Questions tagged [windows]
Windows refers to the Microsoft Windows series of operating systems.
620
questions
0
votes
0answers
30 views
Windows pintool mismatch between call/ret instructions
So i've been trying to write a pintool that monitors call/ret instructions but i've noticed that threre was a significant inconsistency between the two. For example ret instructions without previous ...
0
votes
0answers
54 views
How to find and edit the source of a string in a DX11 game's exe/files (debug build of the game available)
I want to find and edit the values for the motion blur effect in Naruto: Ultimate Ninja Storm 3 on PC (Windows, DX11) to be more in line with the PS3 version (and the other Storm games on PC as well). ...
0
votes
1answer
55 views
how could i follow a system call from a dll -> kernel driver syscall
basically i would like to follow (system calls / internal calls) that basically lands in the kernel i would like for example to debug a specific dll ex : ntdll.dll and follow it to (NtXXX) function ...
1
vote
0answers
24 views
PE Format - How can I delete IMAGE_IAT_DIRECTORY and the app still runs fine?
I’m doing a small research regarding PE files and while I drilled every related question or the documentation itself I couldn’t explain this issue.
Why can I go to CFF explorer or some other PE ...
0
votes
2answers
48 views
Where do arguments 5 and 6 go in this Microsoft x64 function call?
I'm disassembling a working-as-expected compiled C program (MS/Windows x64, MinGW gcc 10.1.0). In the main function, I have the following call which passes 6 arguments to the function DotProduct:
...
/...
1
vote
0answers
25 views
How are AutoIT variable names stored after compiling it to a executable?
I need to write a yara rule for a autoit malware (the binary itself not the decompiled script)
As far as i know the actual script is in the resource section in the RCData, but how can i find the bytes ...
0
votes
1answer
44 views
How to run another IDA script using IDApython?
I'm using IDA batch scripting to run a script on a dataset of malware
the problem is i need to run the VB6 idc script after auto analysis is finished, and wait for it to finish and find all the ...
1
vote
1answer
66 views
How to know where a sequences of bytes are used in a .NET application with Dnspy?
There are a sequence of bytes that i need to find out where are used in dnspy
i tried going to hex editor and found the bytes, but right clicking and saying go to code or structure or follow reference ...
2
votes
1answer
39 views
Pe 32 Add Export function Segment by Extending with dll or Patching pe
I need to add new function inside pe32 module.dll Export Table , in dynamic way if possible ( via extending with dll ) or by patching pe32 module.dll
What can u suggest to solve this ?
2
votes
1answer
43 views
How to debugging activeX with Ida
When I enter to some site it ask me to install ActivX to my Internet Explorer browser so this site will work well. I installed that,and that site works well.
How can I see this ActiveX code(where ...
0
votes
1answer
44 views
Why does an executable still run despite changes to checksum, or changes to data section without new checksum?
I have a "Hello World" console app compiled with Flat Assembler. The size of the executable is 2048 bytes and the checksum is 0x3797.
Questions:
Does it matter if I make changes to the data section ...
0
votes
0answers
81 views
How to bypass SSL certificate pinning on Windows 10
When reverse engineering a big application, it can be very useful to be able to see the network traffic it generates.
Because of this, many applications use HTTPS to communicate with their servers. ...
4
votes
1answer
72 views
what routine in ntdll.dll is responsible of dispatching DllMain function of loaded dll?
I'm trying to debug a dll file using Ida disassembler and Windbg.
I'm debugging rundll32.exe and passing the target dll (debugee) as an argument.
I'm able to have a breakpoint on each Dll load & ...
1
vote
1answer
40 views
What is the difference between mapped and private memory segments in xdbg? and what is a reserved segment?
So in xdbg in the memory map, i can see that some segments are mapped and some are private, at first i thought maybe mapped means it has a corresponding file on disk and its the mapped version of that,...
2
votes
1answer
50 views
Get return address from syscall
I'm debugging some 32-bit process using windbg kernel debugger. This process calls some syscalls, so I set few breakpoints at kernel functions like nt!NtQuerySystemInformation. So after breakpoint hit,...
0
votes
0answers
34 views
x64dbg call function from current thread
While debugging an executable with x64dbg, I want to make a function call (while the executable is stopped on a breakpoint), what I want to do is the same as the following gdb line:
p (void*)freopen("...
2
votes
3answers
87 views
How does an application identify a DLL file
Sorry if this is a basic question, as I'm very new at this.
