Questions tagged [windows]
Windows refers to the Microsoft Windows series of operating systems.
126
questions with no upvoted or accepted answers
5
votes
0
answers
734
views
Page Fault Handler in Windows
Like almost all of my questions, I feel like I'm missing something / I understood something the wrong way, so help me figure out where I'm wrong with this.
When a Page Fault occurs and nt!KiTrap0E ...
- 317
4
votes
0
answers
58
views
Replace a function in a Windows 32-bit binary with a custom C function
I am reverse engineering a Windows game from 1995 using Ghidra, and I'm currently documenting all the decompiled functions. My goal is to replace a function in the original binary with a custom C ...
- 181
4
votes
1
answer
147
views
Why is function in kernel32.dll jumping into a api-ms-win-core stub
I was trying to look into the implementation of GetVersion function in kernel32.dll.
I was surprised to see that the GetVersion thunk is issuing a jump to API-MS-WIN-CORE-SYSINFO-L1-1-0.DLL::...
- 195
4
votes
0
answers
327
views
Finding the correlation of imported dll's and executable vad's of a process
The memorydumps I work with are from a Windows XP SP2 run inside a VirtualBox VM. I aquire the memorydumps with vboxmanage debugvm dumpguestcore --filename dump.vmem. The windows paging is disabled.
...
- 197
3
votes
0
answers
88
views
How can I find out which system functions are used in applications using dynamic loading?
I'm trying to make an application that tries to hook a specific function. but I realized something while working, I can't hook functions of applications that use dynamic loading using the detours ...
- 31
3
votes
0
answers
168
views
How find all kernel functions called by a driver in windows 11
I am working on a highly obfuscated driver that is virtualized. In an attempt to work on this driver I asked a question about some python scripts which turned out not to be effective at all so I ...
- 33
3
votes
0
answers
107
views
Are system dlls like NTDLL and KERNELBASE etc. are always loaded at the same address on a per-session basis?
If I am understanding, code and read only sections of common DLLs are given system-wide section objects for which each process gets its own section view, in order to save physical memory. As such even ...
3
votes
0
answers
211
views
How to disassemble win32 function RegSetValueExW?
I have opened up advapi32.dll in IDA and found out that RegSetValueExW is just a jump to RegSetValueExW_0. And RegSetValueExW_0 seems to be an extern.
How do I actually disassemble RegSetValueExW_0?
- 131
3
votes
0
answers
276
views
Malware analysis - AntiDebugging - Malware slows down the PC while being debugged
As part of my work, I'm debugging a malware found and his behavior is pretty basic after execution:
Being executed
Decrypt a lot of data from memory and obtain a new PE (from memory)
Create a child ...
- 668
3
votes
1
answer
286
views
CreateToolhelp32Snapshot() access denied (while running as admin or even NT AUTHORITY\SYSTEM)
I've come across a troublesome process which refuses to allow CreateToolhelp32Snapshot().
I also noticed that in sysinternals process explorer it shows "Access Denied" for other things too, such as ...
- 129
2
votes
0
answers
50
views
i want to know how to tracing a exe's http responses and log them
I want to "crack" this cheat loader protected by thermedia and I had someone do it before but lost contact with them and, now I would like to learn to do it myself. and they said a basic way ...
- 21
2
votes
0
answers
35
views
Need help extracting AP_Pack .obb files
I'm trying to extract the files for the series of 4 games - Sorcery!, which are in the format .obb.
Thanks to a Hex editor I saw that the .obb was an AP_Pack, and looking for more information on the ...
- 21
2
votes
0
answers
28
views
How is the language of a font glyph determined?
A glyph holds data such as its name and contour points. But how do you determine where the characters of one language end and another begins? Is there a written standard that says language X starts at ...
- 21
2
votes
0
answers
34
views
WinDbg Preview search is not returning results
I am attempting to manually unpack a malware sample. I am using the new WinDbg Preview (only thing that is available to download now). After letting the malware call VirtualAlloc I am trying to search ...
- 131
2
votes
0
answers
35
views
How does Windows Updates determine if the patches are compatible?
I am looking into Microsoft Windows updates, and how they are applied, after extracting the .msu file, we get some .cab files with patches (in PA30 format), and informations on the file attributes, ...
- 151
2
votes
0
answers
68
views
How to decrypt data during runtime before executing and then encrypting it back
I was doing some research and came across the term protectors. From my understanding is they encrypt a file to be protected but run it without an issue. During its execution it is able to decrypt the ...
