Questions tagged [windows]
Windows refers to the Microsoft Windows series of operating systems.
714
questions
0
votes
0answers
12 views
Proxy dll doesn't load the original dll
I have relatively simple code here for the proxy dll main function:
BOOL APIENTRY DllMain(HMODULE hDll, DWORD reason, LPVOID reserved)
{
if (reason != DLL_PROCESS_ATTACH) {
return TRUE;
}
...
0
votes
0answers
23 views
Can't figure out a crash in IDA “The memory could not be read -> 00000710 (exc.code c0000005, tid 20612)”
I'm trying to debug out a game. Basically, the Steam version works perfectly but the GOG version (which is 8kb smaller) has an annoying problem where for some people (which happen to be me) the game ...
0
votes
0answers
28 views
Ghidra: Identify and display a struct broken into multiple smaller fields
Me vs the 90s game, part two.
I'm trying to figure out how the game detects the current date, since that part doesn't work correctly anymore. At some point, GetLocalTime() from kernel32.dll gets ...
0
votes
0answers
21 views
There is a course in which they teach you to use WinAFL?
I would like to know if there is a course that begins in a basic way, such as how to use winAFL to find bugs in app desktop.
0
votes
1answer
51 views
How to find main() of Windows EXE with Ghidra?
I'm new to Ghidra, my goal is to add localizations for a small EXE program. The program was written in Visual Studio and has Russian dialogs, which I like to convert to English.
I've loaded the EXE ...
-1
votes
1answer
42 views
How to find bugs in a modern desktop application with reverse enginnering?
I would like to clarify the context for the question: I have studied different types of exploiting but all the studies I have carried out were with command line programs and with functions that I ...
0
votes
0answers
19 views
How to replace the modified/corrupted module image on the original in the memory dump
I'm analyzing a windows kernel crash. I have instrumented “USBPORT.sys" kernel module for collecting metrics. I named the instrumented version of the module "TARGET_MODULE". After I ...
0
votes
0answers
86 views
What kind of code creates this function call pattern?
While using WinDbg: u/uf to disassemble functions in ntoskrnl.exe there are functions that are used in system calls and exception handling that have these weird function call patterns and I can't ...
4
votes
1answer
130 views
Fixing/recompiling a heavily control flow obfuscated function
I've recently come across a binary that has been obfuscated with a very obscure protection.
Obfuscation
From what I understand, the obfuscator is effective in several ways.
Multiple JMPs via relative ...
1
vote
1answer
46 views
Want to use win API hooking to detect wmi query string? But can't find IWbemServices::ExecQuery in fastprox.dll
I want to implement WMI query detection function using apimon plugin in sandbox https://github.com/tklengyel/drakvuf
To do it,I have to get the DLL symbol file.
But I can't locate the IWbemServices::...
0
votes
0answers
29 views
Is it possible to Direct3D 9 debug DLL in an app using the release version
I have an application using d3d9.dll, but I want to figure out which functions it calls to gain insight.
Since online tools I have found are incompatible with my app (32-bit d3d9),
is it instead ...
0
votes
1answer
35 views
CreateFileA returning invalid handle when file exists
I was working on a practice binary. It opens the file at C:/WINDOWS/system32/filename#123.dat, if the file does not exist, the check compares the result to -1 (An invalid handle). However, even after ...
1
vote
0answers
29 views
Reversing Logitech G933 Battery Charge Values
I have a Logitech G933 headset. I replaced the stock battery with a larger capacity. The headset now lasts many hours longer than it was originally designed, and the software is configured to give ...
1
vote
1answer
53 views
How to get thread start address in Windows?
I'm writing thread finder in module. My goal is find all threads in process and find threads currently working address locations. Like image on below. I do this goal with NtQueryInformationThread API.
...
1
vote
1answer
63 views
Identifying/debugging code parts responsible for features in Windows
New to the area, i am trying to identify the code responsible for example for the search functionality in Windows when you start typing in the start menu.
What are some generic ways of identifying the ...
1
vote
1answer
49 views
Why is process object is shown as desktop object in nt!_object_type
I try to extract the object type of notepad.exe in windbg but the nt!_object_type is showing it as Desktop object instead of Process object.
Any idea why is it so?
4: kd> !process 0 0 notepad.exe
...
0
votes
0answers
133 views
Windows time travel debugging performance bottleneck
First of all I wan to be clear, that this question is not about the collection performance, but indexing performance.
