Questions tagged [windows]
Windows refers to the Microsoft Windows series of operating systems.
729
questions
0
votes
0answers
11 views
Reverse enginiring Samsung Quick share uwp app
Hello i want to make the samsung quick share to work on my PC witch is not samsung so wich dll file to look to reverse engeniere to bypass that restriction and how to get full access to uwp folder ...
0
votes
0answers
10 views
How to debug a .NET windows service: "Cannot start service from the command line or a debugger"
I have a .NET windows service which I can stop and run through Process Hacker.
I can also view it's code with dnSPY.
I tried to debug it without a success by trying to attach to the process.
I wanted ...
-1
votes
0answers
23 views
How can I Bypass the dongle protection for this setup file? [closed]
I have this software that needs to have a dongle for the software to be installed. I do have the dongle but it's used on our radio computer since we use this program to play our audio on our station ...
0
votes
2answers
45 views
Why windbg skips syscall on kernel mode?
I have a VM running windows with notepad open, I did list the modules with lm:
start end module name
00007ffc`60fb0000 00007ffc`60fe2000 vertdll (deferred) ...
2
votes
1answer
141 views
How to propagate re-typed variables to functions signatures automatically?
In the Ghidra decompiler, after applying a type to a function parameter, the compiler uses that type information to provide better decompilation within the function. When that parameter is used in a ...
0
votes
0answers
27 views
Immunity Debugger not running on Windows 10
I'm experiencing some issues with Immunity Debugger where when I'm ready to run the program, I'll push the "play/start" button and nothing will happen.
I've gone through the process already ...
0
votes
0answers
44 views
How are programs like 'StartAllBack' and 'T-Clock' developed?
There are many programs like StartAllBack and its predecessor StartIsBack which somehow modifies different aspects of Windows Shell (explorer.exe).
How are these hook points discovered in the first ...
0
votes
0answers
42 views
Remote debugging with Binary Ninja on Windows possible?
Quick background -- I cannot start the .exe from a debugger; I need to attach after the fact. Binary Ninja's debugging plugin only allows attaching to a remote debug server and not a process. The ...
0
votes
2answers
161 views
Why are certain functions from kernel32.dll always imported?
I've been noticing this for a while. Functions like IsDebuggerPresent and GetModuleHandle are always present in a binary's import directory structure. I assume is the Window's dynamic linker, but ...
3
votes
0answers
41 views
Is it possible to fake being joined to a domain in Windows 10?
I'm dealing with a malware sample from a pentest that will only execute properly if the system is a member of the target organization's Windows Active Directory domain.
Rather than standing up my own ...
0
votes
1answer
165 views
How to unpack Armadillo protected software using x64dbg?
I am planning to reverse-engineer a Windows executable that has been protected with Armadillo.
When I put the executable through Detect It Easy, the results show that the executable was protected with ...
0
votes
1answer
86 views
Windows User Identification / HWID Limiting
I've been playing a game that has an HWID limit and a bunch of other limitations, such as:
a) Cannot be ran in a VM
b) Cannot be ran using Sandboxie and other Sandbox environments
c) Limits 3 ...
0
votes
1answer
128 views
How do I interpret this double offset?
While looking at that old game I've found a class CStr that is used in an unusual (to me) manner. Most of the times a member of CStr is used, it's done as follows. In both cases, this is a CStr *.
...
0
votes
0answers
24 views
How to extract an AutoIT script when tools fail to extract it?
Lets say you have a Autoit malware (windows executable, autoit v3), and you want to extract the script from it. But tools such as exe2aut fail to extract it.
What would you do? is there any place in ...
0
votes
2answers
166 views
How to prevent File Modification in C++
so i want to protect my software against reverse-engineering and i want to add checksum verification to prevent patching the binary but the problem that if i added a checksum verification the binary ...
0
votes
1answer
87 views
Change manifest file using ResourceHacker CLI
I want to automate some manifest file changes (change requestedExecutionLevel level to requireAdministator from asInvoker) so I have to use ResourceHacker CLI.
I have managed to extract the resources ...
0
votes
1answer
21 views
Cant Save .exe using reflixil and Red Gate Reflector 10.3
First off all im pretty new to Reverse Engineering.
Im Stuck on Saving my Project.
When i want to save the Assembly as .exe file Reflexil says cant save, the specified Method is not supported.
I tried ...