I'm trying to get an .exe to load a dummy .dll. I've created an example .dll project in VC++ 2019, added the functions listed in the .exe's ...
1
vote
1answer
35 views
advapi32.dll changes name of function during forwarding of exports
Im trying myself at writing a manual mapper, for injection of DLLs into other processes.
Ive come to the point, where I've written a simple "Hello World" dll, that im trying to inject into another ...
0
votes
0answers
35 views
How can I reassemble a DDS header with the information I have?
I have 2 files which I know for certainty to be as follows:
File 1: Includes all of the DDS image data
File 2: Includes some data from the header. The data it includes is the width and the height (...
1
vote
1answer
32 views
What is the mdisp field in RTTI for throw used for?
First of here is the article from which I'm looking up the fields.
I was trying out different combinations to see how they affect the RTTI for a C++ throw. It seems that having a virtual base class ...
1
vote
1answer
35 views
Can I make a DDS image from headerless DDS data?
I have some files which I've decrypted that I believe are DDS images. These files do not have a DDS header, however the data looks similar to what I've seen in other DDS images. I believe to a great ...
3
votes
2answers
125 views
Windows - syscalls being called in a strange way?
I've been reading about the way syscalls are called in windows.
The general theme in all the articles I read is:
64bit- called inside ntdll
32bit- from ntdll jumping to KiFastSystemcall
but when I ...
2
votes
1answer
36 views
Where do mouse/keyboard GUI inputs get queued or stored?
Where do mouse-clicks in a program's GUI window/menus (Windows OS) get stored in memory? Is there some sort of input/GUI "queue" similar to Windows messages queuing?
I'm wondering if it'd be possible ...
3
votes
1answer
61 views
CreateToolhelp32Snapshot() access denied (while running as admin or even NT AUTHORITY\SYSTEM)
I've come across a troublesome process which refuses to allow CreateToolhelp32Snapshot().
I also noticed that in sysinternals process explorer it shows "Access Denied" for other things too, such as ...
0
votes
0answers
37 views
fuzzing GDI/BITMAP kernel vulnerabilities
i was wondering about gdi/bitmap vulnerabilities in windows kernel(preferably windowds 10).
i saw several exploits and papers regarding this subject, and while it all seem really interesting, i did ...
2
votes
2answers
70 views
Modern methods of fuzzing/locating heap bugs and potential vulnerabilites
really glad I found this great learning resource.
I was wondering, is there any way to fuzz or automate heap vulnerability assesment? I know a lot of practical frameworks for stack based fuzzing in ...
2
votes
1answer
85 views
I can't set a hardware breakpoint on RIP + N-byte after calling NtContinue()
#include <Windows.h>
int handle_exception (EXCEPTION_POINTERS *exception_pointers) {
exception_pointers->ContextRecord->Rip += 4;
return EXCEPTION_CONTINUE_EXECUTION;
}
int main (...
2
votes
1answer
383 views
Reverse engineer Listen to this device on Windows - Reverse engineer Windows when there's no API
I'm writing an Autohotkey script to toggle Listen to this device for my microphone, without interacting with a GUI.
I thought it would be a simple registry key being modified so I used RegShot to ...
1
vote
1answer
99 views
Hiding a file in a Windows operating system
I am trying to understand how to hide a file in windows as a way to learn about win api and malware analysis.
What I am trying to do is to make a file "disappear" via some kind of manipulation. But I ...
0
votes
3answers
85 views
What is the best way to change the call-graph of a PE file without changing its real behavior and without packing it?
What i want to do is take a PE file, extract its call-graph, and then inject a junk function in it, so for example by injecting a junk function inside of it, and changing a call instruction's opcode ...
0
votes
0answers
41 views
How can I debug code execution on a Native->Unity/Mono/C# Application
I'm reverse engineering a Windows application which has a main executable that appears to run some boilerplate/stub code before calling UnityMain and also using Mono. This means that if I use an ...
0
votes
3answers
126 views
How To Identify Which Process Is Being Written To With WriteProcessMemory?
Basically, I cannot find which process is being written to when WriteProcessMemory is being called.
Currently I'm Setting Breakpoints on WriteProcessMemory and OpenProcess. However, the process handle ...
2
votes
1answer
109 views
Anti-debug clearing hardware breakpoints
An application I am debugging somehow manages to clear my hardware breakpoints. I am using TitanHide and x64dbg.
