Questions tagged [windows]
Windows refers to the Microsoft Windows series of operating systems.
141
questions with no upvoted or accepted answers
5
votes
1
answer
116
views
Replace a function in a Windows 32-bit binary with a custom C function
I am reverse engineering a Windows game from 1995 using Ghidra, and I'm currently documenting all the decompiled functions. My goal is to replace a function in the original binary with a custom C ...
- 191
5
votes
0
answers
764
views
Page Fault Handler in Windows
Like almost all of my questions, I feel like I'm missing something / I understood something the wrong way, so help me figure out where I'm wrong with this.
When a Page Fault occurs and nt!KiTrap0E ...
- 317
4
votes
0
answers
328
views
Finding the correlation of imported dll's and executable vad's of a process
The memorydumps I work with are from a Windows XP SP2 run inside a VirtualBox VM. I aquire the memorydumps with vboxmanage debugvm dumpguestcore --filename dump.vmem. The windows paging is disabled.
...
- 197
3
votes
0
answers
118
views
How can I find out which system functions are used in applications using dynamic loading?
I'm trying to make an application that tries to hook a specific function. but I realized something while working, I can't hook functions of applications that use dynamic loading using the detours ...
- 31
3
votes
0
answers
203
views
How find all kernel functions called by a driver in windows 11
I am working on a highly obfuscated driver that is virtualized. In an attempt to work on this driver I asked a question about some python scripts which turned out not to be effective at all so I ...
- 33
3
votes
0
answers
168
views
Are system dlls like NTDLL and KERNELBASE etc. are always loaded at the same address on a per-session basis?
If I am understanding, code and read only sections of common DLLs are given system-wide section objects for which each process gets its own section view, in order to save physical memory. As such even ...
3
votes
0
answers
271
views
How to disassemble win32 function RegSetValueExW?
I have opened up advapi32.dll in IDA and found out that RegSetValueExW is just a jump to RegSetValueExW_0. And RegSetValueExW_0 seems to be an extern.
How do I actually disassemble RegSetValueExW_0?
- 131
3
votes
0
answers
276
views
Malware analysis - AntiDebugging - Malware slows down the PC while being debugged
As part of my work, I'm debugging a malware found and his behavior is pretty basic after execution:
Being executed
Decrypt a lot of data from memory and obtain a new PE (from memory)
Create a child ...
- 668
3
votes
1
answer
333
views
CreateToolhelp32Snapshot() access denied (while running as admin or even NT AUTHORITY\SYSTEM)
I've come across a troublesome process which refuses to allow CreateToolhelp32Snapshot().
I also noticed that in sysinternals process explorer it shows "Access Denied" for other things too, such as ...
- 129
2
votes
1
answer
162
views
Marking DAT section as shellcode in ghidra
I have a binary that loads a DAT section as code (calls ((code **) DAT_something)(0, 2)), and I'd like to be able to disassemble the DAT_something data region. Currently, when looking at the ...
- 121
2
votes
0
answers
54
views
i want to know how to tracing a exe's http responses and log them
I want to "crack" this cheat loader protected by thermedia and I had someone do it before but lost contact with them and, now I would like to learn to do it myself. and they said a basic way ...
- 21
2
votes
0
answers
62
views
Need help extracting AP_Pack .obb files
I'm trying to extract the files for the series of 4 games - Sorcery!, which are in the format .obb.
Thanks to a Hex editor I saw that the .obb was an AP_Pack, and looking for more information on the ...
- 21
2
votes
0
answers
29
views
How is the language of a font glyph determined?
A glyph holds data such as its name and contour points. But how do you determine where the characters of one language end and another begins? Is there a written standard that says language X starts at ...
- 21
2
votes
0
answers
40
views
WinDbg Preview search is not returning results
I am attempting to manually unpack a malware sample. I am using the new WinDbg Preview (only thing that is available to download now). After letting the malware call VirtualAlloc I am trying to search ...
- 131
2
votes
0
answers
40
views
How does Windows Updates determine if the patches are compatible?
I am looking into Microsoft Windows updates, and how they are applied, after extracting the .msu file, we get some .cab files with patches (in PA30 format), and informations on the file attributes, ...
- 151
2
votes
0
answers
125
views
How to decrypt data during runtime before executing and then encrypting it back
I was doing some research and came across the term protectors. From my understanding is they encrypt a file to be protected but run it without an issue. During its execution it is able to decrypt the ...