- 21
2
votes
0
answers
43
views
How to obtain import name from disassembled assembly
I'm trying to create my own tools for reverse engineering PE. I have some assembly codes that I fetched from a clone of objdump for a program. Sometimes I see call instructions such as :
callq *...
- 21
2
votes
0
answers
192
views
Finding the main function on Windows compiled executables
For a C/C++ program compiled on Windows using the x86 architecture, what is the best way to find the main function within disassembled code without relying on signatures such as FLIRT?
I've found ...
- 41
2
votes
0
answers
83
views
x64 Windows: Why is ExAllocatePool stepping on the caller's stack?
I am playing around with windbg on a 64-bit machine and noticed something interesting:
nt!ExAllocatePool:
...
sub rsp, 0xd0
...
mov qword ptr [rsp+0xf8], rbx
Windows only allocated ...
- 21
2
votes
0
answers
48
views
How do I read/edit a .xuk file extension?
I am trying to reverse engineer a license key for some software, the company that made it went out of business. In doing so, if you didn't already have the key their $50,000 machines become ...
- 21
2
votes
0
answers
29
views
Why does OllyDbg label data segment as read only?
I'm working on this problem: Challenge 53
When compiling with cl c53.c /Fac53.asm /MD in VS2019 X86 Development Console and loading the .exe into OllyDbg, I found OllyDbg labels all segments of c53 as ...
2
votes
0
answers
85
views
Reverse engineering unknown data file
I have a set of datafiles that I want to reverse engineer which are used by a software that controls my heating system. I want to extract the commands to then use these commands in my home automation ...
- 21
2
votes
0
answers
122
views
Accessing Windows 10 Feedback Hub Data
I'm trying to make a website that displays the feedback from the Windows 10 Feedback Hub but i have met a roadblock. I'm using Fiddler 4 (Fiddler Everywhere doesn't have support for UWP yet and ...
- 21
2
votes
0
answers
162
views
What is the meaning of call ds:ApiName[registry*constant] in IDA .asm files?
I have a dataset of .ASM files generated by IDA (dont have the corresponding file)
And there are a lot of calls like this :
.text:00637114 5F pop edi
.text:...
- 479
2
votes
0
answers
176
views
Ghidra is mishandling a field access
I have a program which decompiles in Ghidra to include the line
temp_5f2f2f81bc = *(CPedIntelligence **)(&DAT_000010c0 + (longlong)pCVar2);
temp_5f2f2f81bc is a CPedIntelligence*. pCVar2 is a ...
- 121
2
votes
0
answers
124
views
How can I dump the output of this register , the MSR - IA32_VMX_PROCBASED_CTLS2 , to see whether unrestricted guest mode is supported/enabled?
How can I dump the output of this register , the MSR - IA32_VMX_PROCBASED_CTLS2 , to see whether unrestricted guest mode is supported/enabled?
Context is curiosity.
I'm aware that Docker in the ...
- 121
2
votes
0
answers
130
views
How to track events of any software
Softwares use libraries (sdl, wxwidgets, gtk etc.) that handle events.
as keystroke and mouse.
I have a software that when clicking on a button, an annoying noise is reproduced
how do I find the ...
- 121
2
votes
0
answers
412
views
Calling original function that uses unconventional calling convention
I'm using MinHook to hook a static function with the following signature:
float __usercall RadarManager::Add_Blip@<xmm0>(int position@<ecx>, int shape@<edx>, int colorId, float ...
- 133
2
votes
0
answers
5k
views
Invalid Win32 application/Not a valid Exe
I am currently trying to reverse a program that is EXE format, and I believe written and compiled with Microsoft Visual C++ 2010. The end goal is to map the executables functions, and find a method to ...
- 123
2
votes
0
answers
631
views
How get a full memory dump of a running services.exe instance?
How can I get a full memory dump from a services.exe process on Windows 8.1 x64?
- 121
2
votes
0
answers
690
views
Debugging digitally signed executable
I'm having trouble debugging a win32 executable file under Windows 7. I've tried using ollyDbg and x64dbg: the former simply does nothing, while the latter complains with an "Error starting process (...
- 21
2
votes
0
answers
462
views
How allocate memory on Kernel mode by windbg?
How allocate memory on Kernel mode by windbg?
I use .dvalloc on user mode but not working on kernel mode
thanks.
- 121
2
votes
0
answers
844
views
Attach to specific process using IDA + WINDBG in kernel debugging
I asked this question at the StackOverflow website and they referenced me here.
(Previous topic: https://stackoverflow.com/questions/27917592/attach-to-specific-process-using-ida-windbg-in-kernel-...