What is the performance bottleneck of the indexing step?
Some context:
Action in ...
2
votes
1answer
36 views
Why some process has empty nt!_object_type
I try to extra the nt!_object_type of notepad.exe process. But seems like it's empty. Is it some process has no object type?
Correction for my screenshot above for using the EPROCESS address to ...
1
vote
1answer
83 views
Run ntoskrnl.exe with qemu
We can run linux and similar unix kernels uing qemu -kernel parameter. Is there any way to do the same with NT kernel? I could not find a way to test even reactos kernelwith qemu.
Also can .efi files ...
0
votes
1answer
25 views
Can't add tracing in IDA, showing it in gray
I added read/write trace to a program. I was able to record the trace with IDA for the first time.
When I run it again, it didn't work.
I tried to do what I did on the first time, adding the read/...
1
vote
1answer
59 views
How to load modules symbols to IDA while debugging a process
I am debugging a program that I compiled.
This program calls SetWindowTextW.
When I am debugging it with IDA I can step into this function, but it doesn't recognize anything there:
If I will load ...
1
vote
0answers
21 views
On Windows, when is a PTE a VAD prototype PTE (with address 0xFFFFFFFF0000) instead of a prototype-pointer PTE?
I have reviewed several sources on this PTE type, including Windows internals and the following:
http://blog.rekall-forensic.com/2014/10/windows-virtual-address-translation-and.html https://thalium....
1
vote
0answers
18 views
Whats the difference between a MiNotMapped PFN entry with all 1s, and a MiNonCached PFN entry with all 0s and a 0 PteAddress?
On host (UEFI legacy mode):
lkd> !pfn 0xf0
PFN 000000F0 at address FFFFFA8000002D00
flink FFFFFFFFFFFFFFFF blink / share count FFFFFFFFFFFFFFFF pteaddress FFFFFFFFFFFFFFFF
...
2
votes
0answers
52 views
How to disassemble win32 function RegSetValueExW?
I have opened up advapi32.dll in IDA and found out that RegSetValueExW is just a jump to RegSetValueExW_0. And RegSetValueExW_0 seems to be an extern.
How do I actually disassemble RegSetValueExW_0?
3
votes
1answer
79 views
Unable to attach into mysterious PID
I have a suspicious process. I found it by ProcessHacker's network tab.
ProcessHacker display the process as Unknown.
The process listening into a constant port number that's also not found by ...
2
votes
1answer
112 views
Extracting strings from binary files (.exe)
This question has been asked quite a lot especially on stackoverflow, but the solutions/replies are not clear or extensive.
What I`m looking for is to build what Strings does from Sysinternals. My ...
2
votes
1answer
82 views
How to find sleep() in ollydbg or IDA or ghidra
I have a program which converts videos from a proprietary format into mp4.
The conversion is very slow and CPU utilization is less than 1%.
I'm able to speed up the conversion process via Cheat Engine'...
1
vote
1answer
67 views
Disassembly call function offset from RIP
I am writing a program where I map an .exe PE file in memory and I "dissect" it.
I am disassembling the .text section of the target executable, using the distorm disassembler.
CALL ...
0
votes
2answers
65 views
Import header files in IDA to get the struct definitions?
I am reversing a program that has a lot of internal structs in it.
The problem is that there are a lot of structs, so i can't import them manually using local types->insert.
Lets say i have some ...
0
votes
1answer
27 views
Find out version of statically linked MFC from an exe
I have an exe with symbols stripped that I am trying to reverse engineer. I know the library is linked with MFC but I don't know which version. (Therefore, I can't use something like FLIRT signatures ...
0
votes
0answers
55 views
Can I reverse engineer original file names?
I'm new to IT and I turned my external hard-drive into a windows boot disc. I managed to recover files with testdisc & photorec_win. The downside is I got more than I bargened for and I have twice ...
1
vote
1answer
66 views
Merging a large number of segments in IDA Pro
I'm working with a memory dump of a protected win32 program. Something causing me a lot of pain is the program being split into roughly 3,000 contiguous small segments (i.e. instead of just .text and ....
0
votes
0answers
95 views
WMI Spoofing by Fastprox.dll Hooking
I m trying to spoof WMI output by hooking the fastprox.dll. Here is the code I m working on:
typedef HRESULT(__stdcall* tGetFunc)(IWbemClassObject*, LPCWSTR, LONG, VARIANT*, CIMTYPE*, long*);
static ...
