Questions tagged [windows]
Windows refers to the Microsoft Windows series of operating systems.
576
questions
0
votes
0answers
23 views
Copy content of User32.dll with some modifications
I am newbie to reverse engineering, so I have a qustion.
I need to create a copy of user32.dll file with modification in one function. Then I want to place it back into system32 folder. Can you help ...
0
votes
2answers
67 views
Is it possible to use a program's GUI abilities without the GUI?
Is it possible to use/call programs' GUI abilities directly without using the GUI (programmatically, not by keyboarding)?
For example, a program with abilities nested too deeply in cascading submenus:...
0
votes
0answers
9 views
flare-vm installation not completed? [migrated]
*** I'm not really sure if this is the right place to ask this kind of question. If not, let me know the right site. Thanks
I've just installed flare-vm via install.ps1 script from
https://github....
0
votes
0answers
27 views
limit application access
There are applications that block of many software packages to secure themselves.(sniffers , monitoring , and more ...)
For example, the software examines parts of Windows including (list of ...
1
vote
0answers
26 views
Why can I inherit handles from WSASocketA and not from socket?
I'm trying to write some custom shellcode to obtain a shell from a program.
Looking at the program intermodular calls, I found a call to socket(), and my initial plan was to use that to create a new ...
1
vote
1answer
228 views
Where can you find the name of a driver causing a kernel mode crash?
I am in an interesting situation. I have very limited Windows kernel experience, so I just don't know what data structure to look for in order to find what I need to know.
There is a driver that is ...
0
votes
1answer
60 views
Can a program's memory be dumped and then reinserted?
Is it possible to dump a running program's memory (Windows OS), and then later "reinsert" that memory when the program is run again?
0
votes
0answers
56 views
Reversing a Windows service - Debug with x64dbg
For a school project I need to hook the function of the Windows spooler that is used to create a printing job with the path of the document to be printed.
For that I setup a function trampoline (this ...
1
vote
0answers
34 views
Finding PEM passphrase that may be in an executable?
I'm trying to capture the TLSv1.2 traffic of an application. In the applications directory is the file cacert.pem that I assume holds the cert for decrypting the TLS traffic. I tried to load it into ...
1
vote
2answers
86 views
Call function by ebp
When I looking at exe file with Ida I see
call dword ptr [ebp -70p]
What is that? Why this function calling by ebp and not call sub_0xabcd
How can I know which function is that to enter to this ...
2
votes
1answer
34 views
IAT vs GOT address resolving: which of them resolve during runtime and which during load time by default?
So based on my knowledge on windows apps, as far as i know the IAT gets filled with correct addresses when the library gets loaded (correct me if I'm wrong)
now in linux, they use GOT, and again ...
0
votes
0answers
30 views
Intel Pin assertion failed: RTN_Valid(x)
I am working on modifying my Intel Pin based tool. As before I am using VS2015 on Windows 10. Previously, I have been testing a tool on the same system where I build it and it worked just fine. The ...
0
votes
1answer
84 views
mfc140 dll , what is the usage?
While I open exe file in ida I can see lot of calls to mfc140_6153
or mfc140_8718.
What are those functions ? what they do ?
thanks
2
votes
0answers
37 views
Get NonPagedPool (NPP) Base Address on any Windows OS
Is there a way to get the the base(start) address of the NonPagedPool in Windows ?
I know that it's dynamic for Post windows 7 Operating Systems (Does this include Windows server 2008 ?)
0
votes
0answers
24 views
Alternative APIs to hook instead of messagebox for message pop ups?
So i am reversing an app that pops up a message at some point, but its not doing this using messagebox
i also tried to pause and then run to user code but didn't work, so what are some of the other ...
0
votes
2answers
65 views
Is relocation table only used for absolute addresses?
I was reading about mapped and unmapped PE format, and how the alignment between sections changes after loading it into memory and that caused two question for me:
is the relocation table used before ...
0
votes
2answers
43 views
Which APIs are responsible for terminating process icons in Taskbar?
I am trying to reverse and debug a program but it exists after certain point, tried setting breakpoint on any inter module call that starts with exit or terminate, now here's the weird part :
it does ...
-1
votes
2answers
63 views
How to add a message box to a PE [closed]
So, I have a "simple" question. I have this PE that I want to show a message box when the file is launched. How can I patch the file and make the window? Thanks!