- 668
2
votes
0
answers
1k
views
WinDbg is unable to communicate with the target after some time
Host and target are both Windows 7 x64.
The session goes well, but sometimes after 15-20 minutes the target freezes (like a break point was hit), but WinDbg reports that the debuggee is running and it ...
- 317
2
votes
0
answers
1k
views
Map virtual addresses to physical addresses
I know how to translate a virtual address to a physical address, but is it possible to take one desired VA and if you detect that it's PTE (or PDE or PTPE or PML4E) is not present to actually map it ...
- 317
2
votes
0
answers
2k
views
Getting info for undocumented APIs called by StartServiceCtrlDispatcher
I'm trying to understand the inner workings of StartServiceCtrlDispatcher. Specifically, I'm trying to figure out how it determines if its being called from the SCM. So I write a simple service in C# ...
- 325
2
votes
0
answers
190
views
Reassembling Silverlight runtime
I'm trying to insert some instrumentation into libraries such as System.Windows.Browser.dll.
I tried to use ildasm+ilasm and Reflexil and both failed - reassembled library causes browser crashes, ...
- 21
2
votes
1
answer
59
views
Capture and Replay
I was wondering if it was possible to create a python script that is able to capture and replay the instructions executed by a windows program for in depth analysis.
- 49
1
vote
0
answers
33
views
How to develop an anti-debug library which allow users to debug their own programs but not the library?
I'm going to publish a library which guarded by anti-debug ,(ptrace_trackme for Linux and isDebuggerPresent for windows).
The down side of this library is: users would be abled to debug their own ...
- 81
1
vote
0
answers
59
views
IDA pro Error how to resolve this error
52C187F5: The instruction at 0x52C187F5 referenced memory at 0x4. The memory could not be read -> 00000004 (exc.code c0000005, tid 672)
How to Solve this.
I have seen sandbox reports in those the ...
- 31
1
vote
0
answers
132
views
x32dbg : exe with different code address when running
I have a 32 bits exe that works only when there is a specific usb flash disk inserted. On my new laptop, I only have a single USB port, so I want to make it works without the original key, or from a &...
- 141
1
vote
1
answer
237
views
Reverse Engineering Go obfuscated binaries
I have been trying to understand the working of this go malware by reversing it, which can be found here , so basically this stuff takes a shellcode as an input, and converts it to an exe or dll file, ...
- 11
1
vote
0
answers
42
views
Is there any way to get old Windows kernel drivers?
I'm working through "Practical Reverse Engineering" and absolutely loving it so far. However, some of the exercises involve "decompiling" some Windows kernel files (like ...
- 11
1
vote
0
answers
292
views
c000001d (Illegal instruction)
My Windows crashed, don't understand it shows 'Illegal instruction' on a simple 'strlen' instruction:
*******************************************************************************
* ...
- 111
1
vote
0
answers
74
views
How to get the call stack of WinAPI functions?
Yesterday, I noticed an answer to a question about the purpose of a certain undocumented function, which is a call stack (including the DLL library) for this function, This got me interested in the ...
- 15
1
vote
0
answers
56
views
Is there any available source code which is Windows 64 bit compatible that can disassemble binary code?
I'm writing a program that takes as input a single byte of binary (machine code from code segment) and converts it into assembly. I've done some searching online but have yet to find anything helpful. ...
- 11
1
vote
0
answers
61
views
How to reverse an import function?
I'm reversing windows .sys file and an import function RtlLookupEntryHashTable appears in my target functions. I want to know the pseudocode of it. How to achieve this?
.text:00000001C00218C2 ...
- 171
1
vote
0
answers
38
views
Need help finding a windows struct
What I know about it:
struct unknown_struct
{
struct _KAPC apc;
struct _KEVENT event;
char unknown[2056];
};
So first a kernel apc struct then a kernel event struct and the total size is ...
1
vote
0
answers
61
views
windbg shows different instruction at address when you set the breakpoints in 2 different breaks but not the same break (nvd3d9wrapx thunk in user32)
In the first example I only set a breakpoint on user32!CreateWindowExW
In the second example, I set 2 breakpoints at the same time on user32!CreateWindowExW and notepad!WinMain
In the 3rd example I ...
- 285
1
vote
0
answers
80
views
How to convert addresses shown by IDA when statically analyzing a DLL to real addresses in runtime
In a DLL I am trying to reverse there often is a reference to something I believe to be a fixed pointer (like a global var) which looks like dword_10038534. The references I am talking about look like ...
- 11