file with IL in it. It bears repeating: this IL is not the ...
langlauf.io's user avatar
  • 1,540
0 votes
0 answers
45 views

Pe file import binding

I'm learning a bit about PE files. The thing I've struggling a bit now it the First Thunk and Original First Thunk fields. To understand the difference between them I've read this post and that ...
Daros911's user avatar
  • 115
0 votes
0 answers
31 views

windbg fail to load symbol with UNC store

I'm debugging a qemu windows machine in docker and the windbg shows the file is missing. Windbg is attached to qemu kd> .sympath Symbol search path is: srv* Expanded Symbol search path is: cache*;...
anonymous bear's user avatar
1 vote
0 answers
42 views

Where can I find the files from Ghidra symbol tree?

I have decompiled a .dll file with Ghidra. At the left, I see the symbol tree. In the symbol tree, there is a tab imports. This tab contains external .dll files. Where can I find the location of these ...
Riemann's user avatar
  • 83
2 votes
2 answers
190 views

How can I find the buffer of CryptGenRandom?

I am trying to analyze the CryptGenRandom algorithm on my Windows 10 laptop. According to Niels Ferguson's Whitepaper called 'The Windows 10 random number generation infrastructure', the ...
Riemann's user avatar
  • 83
1 vote
0 answers
67 views

Inject a MessageBox to the PE file

I'd like to patch some Windows PE file to show just simple MessageBox. Taking into account that the PE in question doesn't import the MessageBoxA function if I'm right that all i need to do is to add ...
Daros911's user avatar
  • 115
0 votes
0 answers
32 views

How can I make a quick tracer for a PE file?

INTRODUCTION: I made my tracer on the event debug loop, but after I compared its speed characteristics with the same PinTool or similar tools, I realized that my tracer is several dozen times slower ...
Swoke's user avatar
  • 11
0 votes
0 answers
37 views

Firmware not attached to WinDBG while debugging Windows boot process

I'm attempting to reproduce the cve-2022-21894 poc for educational purposes, however I'm getting stuck at the "hvloader" phase. The debugger cannot attach to the boot process. Short ...
gergeerew's user avatar
0 votes
0 answers
52 views

How to inject (a lot of) code into a running program?

I've seen a number of tutorials on changing several binary digits of an executable, like changing assembly je to jn. But what I want to add new functionalities. #include <iostream> #include <...
Gqqnbig's user avatar
  • 133
0 votes
0 answers
22 views

Windows Library description number

Windows Libraries that engage in Library Hijacking, typically have a number in their library description field. What is this field? How does Windows Process it and is there a mapping of int32-like ...
melsk's user avatar
  • 1
1 vote
0 answers
41 views

Windbg command .call usage and syntax

I'm using Windbg to track all functions that could result in the blue screen errors. My method is to call certain suspects manually through windbg .call command. However, I always got syntax error. ...
anonymous bear's user avatar
1 vote
2 answers
138 views

Identifying file-access functions used by explorer.exe

I'm trying to write a Windows 10 64-bit rootkit that runs on userland and hides files using IAT hooking. I managed to accomplish that on cmd.exe by hooking FindFirstFileW and FindNextFileW imported ...
one_hell_of_a_guy's user avatar
0 votes
0 answers
47 views

Emulation program broke because game updated from 32 bit to 64 bit

I have no idea who the developers of the emulator are; so I have no way to reach out to them for a fix. I'm hoping to find someone here who would be willing to take a look at the emulator to see what ...
breezett93's user avatar
2 votes
1 answer
109 views

Marking DAT section as shellcode in ghidra

I have a binary that loads a DAT section as code (calls ((code **) DAT_something)(0, 2)), and I'd like to be able to disassemble the DAT_something data region. Currently, when looking at the ...
0x150's user avatar
  • 121
1 vote
1 answer
489 views

How can I extract the password from an installer/self-extracting archive?