0
votes
1answer
82 views
Can GUI elements of a running program be found/located in memory?
Is it possible for a particular GUI element of a running program (on Windows platform) to be located in memory, such as a text element from a dialog box? For example, locating title text of a drop-...
0
votes
1answer
82 views
Possible to get address of DRIVER OBJECT programmatically?
I am looking into getting the address of a dispatch routine. For example, I can get it with windbg easily like so:
0: kd> !drvobj HEVD 2
Driver object (ffffa70752fdbe30) is for:
\Driver\HEVD
...
1
vote
2answers
99 views
Find a instruction in a binary file (PE) based on a virtual address of a string reference
English is not my first language, so I'm sorry if my text isn't so clear.
I'm trying to program an automatic patcher for a PE binary that should work for multiple versions of this executable. For ...
0
votes
1answer
76 views
I'm trying to understand the SEH mechanism
I'm trying to understand the mechanism of SEH (Structured Exception Handling). I understood how it was recorded and saved in FS: [0] on the previous three instructions. But why add interrupt 1 (step ...
2
votes
1answer
75 views
__security_cookie for function pointers in Windows 10
I'm curious about this __security_cookie that I keep seeing all over the msvcp140.dll from my Windows 10 x64 (insider build.)
Here's an example:
Note that the address for indirect function call (or ...
0
votes
3answers
116 views
Injecting C++ code, while also maximizing compatibility with other injections
Using the New Vegas Script Extender C++ API for Fallout New Vegas, I am able to write to the process' memory directly at runtime through a .dll plugin that's loaded by the NVSE injector. But it is not ...
1
vote
0answers
49 views
How to identify the NonPagedPool Start Memory address from a memory dump
I need to find the memory address where starts the NonPagedPool. I saw some people doing it with Rekall, but I'm having a lot of problems with it.
Is that possible with Volatility ?
Tks
1
vote
3answers
122 views
How to find the starting address of text section of a DLL inside a process? (64 bit)
There was a question about this a year ago, but the answer doesn't explain how to do it in C/C++:
How to find start of .text section?
I'm not talking about module start address, which we can get ...
0
votes
0answers
75 views
injecting through APC using LdrLoadDll fails on `CiValidateImageHeader`
I've encountered an image validation error while trying to inject dll from
driver which add apc task to be performed by alertable thread. the function task include calling to LdrLoadDll with the ...
1
vote
2answers
94 views
Does the loader fill the IAT table of an .exe in load time by checking the corresponding export tables or during run time?
I came upon this question :
Can we hook the Nt or Zw functions using IAT hooking, or just inline hooking?
and it got me wondering, lets say for some reason some function was not in the IAT of our ...
0
votes
1answer
149 views
Can we hook the Nt or Zw functions using IAT hooking, or just inline hooking?
So i was trying to hook the ZwQuerySystemInformation or NtZwQuerySystemInformation using IAT, but i found out that these are not inside the IAT inside the memory nor in the PE file
but maybe i am not ...
2
votes
1answer
90 views
How to hide a process from all the methods of getting the list of processes?
So it seems that there are a lot of ways of getting the process list, although I'm not sure whether in the low level do they acquire them from same place or not
so these are the ways i know :
...
0
votes
0answers
58 views
What's the point of changing the CS register and can any process do this?
So i was reading this article :
http://waleedassar.blogspot.com/2012/07/wow64-user-mode-system-calls-hooking.html
which explains the wow64, the part that we do a far jmp and change the CS register ...
0
votes
1answer
111 views
Why address 7FFE0308 always gets compared in 64bit applications before making a syscall in Ntdll?
So there was a question asked before about this :
What are the difference syscall and int 0x2E instructions?
and it has two answer, one says that is just a way to check if we are in a 32 bit or 64 ...
1
vote
1answer
62 views
What is the ending bytes in the MOV instruction in 32 bit applications in windows? (B8 mov)
So i just compared NTterminateProcess between 32 and 64 bit version of a program, and the mov instruction which moves the syscall into eax is almost the same, both 5 byte, (both the B8 mov) but the ...
0
votes
1answer
60 views
PE Header: What do SizeOfHeapCommit and SizeOfHeapReserve do?
SizeOfHeapReserve and SizeOfHeapCommit are in the optional header of windows executables. They are set to 0x100000 and 0x1000 respectively in most executables (my firefox has 0x40000 as reserve for ...