- 21
2
votes
0
answers
47
views
How to obtain import name from disassembled assembly
I'm trying to create my own tools for reverse engineering PE. I have some assembly codes that I fetched from a clone of objdump for a program. Sometimes I see call instructions such as :
callq *...
- 21
2
votes
0
answers
319
views
Finding the main function on Windows compiled executables
For a C/C++ program compiled on Windows using the x86 architecture, what is the best way to find the main function within disassembled code without relying on signatures such as FLIRT?
I've found ...
- 41
2
votes
0
answers
92
views
x64 Windows: Why is ExAllocatePool stepping on the caller's stack?
I am playing around with windbg on a 64-bit machine and noticed something interesting:
nt!ExAllocatePool:
...
sub rsp, 0xd0
...
mov qword ptr [rsp+0xf8], rbx
Windows only allocated ...
- 21
2
votes
0
answers
51
views
How do I read/edit a .xuk file extension?
I am trying to reverse engineer a license key for some software, the company that made it went out of business. In doing so, if you didn't already have the key their $50,000 machines become ...
- 21
2
votes
0
answers
31
views
Why does OllyDbg label data segment as read only?
I'm working on this problem: Challenge 53
When compiling with cl c53.c /Fac53.asm /MD in VS2019 X86 Development Console and loading the .exe into OllyDbg, I found OllyDbg labels all segments of c53 as ...
2
votes
0
answers
104
views
Reverse engineering unknown data file
I have a set of datafiles that I want to reverse engineer which are used by a software that controls my heating system. I want to extract the commands to then use these commands in my home automation ...
- 21
2
votes
0
answers
125
views
Accessing Windows 10 Feedback Hub Data
I'm trying to make a website that displays the feedback from the Windows 10 Feedback Hub but i have met a roadblock. I'm using Fiddler 4 (Fiddler Everywhere doesn't have support for UWP yet and ...
- 21
2
votes
0
answers
222
views
What is the meaning of call ds:ApiName[registry*constant] in IDA .asm files?
I have a dataset of .ASM files generated by IDA (dont have the corresponding file)
And there are a lot of calls like this :
.text:00637114 5F pop edi
.text:...
- 519
2
votes
0
answers
211
views
Ghidra is mishandling a field access
I have a program which decompiles in Ghidra to include the line
temp_5f2f2f81bc = *(CPedIntelligence **)(&DAT_000010c0 + (longlong)pCVar2);
temp_5f2f2f81bc is a CPedIntelligence*. pCVar2 is a ...
- 121
2
votes
0
answers
127
views
How can I dump the output of this register , the MSR - IA32_VMX_PROCBASED_CTLS2 , to see whether unrestricted guest mode is supported/enabled?
How can I dump the output of this register , the MSR - IA32_VMX_PROCBASED_CTLS2 , to see whether unrestricted guest mode is supported/enabled?
Context is curiosity.
I'm aware that Docker in the ...
- 121
2
votes
0
answers
131
views
How to track events of any software
Softwares use libraries (sdl, wxwidgets, gtk etc.) that handle events.
as keystroke and mouse.
I have a software that when clicking on a button, an annoying noise is reproduced
how do I find the ...
- 121
2
votes
0
answers
447
views
Calling original function that uses unconventional calling convention
I'm using MinHook to hook a static function with the following signature:
float __usercall RadarManager::Add_Blip@<xmm0>(int position@<ecx>, int shape@<edx>, int colorId, float ...
- 133
2
votes
0
answers
5k
views
Invalid Win32 application/Not a valid Exe
I am currently trying to reverse a program that is EXE format, and I believe written and compiled with Microsoft Visual C++ 2010. The end goal is to map the executables functions, and find a method to ...
- 123
2
votes
0
answers
642
views
How get a full memory dump of a running services.exe instance?
How can I get a full memory dump from a services.exe process on Windows 8.1 x64?
- 121
2
votes
0
answers
707
views
Debugging digitally signed executable
I'm having trouble debugging a win32 executable file under Windows 7. I've tried using ollyDbg and x64dbg: the former simply does nothing, while the latter complains with an "Error starting process (...
- 21
2
votes
0
answers
484
views
How allocate memory on Kernel mode by windbg?
How allocate memory on Kernel mode by windbg?
I use .dvalloc on user mode but not working on kernel mode
thanks.
- 121
2
votes
0
answers
868
views
Attach to specific process using IDA + WINDBG in kernel debugging
I asked this question at the StackOverflow website and they referenced me here.