1
vote
0answers
22 views
Send file or non-printable character in Immunity Debugger arguments
I am a beginner in Reverse Engineering.
I am on Windows and using Immunity Debugger.
I would like to send my payload on the .exe file.
The payload contains non-printable characters.
How I can launch ...
0
votes
1answer
89 views
Proxy dll doesn't load the original dll
I have relatively simple code here for the proxy DllMain() function:
BOOL APIENTRY DllMain(HMODULE hDll, DWORD reason, LPVOID reserved)
{
if (reason != DLL_PROCESS_ATTACH) {
return TRUE;
}
...
1
vote
2answers
82 views
Can't figure out a crash in IDA "The memory could not be read -> 00000710 (exc.code c0000005, tid 20612)"
I'm trying to debug out a game. Basically, the Steam version works perfectly but the GOG version (which is 8kb smaller) has an annoying problem where for some people (which happen to be me) the game ...
0
votes
0answers
60 views
Ghidra: Identify and display a struct broken into multiple smaller fields
Me vs the 90s game, part two.
I'm trying to figure out how the game detects the current date, since that part doesn't work correctly anymore. At some point, GetLocalTime() from kernel32.dll gets ...
0
votes
0answers
26 views
There is a course in which they teach you to use WinAFL?
I would like to know if there is a course that begins in a basic way, such as how to use winAFL to find bugs in app desktop.
0
votes
1answer
311 views
How to find main() of Windows EXE with Ghidra?
I'm new to Ghidra, my goal is to add localizations for a small EXE program. The program was written in Visual Studio and has Russian dialogs, which I like to convert to English.
I've loaded the EXE ...
-1
votes
1answer
54 views
How to find bugs in a modern desktop application with reverse enginnering?
I would like to clarify the context for the question: I have studied different types of exploiting but all the studies I have carried out were with command line programs and with functions that I ...
0
votes
0answers
26 views
How to replace the modified/corrupted module image on the original in the memory dump
I'm analyzing a windows kernel crash. I have instrumented “USBPORT.sys" kernel module for collecting metrics. I named the instrumented version of the module "TARGET_MODULE". After I ...
0
votes
0answers
92 views
What kind of code creates this function call pattern?
While using WinDbg: u/uf to disassemble functions in ntoskrnl.exe there are functions that are used in system calls and exception handling that have these weird function call patterns and I can't ...
4
votes
1answer
188 views
Fixing/recompiling a heavily control flow obfuscated function
I've recently come across a binary that has been obfuscated with a very obscure protection.
Obfuscation
From what I understand, the obfuscator is effective in several ways.
Multiple JMPs via relative ...
1
vote
1answer
93 views
Want to use win API hooking to detect wmi query string? But can't find IWbemServices::ExecQuery in fastprox.dll
I want to implement WMI query detection function using apimon plugin in sandbox https://github.com/tklengyel/drakvuf
To do it,I have to get the DLL symbol file.
But I can't locate the IWbemServices::...
0
votes
0answers
36 views
Is it possible to Direct3D 9 debug DLL in an app using the release version
I have an application using d3d9.dll, but I want to figure out which functions it calls to gain insight.
Since online tools I have found are incompatible with my app (32-bit d3d9),
is it instead ...
0
votes
1answer
61 views
CreateFileA returning invalid handle when file exists
I was working on a practice binary. It opens the file at C:/WINDOWS/system32/filename#123.dat, if the file does not exist, the check compares the result to -1 (An invalid handle). However, even after ...
1
vote
0answers
48 views
Reversing Logitech G933 Battery Charge Values
I have a Logitech G933 headset. I replaced the stock battery with a larger capacity. The headset now lasts many hours longer than it was originally designed, and the software is configured to give ...
2
votes
1answer
115 views
How to get thread start address in Windows?
I'm writing thread finder in module. My goal is find all threads in process and find threads currently working address locations. Like image on below. I do this goal with NtQueryInformationThread API.
...
1
vote
1answer
68 views
Identifying/debugging code parts responsible for features in Windows
New to the area, i am trying to identify the code responsible for example for the search functionality in Windows when you start typing in the start menu.
What are some generic ways of identifying the ...
1
vote
1answer
54 views
Why is process object is shown as desktop object in nt!_object_type
I try to extract the object type of notepad.exe in windbg but the nt!_object_type is showing it as Desktop object instead of Process object.
