Questions tagged [windows]
Windows refers to the Microsoft Windows series of operating systems.
815
questions
70
votes
3
answers
14k
views
What is the purpose of 'mov edi, edi'?
I see this instruction in the beginning of several Windows programs.
It's copying a register to itself, so basically, this acts as a nop.
What's the purpose of this instruction?
- 4,755
56
votes
7
answers
153k
views
How to know in which language/technology program (.exe) is written?
How to understand if exe/dll is written in C++/.Net/Java or in any other language. I tried to use Dependency walker but not able to get required information.
- 927
33
votes
5
answers
29k
views
Open source GUI tool for decomposing a PDF
I've been looking for an open-source GUI tool to extract PDF's in an automated way on Windows systems. I've used Didier Steven's tools with great interest for a while, but cannot make sense of how to ...
- 443
30
votes
4
answers
13k
views
Can I statically link (not import) the Windows system DLLs?
I have compiled following C source code in VS2010 console project.
#include <stdio.h>
int main(int argc, char* argv[]){
printf("hello world\n");
return 0;
}
then I used /MT option for ...
- 593
24
votes
2
answers
32k
views
How can I set a breakpoint for a button click?
I am trying to find what a button does, so I want to set a breakpoint to catch button click event. Is that possible?
Any tools or tricks to assist in this?
- 343
24
votes
1
answer
13k
views
What's 'fs:[0]' doing and how can I execute it step by step?
In a 32 bits Windows binary, I see this code:
push next
push fs:[0]
mov fs:[0], esp
int3
...
next:
I see that something happens on the int3 (an error), but I don't understand why,...
- 6,674
23
votes
2
answers
14k
views
How to reverse engineer simple usb device [windows -> linux]
I'd like to reverse engineer my usb beer-can refrigurator, which does connect via USB on windows and via simple GUI tray-tool can set/query temperature.
I was thinking about running virtualboxed ...
- 231
22
votes
1
answer
34k
views
Get the function prototypes from an unknown .dll
I have an unknown .dll from another program which I want to work with. With DLL Export Viewer I was able to find the exported functions.
But to call them I need the information about the parameters ...
- 3,059
21
votes
4
answers
7k
views
Check if exe is 64-bit
How to check if Windows executable is 64-bit reading only its binary. Without executing it and not using any tools like the SDK tool dumpbin.exe with the /headers option.
- 819
21
votes
1
answer
4k
views
Windows Wiki : Books and Tutorials [closed]
This post is for collecting all the best books and tutorials that exist dealing with windows specific reverse engineering techniques and concepts. The content will be added to the Windows wiki. Any ...
20
votes
9
answers
7k
views
Determining if a file is managed code or not
How can I quickly tell if a EXE or DLL I have is managed code or not?
I spent some time recently trying to disassemble a file and then later learned through some traces in the code that I could have ...
- 373
18
votes
5
answers
8k
views
Is there any simple open source Windows packer?
There are great questions here about different types of packers and that is very interesting to me. I would like to try my hand at reverse engineering one. Since I am very new to this, I would like ...
- 183
18
votes
3
answers
12k
views
Are there any tools or scripts for identifying compression algorithms in executables?
I know there are tools for identifying common ciphers and hash algorithms in code, but are there any similar scripts / tools / plugins for common compression algorithms such as gzip, deflate, etc? ...
- 1,252
18
votes
4
answers
6k
views
Server-side Query interception with MS SQL Server
I'm researching into intercepting queries that arrive at the SQL Server 2008 process.
SQLOS architecture is divided in the following system DLLs:
sqlmin.dll: Storage, replication, security features,...
- 283
17
votes
4
answers
4k
views
How can you reliably unpack a Windows driver manually?
When you unpack manually a Windows user-mode executable, you can easily break at its EntryPoint (or TLS), then trace until you reach the original EntryPoint. However that's not possible with a packed ...
- 6,674
17
votes
1
answer
5k
views
COM interface methods
I'm reversing malware and it uses COM, which I evidently don't know. My question is how to find out what method is called using ppv (and objectstublessclient?)
push offset ppv ; Address of ...
- 173
16
votes
4
answers
7k
views
INT 2D Anti-Forensic Method
Inclusion of an INT 2D instruction appears to be a fairly common anti-debugging tactic used by Windows malware authors. From what I understand, it causes a process to act differently when a debugger ...