(Previous topic: https://stackoverflow.com/questions/27917592/attach-to-specific-process-using-ida-windbg-in-kernel-...
- 668
2
votes
0
answers
1k
views
WinDbg is unable to communicate with the target after some time
Host and target are both Windows 7 x64.
The session goes well, but sometimes after 15-20 minutes the target freezes (like a break point was hit), but WinDbg reports that the debuggee is running and it ...
- 317
2
votes
0
answers
1k
views
Map virtual addresses to physical addresses
I know how to translate a virtual address to a physical address, but is it possible to take one desired VA and if you detect that it's PTE (or PDE or PTPE or PML4E) is not present to actually map it ...
- 317
2
votes
0
answers
2k
views
Getting info for undocumented APIs called by StartServiceCtrlDispatcher
I'm trying to understand the inner workings of StartServiceCtrlDispatcher. Specifically, I'm trying to figure out how it determines if its being called from the SCM. So I write a simple service in C# ...
- 325
2
votes
0
answers
193
views
Reassembling Silverlight runtime
I'm trying to insert some instrumentation into libraries such as System.Windows.Browser.dll.
I tried to use ildasm+ilasm and Reflexil and both failed - reassembled library causes browser crashes, ...
- 21
2
votes
1
answer
67
views
Capture and Replay
I was wondering if it was possible to create a python script that is able to capture and replay the instructions executed by a windows program for in depth analysis.
- 49
1
vote
0
answers
50
views
Process stuck on the entry point
I'm trying to patch an old game (1998-ish) that runs on windows 95 and windows XP to make it compatible with windows 11.
The current problem with it is that when running the exe file nothing seems to ...
- 21
1
vote
0
answers
87
views
Where can I find the files from Ghidra symbol tree?
I have decompiled a .dll file with Ghidra. At the left, I see the symbol tree. In the symbol tree, there is a tab imports. This tab contains external .dll files. Where can I find the location of these ...
- 83
1
vote
0
answers
79
views
Inject a MessageBox to the PE file
I'd like to patch some Windows PE file to show just simple MessageBox. Taking into account that the PE in question doesn't import the MessageBoxA function if I'm right that all i need to do is to add ...
- 115
1
vote
0
answers
57
views
Windbg command .call usage and syntax
I'm using Windbg to track all functions that could result in the blue screen errors. My method is to call certain suspects manually through windbg .call command. However, I always got syntax error. ...
- 313
1
vote
0
answers
69
views
How to develop an anti-debug library which allow users to debug their own programs but not the library?
I'm going to publish a library which guarded by anti-debug ,(ptrace_trackme for Linux and isDebuggerPresent for windows).
The down side of this library is: users would be abled to debug their own ...
- 81
1
vote
0
answers
156
views
IDA pro Error how to resolve this error
52C187F5: The instruction at 0x52C187F5 referenced memory at 0x4. The memory could not be read -> 00000004 (exc.code c0000005, tid 672)
How to solve this?
I have seen sandbox reports in those the ...
- 31
1
vote
0
answers
212
views
x32dbg : exe with different code address when running
I have a 32 bits exe that works only when there is a specific usb flash disk inserted. On my new laptop, I only have a single USB port, so I want to make it works without the original key, or from a &...
- 141
1
vote
1
answer
481
views
Reverse Engineering Go obfuscated binaries
I have been trying to understand the working of this go malware by reversing it, which can be found here , so basically this stuff takes a shellcode as an input, and converts it to an exe or dll file, ...
- 11
1
vote
0
answers
58
views
Is there any way to get old Windows kernel drivers?
I'm working through "Practical Reverse Engineering" and absolutely loving it so far. However, some of the exercises involve "decompiling" some Windows kernel files (like ...
- 11
1
vote
0
answers
452
views
c000001d (Illegal instruction)
My Windows crashed, don't understand it shows 'Illegal instruction' on a simple 'strlen' instruction:
*******************************************************************************
* ...
- 111
1
vote
0
answers
88
views
How to get the call stack of WinAPI functions?
Yesterday, I noticed an answer to a question about the purpose of a certain undocumented function, which is a call stack (including the DLL library) for this function, This got me interested in the ...
- 115
1
vote
0
answers
58
views
Is there any available source code which is Windows 64 bit compatible that can disassemble binary code?
I'm writing a program that takes as input a single byte of binary (machine code from code segment) and converts it into assembly. I've done some searching online but have yet to find anything helpful. ...
- 11