0
votes
1answer
55 views
How much of the kernel does remote kernel debugging allow you to debug?
This is a theoretical question because I've never set up remote kernel debugging before -- but I will do at some point, which should hopefully answer some of the experimental questions I have.
What ...
0
votes
0answers
38 views
new to malware analysis and disassembly. dotpeek has been helpful. is this unreadable code due to SuppressIldasmAttribute?
just getting into rev engineering malware. i want to get to source on my own. i could use run.any or VT but that's no fun. any reason why this is unreadable the way it is? is it due to the module ...
0
votes
0answers
34 views
Set standard input/output to a process using NtCreateProcessEx
In the official Windows API function CreateProcessA is possible set or change the standar input and output of the process vía LPSTARTUPINFO structure.
How can do this using the undocumented function ...
0
votes
1answer
78 views
Why a single “nop” crashed the game?
I hope answer to my question is not game/app specific and can be answered in communities like this.
So, I tried to use some internal functions of a game, like pick a target. No malicious intentions, ...
1
vote
1answer
55 views
does mov DWORD PTR 32[rsp], 5 means mov DWORD PTR [rsp+32], 5?
I am learning about windows x64 calling convention, where the first four arguments are passed to registers and left arguments are passed through the stack. To see it, I checked the assembly of the ...
1
vote
1answer
37 views
Switch between debuggers while paused on a breakpoint
Is it possible to switch between debuggers and preserve where you are paused? Often times I find myself wanting to use a feature from a different debugger while paused in a specific context as each of ...
0
votes
2answers
70 views
kd live local debugging !pte and db don't work (only shows context of the debugger for all contexts), but !vtop works
Says the PDPT and PDs of the process are at the same physcial frames (pfns) in both processes.
The first process is winword.exe and the second process is calc.exe
The virtual address in the first case ...
0
votes
0answers
33 views
How to apply complete type information from PDB for multiple images in one IDA database?
IDA is capable of loading multiple images/DLLs into the same database. In this scenario, ntdll.dll and kernel.dll have been loaded additionally to the main target .exe-file into the database. On top ...
0
votes
0answers
53 views
Reversing Windows binary to find where the error is with Ollydbg
I've some experience with gdb and debugging in Linux environment (I'm studying computer science at University and I'm able to handle bof in Linux).
The problem now is on a Windows program. I start it ...
0
votes
0answers
100 views
SSL pinning and bypass
I'm currently investigating one very suspicious app on my system (Windows 10 x64 bit). I wanted to try and understand outgoing https traffic it utilizes by trying to MITM it using Fiddler but as I ...
-1
votes
1answer
68 views
PE Self Injection Not Working
I'm working on different PE Injection technique. I want inject PE file into virtual memory of current executable. After that, I want execute injected PE file, I wrote inject code but my method is not ...
0
votes
0answers
23 views
Smart Battery Issues, a RE Quest?
TL;DR: Perhaps this doesn't sound like a RE post at first, but it's kind of moving in that direction. Essentially, I replaced the battery in my Surface laptop with 2x different new batteries, and they ...
0
votes
0answers
25 views
Thread keeps generating page fault
So i was recently trying to exploit a kernel mode driver (HEVD) and I encountered a problem which doesn't make sense to me.
After i jumped to my shellcode (which resides in usermode), the thread keeps ...
0
votes
0answers
36 views
Fuzzing Third Party Windows Drivers
I want to contribute to vendors while learning how to be a security researcher, and I was wondering: How can I fuzz third party windows drivers? (For instance, those that come with cpu/gpu and similar ...
0
votes
2answers
275 views
CaptureBAT equivalent on Windows 10?
Hello RE community on stack !
I am a beginner, so please pardon any commonplace errors
I am looking to run CaptureBAT on a Windows 10 VM, to capture network activity of different kinds of Malwares
I ...
0
votes
0answers
50 views
Patching a program in IDA
I've opened a simple Hello World program in IDA (Pro 7.5) like that:
global _main
extern _printf
section .text
_main:
push message
call _printf
add esp, 4
push ...
1
vote
1answer
135 views
Arrays assembly
I'm reversing my C array's programs where I'm storing numbers in arrays like this...
int marks[5];
marks[0] = 1;
marks[1] = 3;
marks[2] = 2;
marks[3] = 7;
marks[4] = 9;
so the compiler showing me the ...
