Questions tagged [windows]
Windows refers to the Microsoft Windows series of operating systems.
82
questions
4
votes
3
answers
5k
views
How to find the starting address of text section of a DLL inside a process? (64 bit)
There was a question about this a year ago, but the answer doesn't explain how to do it in C/C++:
How to find start of .text section?
I'm not talking about module start address, which we can get ...
- 232
4
votes
5
answers
5k
views
How to find a subroutine (or next instruction) called after returning from a (Windows) dialog box?
The dialog box is a password challenge, and I'd like to catch/trace/observe the code (hopefully the password-checking code) that gets executed right after clicking the OK button of the dialog box.
I ...
- 151
4
votes
2
answers
3k
views
Reversing a Windows service
I am trying to reverse engineer a malware that open a windows service dynamically in OllyDbg.
When the malware calls StartServiceCtrDispatcherW, I receive an error:
How I can continue to analyze ...
- 43
4
votes
2
answers
2k
views
Is it possible to download program database (PDB) files of Microsoft Windows binaries without installing any software?
I want to download the .pdb files of Windows binaries (e.g., notpad.exe) on machines where the user doesn't have admin rights, nor has any debugger available. I was wondering if it is possible to ...
- 189
3
votes
1
answer
1k
views
Loading a Driver in Immunity
It sounds strange and I realize that you usually use WinDbg to debug drivers, but I was reading up on Gray Hat Python and it states:
To test this out, try loading the driver C:\WINDOWS\System32\...
- 131
3
votes
3
answers
4k
views
Detecting packed 64-bit Windows Portable Executable (EXE) files
What programs are the most useful to detect if a 64-bit PE file has been packed (main focus is on EXE files).
I am not interested in the packer used I would just like to know if the file is packed or ...
- 51
3
votes
2
answers
1k
views
VADs with RWX permission in winlogon and csrss processes
On a clean Windows XP SP2 installation running inside a VirtualBox VM, when doing a snapshot with vboxmangage debugvm --dumpguestcore and analyzing it in Volatility, I always find 9 VADs with ...
- 197
3
votes
3
answers
3k
views
How to edit an .exe file without overwriting previous information
A qualifier - all I know of what I'm about to explain has been gathered from spending the last few hours researching to solve my problem, so forgive the naivety and clumsiness of a non-expert in this ...
- 162
3
votes
1
answer
5k
views
Is it possible to extract / read a variable out of a running .exe file?
I am completely new to Windows programming so please excuse any naivety on my part when asking this question. I'll briefly describe my situation and then hopefully you'll be able to answer my question....
- 167
3
votes
1
answer
2k
views
How to intercept a call to function with known name from known DLL
First of all I wasn't very much into reversing until now, so excuse me if my question is dumb.
I have a windows DLL most likely made with Visual C++. It's been developed in 1998 and has Mfc42.dll (4....
- 131
3
votes
2
answers
3k
views
IOCTL Code for Windows driver
Recently I tried to obtain OICTL Codes from the iscflashx64.sys driver and I have found it in DispatchDeviceControl function. After driver being installed and have started with SCM it displayed in ...
- 33
3
votes
1
answer
1k
views
How can WinDbg be used to troubleshoot program loading?
I have a stubborn PE file which I cannot get to load. The PE headers seem to be intact and the file even parses fine in several PE tools. I am receiving a "Invalid Win32 Application" error when I try ...
- 1,830
3
votes
3
answers
2k
views
is ther a way an app can display a message without the use of messagebox API?
I have app that used to display a message "processing" after clicking OK button then another message "done", but now it doesn't. So I got reverse it and see whats happening, but it turns out that the ...
- 73
3
votes
0
answers
520
views
What does fs register value mean in x86 application? [duplicate]
I know that FS points to Thread Environment Block - which is seen by the address at the right part of what OllyDbg shows:
What does this value 0x53 mean? Does it have some connection with the address ...
- 218
2
votes
3
answers
2k
views
How to find the address (offset) of specific driver function
I am reversing Capcom driver and in IDA I have this list of functions:
I want to set breakpoint on the function sub_10590 but I don't know what is the address of this function when I am doing live ...
- 573
2
votes
2
answers
218
views
Reverse function in .rdata field
I'm tracking a function called CreateIoCompletionPort in dns.exe. The import tab in IDA shows that it's imported from api-ms-win-core-io-l1-1-0.dll.
