Questions tagged [windows]
Windows refers to the Microsoft Windows series of operating systems.
757
questions
0
votes
0
answers
4
views
Symbol name tcpip!IppInitializePathSet found in windbg but unable to find function IppInitializePathSet in tcpip.sys
I'm debugging windows server 2019 in windbg and I want to find function IppInitializePathSet. However, I can't find the function in IDA but I can find the symbol named tcpip!IppInitializePathSet. How ...
1
vote
1
answer
55
views
x86 weird register call
I am digging with disassembler inside old game (release year 2002) and something is bugging me, I noticed it has a bunch of... questionable instructions. One of the things it does is calling imported ...
- 11
1
vote
0
answers
52
views
x64 Windows: Why is ExAllocatePool stepping on the caller's stack?
I am playing around with windbg on a 64-bit machine and noticed something interesting:
nt!ExAllocatePool:
...
sub rsp, 0xd0
...
mov qword ptr [rsp+0xf8], rbx
Windows only allocated ...
- 11
0
votes
0
answers
47
views
Is there any available source code which is Windows 64 bit compatible that can disassemble binary code?
I'm writing a program that takes as input a single byte of binary (machine code from code segment) and converts it into assembly. I've done some searching online but have yet to find anything helpful. ...
- 1
0
votes
0
answers
24
views
How to reverse an import function?
I'm reversing windows .sys file and an import function RtlLookupEntryHashTable appears in my target functions. I want to know the pseudocode of it. How to achieve this?
.text:00000001C00218C2 ...
0
votes
0
answers
23
views
Need help finding a windows struct
What I know about it:
struct unknown_struct
{
struct _KAPC apc;
struct _KEVENT event;
char unknown[2056];
};
So first a kernel apc struct then a kernel event struct and the total size is ...
1
vote
0
answers
16
views
Getting "Flow analysis was incomplete, some code may be missing" on WinDbg
I wanted to perform static analysis on the Win32 function CreateFileW, so I loaded kernel32.dll using WinDbg and perform the command uf kernel32!CreateFileW.
But I am seeing the following output ...
- 145
6
votes
4
answers
3k
views
Do I have to learn computer architecture for underestanding or doing reverse engineering?
I am completely noob in reverse engineering, and I've just started to learn it.
Now I have this question in my mind, that does a reverse engineer use any computer architecture knowledge for doing his/...
- 63
0
votes
0
answers
25
views
windbg shows different instruction at address when you set the breakpoints in 2 different breaks but not the same break (nvd3d9wrapx thunk in user32)
In the first example I only set a breakpoint on user32!CreateWindowExW
In the second example, I set 2 breakpoints at the same time on user32!CreateWindowExW and notepad!WinMain
In the 3rd example I ...
- 235
1
vote
1
answer
50
views
Why is JMP ESP required in buffer overflow?
I was reading this article by Hackers Grimoire on Windows buffer overflow attacks.
The article made sense, except for the part where the author searched for a DLL (.dll) file which contained a JMP ESP ...
- 113
2
votes
1
answer
144
views
How do I unpack a file protected by MPRESS?
I have a file that is protected by MPRESS packer and I want to know how to unpack it on Windows. Is there a specific program for that or something else? I am new to this so every help is appreciated.
- 21
1
vote
0
answers
35
views
How do I read/edit a .xuk file extension?
I am trying to reverse engineer a license key for some software, the company that made it went out of business. In doing so, if you didn't already have the key their $50,000 machines become ...
- 11
0
votes
1
answer
106
views
Function pointer and symbols in Ghidra
I am using Ghidra and I see that when it uses function pointers it never shows the paraments that are being sent to the function(In IDA pro, it always show the parameters). How can I fix that it will ...
- 1
0
votes
1
answer
27
views
ida jumping to address I can't see in driver
When I open this driver in IDA i can't seem to see the instructions that this jmp at 0x1400DC46D jumps to.
I've tried to undefine bytes and re-analyze the function but it then ends up will garbage. ...
- 21
2
votes
1
answer
58
views
Mov instruction from a pointed location at the beginning of a program
I am trying to learn how to read assembly code. So far I have understood the basic instructions. Now I am trying to see if I can understand a dissassembly from a linked executable. So this is an ...
- 143
1
vote
1
answer
29
views
Calling a function with a variable number of args from a proxy DLL
The program I'm messing with has builtin logging. Using a proxy DLL, I managed to activate it by calling the right functions from the real DLL. However, I got stuck at using the actual logging ...
