Questions tagged [windows]

Windows refers to the Microsoft Windows series of operating systems.

126 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
5 votes
0 answers
734 views

Page Fault Handler in Windows

Like almost all of my questions, I feel like I'm missing something / I understood something the wrong way, so help me figure out where I'm wrong with this. When a Page Fault occurs and nt!KiTrap0E ...
user3002428's user avatar
4 votes
0 answers
58 views

Replace a function in a Windows 32-bit binary with a custom C function

I am reverse engineering a Windows game from 1995 using Ghidra, and I'm currently documenting all the decompiled functions. My goal is to replace a function in the original binary with a custom C ...
Cesar Canassa's user avatar
4 votes
1 answer
147 views

Why is function in kernel32.dll jumping into a api-ms-win-core stub

I was trying to look into the implementation of GetVersion function in kernel32.dll. I was surprised to see that the GetVersion thunk is issuing a jump to API-MS-WIN-CORE-SYSINFO-L1-1-0.DLL::...
caramel1995's user avatar
4 votes
0 answers
327 views

Finding the correlation of imported dll's and executable vad's of a process

The memorydumps I work with are from a Windows XP SP2 run inside a VirtualBox VM. I aquire the memorydumps with vboxmanage debugvm dumpguestcore --filename dump.vmem. The windows paging is disabled. ...
user3365's user avatar
  • 197
3 votes
0 answers
88 views

How can I find out which system functions are used in applications using dynamic loading?

I'm trying to make an application that tries to hook a specific function. but I realized something while working, I can't hook functions of applications that use dynamic loading using the detours ...
DertliSelo's user avatar
3 votes
0 answers
168 views

How find all kernel functions called by a driver in windows 11

I am working on a highly obfuscated driver that is virtualized. In an attempt to work on this driver I asked a question about some python scripts which turned out not to be effective at all so I ...
disharm0niz's user avatar
3 votes
0 answers
107 views

Are system dlls like NTDLL and KERNELBASE etc. are always loaded at the same address on a per-session basis?

If I am understanding, code and read only sections of common DLLs are given system-wide section objects for which each process gets its own section view, in order to save physical memory. As such even ...
EatingTechnobladesRemainsAt3am's user avatar
3 votes
0 answers
211 views

How to disassemble win32 function RegSetValueExW?

I have opened up advapi32.dll in IDA and found out that RegSetValueExW is just a jump to RegSetValueExW_0. And RegSetValueExW_0 seems to be an extern. How do I actually disassemble RegSetValueExW_0?
jafarlihi's user avatar
  • 131
3 votes
0 answers
276 views

Malware analysis - AntiDebugging - Malware slows down the PC while being debugged

As part of my work, I'm debugging a malware found and his behavior is pretty basic after execution: Being executed Decrypt a lot of data from memory and obtain a new PE (from memory) Create a child ...
0xAK's user avatar
  • 668
3 votes
1 answer
286 views

CreateToolhelp32Snapshot() access denied (while running as admin or even NT AUTHORITY\SYSTEM)

I've come across a troublesome process which refuses to allow CreateToolhelp32Snapshot(). I also noticed that in sysinternals process explorer it shows "Access Denied" for other things too, such as ...
Cherona's user avatar
  • 129
2 votes
0 answers
50 views

i want to know how to tracing a exe's http responses and log them

I want to "crack" this cheat loader protected by thermedia and I had someone do it before but lost contact with them and, now I would like to learn to do it myself. and they said a basic way ...
od8m's user avatar
  • 21
2 votes
0 answers
35 views

Need help extracting AP_Pack .obb files

I'm trying to extract the files for the series of 4 games - Sorcery!, which are in the format .obb. Thanks to a Hex editor I saw that the .obb was an AP_Pack, and looking for more information on the ...
Maneki's user avatar
  • 21
2 votes
0 answers
28 views

How is the language of a font glyph determined?

A glyph holds data such as its name and contour points. But how do you determine where the characters of one language end and another begins? Is there a written standard that says language X starts at ...
user3208218's user avatar
2 votes
0 answers
34 views

WinDbg Preview search is not returning results

I am attempting to manually unpack a malware sample. I am using the new WinDbg Preview (only thing that is available to download now). After letting the malware call VirtualAlloc I am trying to search ...
Jason Crosby's user avatar
2 votes
0 answers
35 views

How does Windows Updates determine if the patches are compatible?