However, it appears in .rdata section in the .dll ...
- 313
2
votes
1
answer
167
views
What is the mdisp field in RTTI for throw used for?
First of here is the article from which I'm looking up the fields.
I was trying out different combinations to see how they affect the RTTI for a C++ throw. It seems that having a virtual base class ...
- 455
2
votes
2
answers
3k
views
Initializing a struct in win32 assembly programming using MASM
I'm trying to create a demo program demonstrating struct(s) in MASM ,
I've written a code like this :
struct1 struct
first db ?
second dw ?
struct1 EndS
.386
.model flat,stdcall
option casemap:none
...
- 67
1
vote
1
answer
149
views
Trying to reverse engineer CmpFindNlsData of winload
I have a basic understanding of assembly language and I'm unable to perfectly define the algorithm of winload!CmpFindNlsData looking at the disassembly. Basically I need to understand how NLS data is ...
- 17
1
vote
1
answer
213
views
How to deal with code that change its address among different execution
I think that this is a basic need of every reverser so this question may have been asked in other places but really, I'm unable to find an answer. Maybe I'm asking the wrong question.
So, supposing I ...
1
vote
1
answer
4k
views
Dump value of register using frida
I'm new with frida and came to this problem.
I have dll that I want to reverse engeneer(there are no debug symbols). Specifically I want to dump some data from a function. So I have this big function ...
- 203
1
vote
3
answers
726
views
Most efficient way to begin analyzing malware binary
I'm taking a reverse engineering course and the class has just been given a big project where we have to analyze a packed malware binary. I am using a Windows 10 VM. I am a little confused on where to ...
- 135
1
vote
1
answer
240
views
Possible to capture/replay GUI functions by “puppet-stringing”? [closed]
When clicking a GUI, there's underlying code somewhere getting executed. Is it possible to capture this "puppet-stringing" so that it can be manually called on demand (without clicking the GUI)?
For ...
- 169
0
votes
1
answer
2k
views
How do I get all sections in a PE file using C++?
So I am wondering how can I get all sections and their info from a dumped PE file on the disk, using C++.
I have the entire PE loaded on a buffer, the NT headers, and hopefully the DOS headers.
I need ...
- 28
0
votes
1
answer
734
views
Can GUI elements of a running program be found/located in memory?
Is it possible for a particular GUI element of a running program (on Windows platform) to be located in memory, such as a text element from a dialog box? For example, locating title text of a drop-...
- 169
0
votes
1
answer
607
views
ASCII strings not showing up in CPU in OllyDbg, but rather in dump
I'm pretty much new to the Reverse Engineering and assembly language. I've watched some videos about OllyDbg and cracking serial numbers in programs and I got interested in them and I want to learn ...
- 103
0
votes
1
answer
4k
views
x64dbg - Conditional breakpoint based on function argument
How can I set a conditional breakpoint based on the argument of a function?
I am trying to break on the windows function LoadLibraryExW: https://docs.microsoft.com/en-us/windows/desktop/api/...
- 103
0
votes
3
answers
275
views
What is the best way to change the call-graph of a PE file without changing its real behavior and without packing it?
What i want to do is take a PE file, extract its call-graph, and then inject a junk function in it, so for example by injecting a junk function inside of it, and changing a call instruction's opcode ...
- 519
0
votes
1
answer
1k
views
Can we hook the Nt or Zw functions using IAT hooking, or just inline hooking?
So i was trying to hook the ZwQuerySystemInformation or NtZwQuerySystemInformation using IAT, but i found out that these are not inside the IAT inside the memory nor in the PE file
but maybe i am not ...
- 519
0
votes
1
answer
364
views
How to track output parameters in disassembly?
I have the following disassembly of winload!CmpFindNlsData function and I need to check the output parameters of this function.
P.S.: CmpFindNLSData(int a1<eax>, int a2, PUNICODE_STRING ...
- 17
0
votes
2
answers
601
views
Where do arguments 5 and 6 go in this Microsoft x64 function call?
I'm disassembling a working-as-expected compiled C program (MS/Windows x64, MinGW gcc 10.1.0). In the main function, I have the following call which passes 6 arguments to the function DotProduct:
...
/...
- 111
-3
votes
2
answers
3k
views
Anti-debug techniques for MS-Windows?
Is there any anti-debugger tricks used by malware other than interrupt INT 0x2D ? And, how do they work ? Working examples would be really nice !
- 135