I have an installer/self-extracting archive. The executable file has an embedded ZIP archive into it (like many other installers). The ZIP archive is encrypted with a password. The installer DOES NOT ...
ARGYROU MINAS's user avatar
2 votes
1 answer
68 views

What triggers RIP_EVENT?

The documentation for the Windows Debugger API mentions a debug event called RIP_EVENT. It offers little explanation of what a RIP_EVENT is, only stating that the structure "contains the error ...
tomysshadow's user avatar
0 votes
1 answer
50 views

Should shell32.dll be in executable search path for winword.exe with WinDBG?

I'm threat hunting and I'm curious if there should be a shell32.dll in the executable search path in windbg for winword.exe.
Invulnerable Immortal's user avatar
1 vote
0 answers
52 views

How to develop an anti-debug library which allow users to debug their own programs but not the library?

I'm going to publish a library which guarded by anti-debug ,(ptrace_trackme for Linux and isDebuggerPresent for windows). The down side of this library is: users would be abled to debug their own ...
prgbenz's user avatar
  • 81
2 votes
0 answers
52 views

i want to know how to tracing a exe's http responses and log them

I want to "crack" this cheat loader protected by thermedia and I had someone do it before but lost contact with them and, now I would like to learn to do it myself. and they said a basic way ...
od8m's user avatar
  • 21
2 votes
0 answers
49 views

Need help extracting AP_Pack .obb files

I'm trying to extract the files for the series of 4 games - Sorcery!, which are in the format .obb. Thanks to a Hex editor I saw that the .obb was an AP_Pack, and looking for more information on the ...
Maneki's user avatar
  • 21
2 votes
0 answers
29 views

How is the language of a font glyph determined?

A glyph holds data such as its name and contour points. But how do you determine where the characters of one language end and another begins? Is there a written standard that says language X starts at ...
user3208218's user avatar
4 votes
1 answer
97 views

Replacing a function in a 1995 Windows 32-bit binary using Frida causes crash

I am working with a 1995 Windows 32-bit binary compiled with Watcom, which uses the Watcom calling convention. I am trying to replace a simple string length calculation function in the binary using ...
Cesar Canassa's user avatar
4 votes
2 answers
159 views

Malware analysis - Debugger hangs at HttpSendRequestA

I'm reverse engineering a malware that at some point tries to connect to http://api.ipify.org in order to get the IP address of the infected PC. I was able to replicate this behaviour with a small ...
Luca D'Amico's user avatar
4 votes
0 answers
69 views

Replace a function in a Windows 32-bit binary with a custom C function

I am reverse engineering a Windows game from 1995 using Ghidra, and I'm currently documenting all the decompiled functions. My goal is to replace a function in the original binary with a custom C ...
Cesar Canassa's user avatar
4 votes
3 answers
313 views

Help disassembling a simple 16-bit NE function

I am currently attempting to reverse engineer a simple function from within a 16-Bit Windows 3.1 (NE) DLL, which from what I can tell is used to display a message box when required. I would assume ...
jttri777's user avatar
  • 165
3 votes
0 answers
110 views

How can I find out which system functions are used in applications using dynamic loading?

I'm trying to make an application that tries to hook a specific function. but I realized something while working, I can't hook functions of applications that use dynamic loading using the detours ...
DertliSelo's user avatar
2 votes
0 answers
39 views

WinDbg Preview search is not returning results

I am attempting to manually unpack a malware sample. I am using the new WinDbg Preview (only thing that is available to download now). After letting the malware call VirtualAlloc I am trying to search ...
Jason Crosby's user avatar
0 votes
0 answers
58 views

Why is Windows 10 still blocking me from running malware?