- 263
16
votes
1
answer
5k
views
What are the Vectored Continue Handlers
Practically everyone knows what Vectored Exception Handlers are, but I couldn't find a lot of information about the similar "Vectored Continue Handlers" and related functions I encountered today, such ...
- 11.7k
15
votes
4
answers
4k
views
Debugging malware that will only run as a service
I'm trying to debug a malware sample that installs to a system as service and then will only start if it starts as a service. Other functions are still available without the service start, like ...
- 153
15
votes
7
answers
11k
views
How to see what data is being transmitted when an application calls home?
Always wondered how it would be possible to see what data is being transmitted back and forth with an application that calls home.
Let's say we emulate the server via host file redirect. Would it be ...
- 153
15
votes
3
answers
22k
views
Difference between DllMain and DllEntryPoint
I have a piece a malware to analyze. It is a DLL according to the IMAGE_FILE_HEADER->Characteristics. I was trying to do some dynamic analysis on it. I have done the following:
Run it with ...
- 491
15
votes
2
answers
407
views
Is there a good reference for COM object signatures?
When doing RE on some Microsoft binaries I run across COM object references all the time. Is there a good central place to translate some of the GUID's that I find to some sort of object type without ...
- 429
14
votes
2
answers
9k
views
windows - Why is the imagebase default 0x400000?
Having stumbled upon this question (and answer): https://stackoverflow.com/questions/2170843/va-virtual-adress-rva-relative-virtual-address on my quest for understanding Windows' PE format, I'm ...
- 585
13
votes
3
answers
2k
views
How to prevent use of Resource editors
There are variety of tools that allow editing the resources of Windows executables.
These tools allow a very easy interface for changing the programs look and feel.
Replacing icons, text, menus can be ...
- 4,755
13
votes
5
answers
18k
views
Freely available resource hacking applications
I am using Resource Hacker as a tool to extract out resources like icon, images, etc. from .dll or .exe file. In addition, I am using it to crack some small Windows application. However, it does not ...
13
votes
2
answers
5k
views
How do the internals of a Windows update security patch work?
Wasn't sure where to ask this on stack exchange, so vote to close if you think it is in the wrong place.
I am analyzing a Windows security patch. Having never examined a windows security patch, and ...
- 1,236
12
votes
2
answers
3k
views
What kind of code would produce this assemby with loads of jump statements?
00EE16CC . E9 DFBB0000 JMP BinFile.00EED2B0
00EE16D1 . E9 64AF0000 JMP <JMP.&MSVCP140D.?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@>
00EE16D6 . E9 15DB0000 JMP BinFile....
- 135
12
votes
5
answers
29k
views
Are there any OllyDbg anti-debug/anti-anti-debug plugins what work with Windows 7 / NT 6.x?
Title says it all. I'm trying to RE a video game which is packed with Themida and the second I attach OllyDbg it crashes. When on XP, I can use StrongOD and PhantOm but neither of these work properly ...
- 223
12
votes
3
answers
934
views
Trying to understand this construct in Dbgv.sys driver for DbgView tool
I'm trying to reverse the Dbgv.sys (x86 kernel driver) for the DbgView tool. It has this sub_10D4A function that is called almost at the beginning of the driver's DriverEntry function. It goes as such:...
- 221
11
votes
3
answers
4k
views
Is there any way to get my own image base without calling any WinAPI functions, such as GetModuleHandle?
Is there any way to get the image base of an .exe without calling WinAPI functions (i.e. imported functions) so that it can't be easily viewed in a disassembler/debugger?
I've been thinking of ...
- 113
11
votes
1
answer
6k
views
Dll injection and GetProcAddress with the winapi
So i just read a little bit about how one would go about for injecting a dll into a running program on Wikipedia (the CreateRemoteThread idea). I followed the steps described and eventually got it ...
- 369
11
votes
2
answers
2k
views
Debugging EXE with TLS
How do I debug an executable that uses TLS callbacks? It's my understanding that these run before my debugger will attach.
- 4,036
11
votes
3
answers
1k
views
What methodology can be used to change code flow atomically during program execution?
I have been reading a lot about the different techniques for Windows API hooking (a technique I'm particularly fascinated by and fond of), and it seems a major problem in implementing a realiable ...
- 398
11
votes
1
answer
356
views
Thread-Switching with PyDbg
I'm having trouble switching from debugging one thread to another in pydbg. I don't have much experience with multithreading, so I'm hoping that I'm just missing something obvious.
Basically, I want ...