- 149
2
votes
1
answer
108
views
Understanding disassembly information from Visual Studio's dumpbin and GNU's objdump
I usually write my code on Windows, and there are two different types of development environments, each providing their own tools to view the assembly code of an object file(*.obj) or executable (*....
- 143
1
vote
0
answers
31
views
How to convert addresses shown by IDA when statically analyzing a DLL to real addresses in runtime
In a DLL I am trying to reverse there often is a reference to something I believe to be a fixed pointer (like a global var) which looks like dword_10038534. The references I am talking about look like ...
- 11
0
votes
0
answers
16
views
How are system page map entries belonging to process's updated?
Every process has its own PML4 table, and the first 9 bits of the 48-bit virtual address describe the index of a PML4 entry. The first bit of the PML4 index is clear for user code and set for kernel ...
1
vote
1
answer
291
views
How to load a PDB file into x64dbg?
I want to see symbols in the disassembly wherever possible, and I have a PDB file for the .exe I'm debugging, but I can't find a way to load the PDB file from disk. Is it even possible?
- 127
0
votes
1
answer
416
views
Frida hook multiple processes
There was such a situation. I run the frida hook on the process like this:
frida -f '..\hack2\hackme.exe' -l .\start.js
In the script itself I do this
var moduleData = Process.getModuleByName("...
- 13
1
vote
1
answer
40
views
What are these Device Object Characteristics / Flags in Windows 10 ntoskrnl!IopParseDevice
In Windows 10 looking at ntoskrnl!IopParseDevice I'm trying to work out the name / purpose of the flags in this check, which seem to be testing for values in a DEVICE_OBJECT Characteristics property ...
- 1,111
1
vote
2
answers
72
views
IDA show xrefs in .pdata and nothing else
I'm debugging the Windows ARM64 version's EFI (bootaa64.efi).
Using QEMU and GDB I was able to find that bootaa64.efi was stuck in one of the two functions BlKernelSp0SystemErrorHandler and ...
- 177
2
votes
0
answers
23
views
Why does OllyDbg label data segment as read only?
I'm working on this problem: Challenge 53
When compiling with cl c53.c /Fac53.asm /MD in VS2019 X86 Development Console and loading the .exe into OllyDbg, I found OllyDbg labels all segments of c53 as ...
0
votes
0
answers
20
views
How to initiate usb connection as usb display
I'm trying to essentially make an hdmi dummy plug to trick the computer into thinking there is a second monitor. I am planning on doing it by having a raspberry pi pico act as a usb monitor. (much ...
- 1
1
vote
1
answer
71
views
Why is Visual Studio compiling my EXE file with an entry point that is not in the file?
So I am trying to open my test app EXE file in ollydbg to study the assembly, the stack, registers and all that stuff for educational purposes and it gives me this message saying that the entry point ...
- 11
0
votes
0
answers
19
views
How to download previous releases that were published on Windows Store?
Often it's useful when Reverse Engineering to compare releases to one another.
Windows Store has previously been unpopular, but is getting increasing use.
Utilities like https://github.com/microsoft/...
- 101
1
vote
1
answer
114
views
Instructions to compare two strings
I made a list of which instructions compare two strings in disassembly so that when I get to intermodular calls in x64dbg, I can simply type this instructions to see if there is a comparison have been ...
1
vote
0
answers
55
views
Reverse engineering unknown data file
I have a set of datafiles that I want to reverse engineer which are used by a software that controls my heating system. I want to extract the commands to then use these commands in my home automation ...
- 11
0
votes
0
answers
31
views
Phoenix Exploit Education, Powershell script not working the error: '-netdev:user: invalid option','vmlinuz-4.9.0-8-amd64': No such file or directory
I tried these 2 scripts to set up phoenix from Exploit-Education but faced the below errors could not find any other script online one was from
https://blog.lamarranet.com/index.php/exploit-education-...
1
vote
1
answer
56
views
funcion calls extern function without body
I wanted to look at how does the Windows API get the size of a file, so I opened kernel32.dll in a disassembler. I searched for GetFileSizeEx, and it seems to call a stub(?), but the disassembler ...
- 25
0
votes
0
answers
178
views
How to identify if an .exe packed by VMProtect has virtualization enabled?
I am interested in reverse engineering a few parts of an .exe application (windows 32-bit executable) that downloads some documents from a server and decrypts them locally in memory.
Using PE EXE ...
0
votes
1
answer
92
views
Understanding the meaning of EBP + 0xffff98b4
I'm currently reverse-engineering an old game from 2003 to extend its functionality. I have now found what I am looking for and since it was written in C++ I'm trying to re-create the used classes. I ...