I am looking into Microsoft Windows updates, and how they are applied, after extracting the .msu file, we get some .cab files with patches (in PA30 format), and informations on the file attributes, ...
Redouane Red's user avatar
2 votes
0 answers
68 views

How to decrypt data during runtime before executing and then encrypting it back

I was doing some research and came across the term protectors. From my understanding is they encrypt a file to be protected but run it without an issue. During its execution it is able to decrypt the ...
soqq's user avatar
  • 21
2 votes
0 answers
43 views

How to obtain import name from disassembled assembly

I'm trying to create my own tools for reverse engineering PE. I have some assembly codes that I fetched from a clone of objdump for a program. Sometimes I see call instructions such as : callq *...
onerom's user avatar
  • 21
2 votes
0 answers
192 views

Finding the main function on Windows compiled executables

For a C/C++ program compiled on Windows using the x86 architecture, what is the best way to find the main function within disassembled code without relying on signatures such as FLIRT? I've found ...
Soyboii's user avatar
  • 41
2 votes
0 answers
83 views

x64 Windows: Why is ExAllocatePool stepping on the caller's stack?

I am playing around with windbg on a 64-bit machine and noticed something interesting: nt!ExAllocatePool: ... sub rsp, 0xd0 ... mov qword ptr [rsp+0xf8], rbx Windows only allocated ...
Yolo41251263's user avatar
2 votes
0 answers
48 views

How do I read/edit a .xuk file extension?

I am trying to reverse engineer a license key for some software, the company that made it went out of business. In doing so, if you didn't already have the key their $50,000 machines become ...
Xalen's user avatar
  • 21
2 votes
0 answers
29 views

Why does OllyDbg label data segment as read only?

I'm working on this problem: Challenge 53 When compiling with cl c53.c /Fac53.asm /MD in VS2019 X86 Development Console and loading the .exe into OllyDbg, I found OllyDbg labels all segments of c53 as ...
Nicholas Humphrey's user avatar
2 votes
0 answers
85 views

Reverse engineering unknown data file

I have a set of datafiles that I want to reverse engineer which are used by a software that controls my heating system. I want to extract the commands to then use these commands in my home automation ...
fredlcore's user avatar
2 votes
0 answers
122 views

Accessing Windows 10 Feedback Hub Data

I'm trying to make a website that displays the feedback from the Windows 10 Feedback Hub but i have met a roadblock. I'm using Fiddler 4 (Fiddler Everywhere doesn't have support for UWP yet and ...
Dar's user avatar
  • 21
2 votes
0 answers
162 views

What is the meaning of call ds:ApiName[registry*constant] in IDA .asm files?

I have a dataset of .ASM files generated by IDA (dont have the corresponding file) ‌And there are a lot of calls like this : .text:00637114 5F pop edi .text:...
OneAndOnly's user avatar
2 votes
0 answers
176 views

Ghidra is mishandling a field access

I have a program which decompiles in Ghidra to include the line temp_5f2f2f81bc = *(CPedIntelligence **)(&DAT_000010c0 + (longlong)pCVar2); temp_5f2f2f81bc is a CPedIntelligence*. pCVar2 is a ...
cpast's user avatar
  • 121
2 votes
0 answers
124 views

How can I dump the output of this register , the MSR - IA32_VMX_PROCBASED_CTLS2 , to see whether unrestricted guest mode is supported/enabled?

How can I dump the output of this register , the MSR - IA32_VMX_PROCBASED_CTLS2 , to see whether unrestricted guest mode is supported/enabled? Context is curiosity. I'm aware that Docker in the ...
barlop's user avatar
  • 121
2 votes
0 answers
130 views

How to track events of any software

Softwares use libraries (sdl, wxwidgets, gtk etc.) that handle events. as keystroke and mouse. I have a software that when clicking on a button, an annoying noise is reproduced how do I find the ...
jony alton's user avatar
2 votes
0 answers
412 views

Calling original function that uses unconventional calling convention

I'm using MinHook to hook a static function with the following signature: float __usercall RadarManager::Add_Blip@<xmm0>(int position@<ecx>, int shape@<edx>, int colorId, float ...
Neijwiert's user avatar
  • 133
2 votes
0 answers
5k views

Invalid Win32 application/Not a valid Exe

I am currently trying to reverse a program that is EXE format, and I believe written and compiled with Microsoft Visual C++ 2010. The end goal is to map the executables functions, and find a method to ...
RandomHash's user avatar
2 votes
0 answers
631 views

How get a full memory dump of a running services.exe instance?

How can I get a full memory dump from a services.exe process on Windows 8.1 x64?
forbiddenhi's user avatar
2 votes
0 answers
690 views

Debugging digitally signed executable

I'm having trouble debugging a win32 executable file under Windows 7. I've tried using ollyDbg and x64dbg: the former simply does nothing, while the latter complains with an "Error starting process (...
Damian's user avatar
  • 21
2 votes
0 answers
462 views

How allocate memory on Kernel mode by windbg?