- 111
11
votes
1
answer
2k
views
Kernel level Dynamic Binary Instrumentation
Is there anything like PIN or DynamoRIO to instrument at Kernel level? The platforms I'm more interested on are Windows and OSX.
- 4,425
10
votes
2
answers
2k
views
Is there an easy way to detect if the SSDT has been patched from a memory dump?
The SSDT is a dispatch table inside the Windows NT kernel, and it is used for handling calls to various internal kernel APIs. Often malware will change addresses in the SSDT in order to hook certain ...
- 1,252
10
votes
2
answers
7k
views
Struggling between syscall or sysenter ( Windows )
As i understand, from windows xp, there is a sysenter instruction introduced, instead of 'int 2e' interrupt. But on win 10 there is syscall instruction used in ntdll. So is the sysenter used only for ...
10
votes
2
answers
7k
views
How to load symbols from a symbol server in Ghidra?
I've been trying to learn Ghidra by attempting to reverse the comctl32.dll system library, which has many of its functions documented. I started the de-compilation analysis in it, and after a while it ...
- 1,517
10
votes
1
answer
5k
views
Can I define custom enum-type to be used in Ghidra as a data type?
I'm trying to learn Ghidra. Say, if it generated the following code for loading functions from an array of function names from gpfnCommCtrlAPI:
I was able to retype gpfnCommCtrlAPI into char*[14] ...
- 1,517
10
votes
1
answer
3k
views
Anti-debugging techniques - Preventing me from setting a memory and hardware breakpoint. How can I bypass that?
I'm debugging this process which has a lot of anti debugging techniques in it, and I faced something new which I don't know how to bypass yet.
Changing the code dynamically causes exceptions to occur ...
- 668
9
votes
2
answers
4k
views
Where is ntdll.dll?
I am trying to get the base address of ntdll.dll over the PEB. So, what I did was to dump the PEB (d fs:[30]). Then, I tried to get to PEB_LDR_DATA over the offset 0xC. Over the offset 0x1C of ...
- 443
9
votes
2
answers
6k
views
What are the difference syscall and int 0x2E instructions?
From this question: How does the Windows Native API communicate with the kernel?
Here is an example of ZwClose(HANDLE Handle); system call in NTDLL.DLL in Windows 10 X86_64:
NtClose proc near
...
- 1,549
9
votes
2
answers
2k
views
Obfuscating Windows Executables
GCC allows you to write optimization plugins that can be used to obfuscate your compiled executable, but this wasn't ported to mingw. LLVM allows something similar but barfs when including Windows.h.
...
- 4,036
9
votes
3
answers
303
views
How to manage/revert to specific OS versions for effective patch diffing?
For the purpose of learning about the complexities involved in writing PoC's (and gaining experience in) one could do patch diffing and have real world vulnerable examples to practice on. For now ...
- 1,733
9
votes
1
answer
4k
views
IDA pro and default windows (lib) functions
Why can't IDA Pro successfully determine which exact functions are called after successful disassembly of inline functions?
For example, statically linked functions like printf(), memcpy(), memset() ...
- 581
9
votes
1
answer
556
views
Loading Windows executable - unexpected data appended at beginning sections after loading in memory
Few days after asking the question I realised I misinterpreted my original findings. It seems .rdata section on file is copied directly to memory, but then first 36 bytes are overwritten by loader ...
- 293
9
votes
1
answer
991
views
Red Alert 2 Windows 8 DirectDraw compatibility
The game Red Alert 2 runs on Windows 8, but as soon as I inject a DLL (via ddraw.dll or an extra DLL) it stops drawing buttons on the main menu. With the DLL it still work fine in windowed mode and it ...
- 241
8
votes
1
answer
5k
views
How to investigate Windows 32/64bit (WOW64) transition
There is surprisingly little information about Windows WOW64 mechanism.
I'm trying to investigate it.
So when we have system call in 32-land, it calls an address that is stored in FS, which leads us ...
- 263
8
votes
2
answers
25k
views
What happens when a DLL is added to AppInit_DLL
I have a malware sample that adds a DLL to the registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs. There is malicious functionality in the DLL referenced by the ...
- 1,326
8
votes
3
answers
5k
views
Batch disassembling DLL and EXE files?
In %SYSTEMROOT%, there are about 2000 DLL and EXE files. I am looking into reverse engineering some of them which are dependencies of other applications.
However, what I would preferably want is ...
- 203