I am observing the following behaviour:
When placing the first hw breakpoint, it is ...
0
votes
0answers
79 views
Reverse Engineering a Keygen
I have a keygen for some programs from a manufacturer. But not for all.
I suspect that the manufacturer uses very similar algorithms. Is there an easy way to find out the algorithms of the different ...
1
vote
2answers
83 views
NOPed encrypt/decrypt functions in a Path of Exile client and now it crashes without message. Next step?
I am reversing an old Path of Exile client with the purpose of building an emulator. I managed to reach the character select screen in a newer, 64-bit client but I am struggling to make the same ...
1
vote
0answers
39 views
Possible to inject a new menu into a program's menu bar?
Is it be possible to inject a new menu/menu item into a program's menu bar?
As an example, in Notepad's (Windows) "Help" menu, would it be possible to add a new entry to that menu like "Open ...
1
vote
1answer
114 views
Adding a static variable to Windows DLL
I'm trying to patch a function in a Windows x86 DLL, however it turned out that I need a static variable to store some state that wasn't correctly preserved by the original executable across calls.
I ...
-1
votes
1answer
161 views
Why cant we find ransomware keys?
From my understanding most ransomware has a secret key used for encryption in a server which it contacts to send over the key and use it for encryption
But I am wondering, couldn't someone easily ...
0
votes
0answers
34 views
Questions about process hollowing
When it's time to write the malicious image inside the hollowed process, apparently the goal is to allocate memory exactly at the image base address of the hollowed process. Why? Why not allocate ...
1
vote
1answer
60 views
Executable code in the same location differs in memory and on disk
I'm trying to inject code to change the byte value of a CMP in an executable from 0 to 2 at runtime, in order to effectively no-op a boolean comparison as part of an effort to insert my own behavior. ...
3
votes
1answer
117 views
Reverse old win32 app to find encryption vulnerability
I’m trying to reverse engineer an old win32 application used on SCADA and ICS (Industrial Control Systems). This app has a silly encryption function to protect the user password to prevent ...
1
vote
0answers
40 views
How does this wannacry sample work?
I downloaded wannacry sample here: https://github.com/fadyosman/WannaCrySample/releases. Don't forget to enter password for archive.
I figured out how most of the binary works, except the very last ...
1
vote
0answers
33 views
Find High Entropy VA (64-bit ALSR) Incompatibility in Disassembly
Have a 64-bit plugin DLL (no source code) and the host application in an update changed its DLL characteristic to include "high-entropy 64-bit address space layout randomization (ASLR)" When this is ...
1
vote
0answers
36 views
Memory modified at jump far
Observing a trace of Wow64 switching on Windows 7, the following situation makes me confused
...
0x77491dbe 64 ff 15 c0 00 00 00 call fs:[0xc0] ; syswow64\ntdll.dll
0x74632320 ea 1e 27 63 ...
0
votes
0answers
316 views
Decompile a win32 application written using C++ with .exe and .pdb
I'm aware of IDA Pro, but it doesn't generate a compilable code.
I don't want exact original source code or comments, I just want a recompilable code generation.
The exe is not packed and does not ...
0
votes
0answers
28 views
Symbol Information on wcscpy_s in WinDbg - Why references across so many DLLs?
I am using Time Travel Debugging feature of WinDbg to log string output with position of trace to help me more easily isolate sections of codes I want to analyse, using command like below:
bp ...
0
votes
0answers
37 views
How good is Cryptochecker (CC) by Aleph for binary analysis compared to the modern alternatives
I've been using the tool called CC by Aleph for ages now. To my own surprise, having found this tool on some forum, the tools remains largely undiscovered even by the cryptography/reverse engineering ...
0
votes
2answers
141 views
How to compare two different executions of the same file?
When i start the program by just double clicking the .exe, it has a certain behavior. This behavior differs when i start the program from running the launcher provided. I’d like to figure out how to ...
0
votes
0answers
34 views
Capturing traffic of an integrated laptop keyboard
I'm trying to capture the traffic between my laptop's integrated keyboard and its controlling software on Windows. I'll analyze the traffic to write a driver for Linux to control keyboard backlight. I ...
1
vote
1answer
43 views
How to track/debug/manipulate Windows processes in a VM?
I am trying to make some deep-level windows debuggig/tracing, utilizing virtualization.
Considering that if a Windows runs in a virtual machine, theoretically I have total power over it - I could ...
