Questions tagged [windows]

Windows refers to the Microsoft Windows series of operating systems.

Filter by
Sorted by
Tagged with
10
votes
1answer
2k views

Kernel level Dynamic Binary Instrumentation

Is there anything like PIN or DynamoRIO to instrument at Kernel level? The platforms I'm more interested on are Windows and OSX.
16
votes
5answers
7k views

Is there any simple open source Windows packer?

There are great questions here about different types of packers and that is very interesting to me. I would like to try my hand at reverse engineering one. Since I am very new to this, I would like ...
21
votes
1answer
4k views

Windows Wiki : Books and Tutorials [closed]

This post is for collecting all the best books and tutorials that exist dealing with windows specific reverse engineering techniques and concepts. The content will be added to the Windows wiki. Any ...
14
votes
7answers
10k views

How to see what data is being transmitted when an application calls home?

Always wondered how it would be possible to see what data is being transmitted back and forth with an application that calls home. Let's say we emulate the server via host file redirect. Would it be ...
17
votes
4answers
4k views

Server-side Query interception with MS SQL Server

I'm researching into intercepting queries that arrive at the SQL Server 2008 process. SQLOS architecture is divided in the following system DLLs: sqlmin.dll: Storage, replication, security features,...
17
votes
8answers
5k views

Determining if a file is managed code or not

How can I quickly tell if a EXE or DLL I have is managed code or not? I spent some time recently trying to disassemble a file and then later learned through some traces in the code that I could have ...
13
votes
4answers
5k views

INT 2D Anti-Forensic Method

Inclusion of an INT 2D instruction appears to be a fairly common anti-debugging tactic used by Windows malware authors. From what I understand, it causes a process to act differently when a debugger ...
32
votes
5answers
23k views

Open source GUI tool for decomposing a PDF

I've been looking for an open-source GUI tool to extract PDF's in an automated way on Windows systems. I've used Didier Steven's tools with great interest for a while, but cannot make sense of how to ...
17
votes
3answers
8k views

Are there any tools or scripts for identifying compression algorithms in executables?

I know there are tools for identifying common ciphers and hash algorithms in code, but are there any similar scripts / tools / plugins for common compression algorithms such as gzip, deflate, etc? ...
8
votes
2answers
1k views

Is there an easy way to detect if the SSDT has been patched from a memory dump?

The SSDT is a dispatch table inside the Windows NT kernel, and it is used for handling calls to various internal kernel APIs. Often malware will change addresses in the SSDT in order to hook certain ...
12
votes
3answers
1k views

How to prevent use of Resource editors

There are variety of tools that allow editing the resources of Windows executables. These tools allow a very easy interface for changing the programs look and feel. Replacing icons, text, menus can be ...
10
votes
2answers
2k views

Debugging EXE with TLS

How do I debug an executable that uses TLS callbacks? It's my understanding that these run before my debugger will attach.
4
votes
1answer
2k views

What are good Windows anti-debug references? [closed]

What are good anti-debug references for Windows which help with manual unpacking, emulating, or sandboxing?
17
votes
4answers
4k views

How can you reliably unpack a Windows driver manually?

When you unpack manually a Windows user-mode executable, you can easily break at its EntryPoint (or TLS), then trace until you reach the original EntryPoint. However that's not possible with a packed ...
6
votes
2answers
22k views

What happens when a DLL is added to AppInit_DLL

I have a malware sample that adds a DLL to the registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs. There is malicious functionality in the DLL referenced by the ...
54
votes
3answers
9k views

What is the purpose of 'mov edi, edi'?

I see this instruction in the beginning of several Windows programs. It's copying a register to itself, so basically, this acts as a nop. What's the purpose of this instruction?
6
votes
1answer
754 views

Canonical method to circumvent the ZwSetInformationThread antidebugging technique

I'm sure many of you are familiar with this classic antidebug trick accomplished by calling ZwSetInformationThread with ThreadInformationClass set to 0x11. Although many OllyDbg modules exist for the ...
8
votes
2answers
2k views

Obfuscating Windows Executables

GCC allows you to write optimization plugins that can be used to obfuscate your compiled executable, but this wasn't ported to mingw. LLVM allows something similar but barfs when including Windows.h. ...
6
votes
2answers
395 views

Viewing MSSQL transactions between closed-source application and server

I am reversing a closed-source legacy application that uses Microsoft SQL Server (2005) and I would like to find out precisely what queries are being executed in the background. I understand that it ...
8
votes
3answers
241 views

How to manage/revert to specific OS versions for effective patch diffing?

For the purpose of learning about the complexities involved in writing PoC's (and gaining experience in) one could do patch diffing and have real world vulnerable examples to practice on. For now ...
14
votes
2answers
356 views

Is there a good reference for COM object signatures?

When doing RE on some Microsoft binaries I run across COM object references all the time. Is there a good central place to translate some of the GUID's that I find to some sort of object type without ...

1
9 10 11 12
13