I am analyzing some malware on Windows 10. I installed FLARE VM, disabled tamper protection and disabled the virus scanner in the registry. However when I attempt to run a malware, Windows is still ...
Jason Crosby's user avatar
1 vote
0 answers
106 views

IDA pro Error how to resolve this error

52C187F5: The instruction at 0x52C187F5 referenced memory at 0x4. The memory could not be read -> 00000004 (exc.code c0000005, tid 672) How to Solve this. I have seen sandbox reports in those the ...
Satyam Singh's user avatar
4 votes
1 answer
350 views

Reverse engineer DPC Latency Checker tool to fix high Windows kernel timer latency

I need help with something very Windows/kernel-specific. I'm working on a fix for the high Kernel Timer Latency in Windows 10 2004 and higher. This problem was introduced between Insider Build 18950 ...
SilverLPs's user avatar
2 votes
0 answers
38 views

How does Windows Updates determine if the patches are compatible?

I am looking into Microsoft Windows updates, and how they are applied, after extracting the .msu file, we get some .cab files with patches (in PA30 format), and informations on the file attributes, ...
Redouane Red's user avatar
4 votes
1 answer
96 views

Windows 11: Interact with IDA pro when running in session 0

I am trying to debug a windows service, so I set IDA as the debugger of that service. But since services are running in session 0, I can't interact with IDA. Also in the latest windows version (e.g. ...
tturbox's user avatar
  • 53
3 votes
1 answer
96 views

The same notepad.exe runs in both WoW64 and x64 modes

When I run notepad.exe with x64dbg it runs as WOW64 process. But when I run it with x32dbg it runs as x64 process with x64 instructions. I am running it from the same directory C:\Windows\System32\...
SSSSSXXXXX's user avatar
5 votes
1 answer
243 views

Why is function in kernel32.dll jumping into a api-ms-win-core stub

I was trying to look into the implementation of GetVersion function in kernel32.dll. I was surprised to see that the GetVersion thunk is issuing a jump to API-MS-WIN-CORE-SYSINFO-L1-1-0.DLL::...
caramel1995's user avatar
3 votes
1 answer
69 views

How does this Is64BitOS pointer-arithmetic-based function work?

Reversed this function. It works. But stepping through I can't figure out how. Why does this work? bool _Is64BitOS(void) { unsigned int version = *(unsigned int*)0x7FFE026C; unsigned int ...
Pulpo's user avatar
  • 155
2 votes
1 answer
64 views

Capture and Replay

I was wondering if it was possible to create a python script that is able to capture and replay the instructions executed by a windows program for in depth analysis.
jjprince's user avatar
4 votes
2 answers
379 views

Forcing a legacy Windows application to use an older version of ntdll.dll

There is this old Windows application I've been using for more than a decade now: DesktopEarth. It got its last update in 2015 and the author's website is offline now, but it's been running fine on ...
klamann's user avatar
  • 141
2 votes
1 answer
162 views

How to access files stored in mouse?

I own a Razer Mamba Elite mouse. After plugging it in to the usb port, an software installation window shows up. Basically it's the Razer software to manage device's options such as profiles, macros, ...
Matt's user avatar
  • 21
2 votes
0 answers
103 views

How to decrypt data during runtime before executing and then encrypting it back

I was doing some research and came across the term protectors. From my understanding is they encrypt a file to be protected but run it without an issue. During its execution it is able to decrypt the ...
soqq's user avatar
  • 21
2 votes
0 answers
62 views

What is the following code will do after modifying it? [closed]

The following commands will change the files information gatherosstate.exe file. From looking at the hex values I can interpret that there are nop (0x00). The file changed in windows terminal. But ...
i_am_learning's user avatar
3 votes
1 answer
149 views

How to call Windows console in ASM and printf some values there?

Is there a working way to embed the windows console in disasm code? I tried AllocConsole with GetStdHandle or AttachConsole with PID of an existing console but it didn't work. I have tried printf ...
EvilCracker's user avatar
2 votes
1 answer
140 views

What are latest research in reverse engineering?

I am searching research papers related to reverse engineering between 2020 and 2022 but did not found good papers with latest research in the direction of reverse engineering. So, what are the latest ...
i_am_learning's user avatar

1
2 3 4 5
17