0
votes
0answers
71 views
How to research the executable file of a game written using the Unreal Engine?
I want to make changes to the gameplay of a game written using the Unreal Engine.
To do this, I need to find the function that interests me, embed my DLL in the game process, and change the pointers.
...
1
vote
1answer
45 views
What does BindImageEx actually do?
Docs.
If I understand this correctly, this function pre-computes virtual addresses of imported DLLs and writes them to the IAT of an image (provided that BIND_NO_UPDATE is not set as parameter). My ...
1
vote
1answer
72 views
Getting started with RE, with eventually goal being able to make a keygen [closed]
I want to get started in RE and eventually want to be able to figure out how to calculate a serial from a username/license number from program number, etc... (meaning the software tests the serial ...
2
votes
1answer
35 views
Partially correctly decoded strings from pkware zip with known plaintext
I have a password-protected zip file, where the paths and filenames of each file are encrypted using PKWARE encryption.
The password is known and correct, and so is the encryption algorithm.
I also ...
-1
votes
1answer
59 views
malware analysis [closed]
I tried to use process monitor to find out what program 4.exe did on my system. However, I could not find what changes were made.
I believe that this program modifies some files and the registry, but ...
0
votes
1answer
144 views
Info on ProcMon from SysInternals
I need help. I am reversing Procmon64.exe file.
It drops procmon.Sys filesystem minifilter driver which does monitoring.
Question:
I need to know if filtering of events is done in user-mode or ...
0
votes
1answer
79 views
The executable file makes a unique ID from each individual PC. Can anyone decipher from where the file makes these unique IDs?
The file generates random unique ID. It says hardware ID but I couldn't find it in product key, BIOS serial number or anywhere. I used IDA but I couldn't get from where the file creates the code. Even ...
2
votes
1answer
85 views
change PE file icon without re-signing the file all over again
Is there any option to set new icon for a signed PE executable in windows without re-signing it again. This means that the icon image, although fully assimilated to the PE file, won't change the hash ...
5
votes
1answer
275 views
Microsoft Edge and it's related processes may have turned protected in windows 10 1903
It seems like driver based injection using APC calls fails on MicrosoftEdge and it's related processes (browser_broker.exe , MicrosoftEdgeCP.exe and MicrosoftEdge.exe).
Looking into the problem, it ...
1
vote
1answer
128 views
Finding out what calls win32u.dll functions
There's a button which, when clicked, writes some data to the clipboard.
I'm trying to call the function this button executes using DLL Injection.
I managed to find the function in win32u.dll which ...
0
votes
1answer
226 views
Dump value of register using frida
I'm new with frida and came to this problem.
I have dll that I want to reverse engeneer(there are no debug symbols). Specifically I want to dump some data from a function. So I have this big function ...
0
votes
1answer
36 views
Exported DLL function has only stdcall with some offset
I am quite new to reverse engineering. I have opened .dll (x86) in IDA Pro and I have noticed few exported functions. The issue is that all of them looks like this:
IDA pseudocode:
int __stdcall ...
1
vote
1answer
36 views
What does -c mean in this Windbg Command Syntax?
kd> u win32k!impPsIsThreadTerminating+0xe4-c L5
| \ \ \ \ \
/ \ \ \ \ \
/ \ \ \ \ \
...
0
votes
2answers
67 views
Find Target to Call Dword Ptr in 16-bit Windows with IDA Pro
Looking for suggestions on steps that could be used to identify what code would get executed at call dword ptr es:[bx+0Ch] from static analysis.
cseg04:3044 loc_105D4: ; ...
1
vote
1answer
56 views
Find Reference To Resource String In Windows 3.1 16-bit DLL with IDA Pro
Experimenting Visual Basic 4 in DosBox + Windows 3.1 running on Windows 10. While I have installed SHARE.exe from MS-DOS 6.22 and it seems to run OK, it still fails to detect it.
The error I get is : ...
1
vote
0answers
55 views
Downgrade HTTPS (strip SSL ) to HTTP on Windows (if possible) [closed]
Long Question: I have an Android app: https://transfer.sh/mY240/com.phonegap.voyo.apk
which connects to an API: http://www.24ur.com/lbin/WebApp/Popplus/Android.php
the problem is the api authors are ...