Any idea why is it so?
4: kd> !process 0 0 notepad.exe
...
0
votes
0answers
135 views
Windows time travel debugging performance bottleneck
First of all I wan to be clear, that this question is not about the collection performance, but indexing performance.
What is the performance bottleneck of the indexing step?
Some context:
Action in ...
2
votes
1answer
36 views
Why some process has empty nt!_object_type
I try to extra the nt!_object_type of notepad.exe process. But seems like it's empty. Is it some process has no object type?
Correction for my screenshot above for using the EPROCESS address to ...
1
vote
1answer
96 views
Run ntoskrnl.exe with qemu
We can run linux and similar unix kernels uing qemu -kernel parameter. Is there any way to do the same with NT kernel? I could not find a way to test even reactos kernelwith qemu.
Also can .efi files ...
0
votes
1answer
31 views
Can't add tracing in IDA, showing it in gray
I added read/write trace to a program. I was able to record the trace with IDA for the first time.
When I run it again, it didn't work.
I tried to do what I did on the first time, adding the read/...
1
vote
1answer
81 views
How to load modules symbols to IDA while debugging a process
I am debugging a program that I compiled.
This program calls SetWindowTextW.
When I am debugging it with IDA I can step into this function, but it doesn't recognize anything there:
If I will load ...
1
vote
0answers
33 views
On Windows, when is a PTE a VAD prototype PTE (with address 0xFFFFFFFF0000) instead of a prototype-pointer PTE?
I have reviewed several sources on this PTE type, including Windows internals and the following:
http://blog.rekall-forensic.com/2014/10/windows-virtual-address-translation-and.html https://thalium....
1
vote
0answers
21 views
Whats the difference between a MiNotMapped PFN entry with all 1s, and a MiNonCached PFN entry with all 0s and a 0 PteAddress?
On host (UEFI legacy mode):
lkd> !pfn 0xf0
PFN 000000F0 at address FFFFFA8000002D00
flink FFFFFFFFFFFFFFFF blink / share count FFFFFFFFFFFFFFFF pteaddress FFFFFFFFFFFFFFFF
...
2
votes
0answers
76 views
How to disassemble win32 function RegSetValueExW?
I have opened up advapi32.dll in IDA and found out that RegSetValueExW is just a jump to RegSetValueExW_0. And RegSetValueExW_0 seems to be an extern.
How do I actually disassemble RegSetValueExW_0?
3
votes
1answer
147 views
Unable to attach into mysterious PID
I have a suspicious process. I found it by ProcessHacker's network tab.
ProcessHacker display the process as Unknown.
The process listening into a constant port number that's also not found by ...
2
votes
1answer
172 views
Extracting strings from binary files (.exe)
This question has been asked quite a lot especially on stackoverflow, but the solutions/replies are not clear or extensive.
What I`m looking for is to build what Strings does from Sysinternals. My ...
2
votes
1answer
107 views
How to find sleep() in ollydbg or IDA or ghidra
I have a program which converts videos from a proprietary format into mp4.
The conversion is very slow and CPU utilization is less than 1%.
I'm able to speed up the conversion process via Cheat Engine'...
1
vote
1answer
126 views
Disassembly call function offset from RIP
I am writing a program where I map an .exe PE file in memory and I "dissect" it.
I am disassembling the .text section of the target executable, using the distorm disassembler.
CALL ...
0
votes
2answers
179 views
Import header files in IDA to get the struct definitions?
I am reversing a program that has a lot of internal structs in it.
The problem is that there are a lot of structs, so i can't import them manually using local types->insert.
Lets say i have some ...
0
votes
1answer
35 views
Find out version of statically linked MFC from an exe
I have an exe with symbols stripped that I am trying to reverse engineer. I know the library is linked with MFC but I don't know which version. (Therefore, I can't use something like FLIRT signatures ...
0
votes
0answers
60 views
Can I reverse engineer original file names?
I'm new to IT and I turned my external hard-drive into a windows boot disc. I managed to recover files with testdisc & photorec_win. The downside is I got more than I bargened for and I have twice ...
1
vote
1answer
82 views
Merging a large number of segments in IDA Pro
I'm working with a memory dump of a protected win32 program. Something causing me a lot of pain is the program being split into roughly 3,000 contiguous small segments (i.e. instead of just .text and ....