How allocate memory on Kernel mode by windbg? I use .dvalloc on user mode but not working on kernel mode thanks.
forbiddenhi's user avatar
2 votes
0 answers
844 views

Attach to specific process using IDA + WINDBG in kernel debugging

I asked this question at the StackOverflow website and they referenced me here. (Previous topic: https://stackoverflow.com/questions/27917592/attach-to-specific-process-using-ida-windbg-in-kernel-...
0xAK's user avatar
  • 668
2 votes
0 answers
1k views

WinDbg is unable to communicate with the target after some time

Host and target are both Windows 7 x64. The session goes well, but sometimes after 15-20 minutes the target freezes (like a break point was hit), but WinDbg reports that the debuggee is running and it ...
user3002428's user avatar
2 votes
0 answers
1k views

Map virtual addresses to physical addresses

I know how to translate a virtual address to a physical address, but is it possible to take one desired VA and if you detect that it's PTE (or PDE or PTPE or PML4E) is not present to actually map it ...
user3002428's user avatar
2 votes
0 answers
2k views

Getting info for undocumented APIs called by StartServiceCtrlDispatcher

I'm trying to understand the inner workings of StartServiceCtrlDispatcher. Specifically, I'm trying to figure out how it determines if its being called from the SCM. So I write a simple service in C# ...
Justin Dearing's user avatar
2 votes
0 answers
190 views

Reassembling Silverlight runtime

I'm trying to insert some instrumentation into libraries such as System.Windows.Browser.dll. I tried to use ildasm+ilasm and Reflexil and both failed - reassembled library causes browser crashes, ...
user3285's user avatar
2 votes
1 answer
59 views

Capture and Replay

I was wondering if it was possible to create a python script that is able to capture and replay the instructions executed by a windows program for in depth analysis.
jjprince's user avatar
1 vote
0 answers
33 views

How to develop an anti-debug library which allow users to debug their own programs but not the library?

I'm going to publish a library which guarded by anti-debug ,(ptrace_trackme for Linux and isDebuggerPresent for windows). The down side of this library is: users would be abled to debug their own ...
prgbenz's user avatar
  • 81
1 vote
0 answers
59 views

IDA pro Error how to resolve this error

52C187F5: The instruction at 0x52C187F5 referenced memory at 0x4. The memory could not be read -> 00000004 (exc.code c0000005, tid 672) How to Solve this. I have seen sandbox reports in those the ...
Satyam Singh's user avatar
1 vote
0 answers
132 views

x32dbg : exe with different code address when running

I have a 32 bits exe that works only when there is a specific usb flash disk inserted. On my new laptop, I only have a single USB port, so I want to make it works without the original key, or from a &...
JayMore's user avatar
  • 141
1 vote
1 answer
237 views

Reverse Engineering Go obfuscated binaries

I have been trying to understand the working of this go malware by reversing it, which can be found here , so basically this stuff takes a shellcode as an input, and converts it to an exe or dll file, ...
Subhajeet 's user avatar
1 vote
0 answers
42 views

Is there any way to get old Windows kernel drivers?

I'm working through "Practical Reverse Engineering" and absolutely loving it so far. However, some of the exercises involve "decompiling" some Windows kernel files (like ...
superzero's user avatar
1 vote
0 answers
292 views

c000001d (Illegal instruction)

My Windows crashed, don't understand it shows 'Illegal instruction' on a simple 'strlen' instruction: ******************************************************************************* * ...
GreenTea's user avatar
  • 111
1 vote
0 answers
74 views

How to get the call stack of WinAPI functions?

Yesterday, I noticed an answer to a question about the purpose of a certain undocumented function, which is a call stack (including the DLL library) for this function, This got me interested in the ...
Int Ver's user avatar
  • 15
1 vote
0 answers
56 views

Is there any available source code which is Windows 64 bit compatible that can disassemble binary code?

I'm writing a program that takes as input a single byte of binary (machine code from code segment) and converts it into assembly. I've done some searching online but have yet to find anything helpful. ...
vSm's user avatar
  • 11
1 vote
0 answers
61 views

How to reverse an import function?

I'm reversing windows .sys file and an import function RtlLookupEntryHashTable appears in my target functions. I want to know the pseudocode of it. How to achieve this? .text:00000001C00218C2 ...
anonymous bear's user avatar
1 vote
0 answers
38 views

Need help finding a windows struct

What I know about it: struct unknown_struct { struct _KAPC apc; struct _KEVENT event; char unknown[2056]; }; So first a kernel apc struct then a kernel event struct and the total size is ...
EatingTechnobladesRemainsAt3am's user avatar
1 vote
0 answers
61 views

windbg shows different instruction at address when you set the breakpoints in 2 different breaks but not the same break (nvd3d9wrapx thunk in user32)

In the first example I only set a breakpoint on user32!CreateWindowExW In the second example, I set 2 breakpoints at the same time on user32!CreateWindowExW and notepad!WinMain In the 3rd example I ...
Lewis Kelsey's user avatar
1 vote
0 answers
80 views

How to convert addresses shown by IDA when statically analyzing a DLL to real addresses in runtime

In a DLL I am trying to reverse there often is a reference to something I believe to be a fixed pointer (like a global var) which looks like dword_10038534. The references I am talking about look like ...
Curious User's user avatar