- 3
0
votes
0
answers
65
views
How can i reconstruct a full PE from a memory injected PE that only has IAT + sections content?
I have a injected PE (kernel mode rootkit to be exact) that only has the IAT table, which basically only stores the addresses of some kernel functions in an array which is referenced inside its code, ...
- 320
-1
votes
1
answer
237
views
Windows reverse engineered?
Have read in some Discord channel, that Windows was reverse engineered. Does anybody here have knowledge about such reverse engineered Windows version? If it really exists, where can it be downloaded?
- 121
1
vote
1
answer
99
views
Windows UI freezes except the debugger itself when a breakpoint is hit in every debuggers I tried on a particular application
I'm trying to "trace" (just setting breakpoint, step in, step over to know how certain things work) an application. But if the application enters suspended state by using breakpoint, every ...
0
votes
1
answer
44
views
One class with different sizes
After looking at some basic examples of how C++ classes are compiled by MSVC, I tried to apply the knowledge to a DLL I'm working on. While searching for a class to start with, I came across
...
- 149
0
votes
1
answer
424
views
How do I get all sections in a PE file using C++?
So I am wondering how can I get all sections and their info from a dumped PE file on the disk, using C++.
I have the entire PE loaded on a buffer, the NT headers, and hopefully the DOS headers.
I need ...
- 28
0
votes
0
answers
35
views
How to redirect connections by an exe file to a specific external ip address
I have an exe program that connects randomly to one of the 4 addresses 188.39.21.82...83...84...85 out of which only 82 works
Currently I blocked the remaining addresses using Windows 10 Firewall ...
- 103
1
vote
1
answer
65
views
Unknown usage of dwLength and SsHandle members in PEB_LDR_DATA
I've been implementing some Windows internals code and when I have tried to document this structure I have not been able to do so because of those two members. I can't find anything about them.
This ...
- 13
0
votes
0
answers
70
views
Reverse engineering Samsung Quick share UWP app
I want to make the Samsung Quick Share app work on my PC which is not from Samsung. So which DLL file would I have to reverse engineer to bypass that restriction, and how to get full access to UWP ...
0
votes
0
answers
152
views
How to debug a .NET windows service: "Cannot start service from the command line or a debugger"
I have a .NET windows service which I can stop and run through Process Hacker.
I can also view it's code with dnSPY.
I tried to debug it without a success by trying to attach to the process.
I wanted ...
- 471
0
votes
2
answers
201
views
Why windbg skips syscall on kernel mode?
I have a VM running windows with notepad open, I did list the modules with lm:
start end module name
00007ffc`60fb0000 00007ffc`60fe2000 vertdll (deferred) ...
- 49
2
votes
1
answer
468
views
How to propagate re-typed variables to functions signatures automatically?
In the Ghidra decompiler, after applying a type to a function parameter, the compiler uses that type information to provide better decompilation within the function. When that parameter is used in a ...
- 195
0
votes
0
answers
98
views
Immunity Debugger not running on Windows 10
I'm experiencing some issues with Immunity Debugger where when I'm ready to run the program, I'll push the "play/start" button and nothing will happen.
I've gone through the process already ...
- 1
0
votes
0
answers
76
views
How are programs like 'StartAllBack' and 'T-Clock' developed?
There are many programs like StartAllBack and its predecessor StartIsBack which somehow modifies different aspects of Windows Shell (explorer.exe).
How are these hook points discovered in the first ...
0
votes
0
answers
150
views
Remote debugging with Binary Ninja on Windows possible?
Quick background -- I cannot start the .exe from a debugger; I need to attach after the fact. Binary Ninja's debugging plugin only allows attaching to a remote debug server and not a process. The ...
- 101
0
votes
2
answers
303
views
Why are certain functions from kernel32.dll always imported?
I've been noticing this for a while. Functions like IsDebuggerPresent and GetModuleHandle are always present in a binary's import directory structure. I assume is the Window's dynamic linker, but ...
- 69
4
votes
1
answer
148
views
Is it possible to fake being joined to a domain in Windows 10?
I'm dealing with a malware sample from a pentest that will only execute properly if the system is a member of the target organization's Windows Active Directory domain.
Rather than standing up my own ...
- 141
0
votes
1
answer
888
views
How to unpack Armadillo protected software using x64dbg?
I am planning to reverse-engineer a Windows executable that has been protected with Armadillo.
When I put the executable through Detect It Easy, the results show that the executable was protected with ...
