Questions tagged [windows]

Windows refers to the Microsoft Windows series of operating systems.

Filter by
Sorted by
Tagged with
-2 votes
1 answer
2k views

How can I locate exported functions of an EXE or DLL? [closed]

I am trying to do some experimenting with certain system files (DLLs, EXEs) in Windows and would like to know how I can get information about the functions that they contain. I want to be able to call ...
user avatar
10 votes
1 answer
346 views

Thread-Switching with PyDbg

I'm having trouble switching from debugging one thread to another in pydbg. I don't have much experience with multithreading, so I'm hoping that I'm just missing something obvious. Basically, I want ...
user avatar
  • 101
3 votes
1 answer
1k views

Loading a Driver in Immunity

It sounds strange and I realize that you usually use WinDbg to debug drivers, but I was reading up on Gray Hat Python and it states: To test this out, try loading the driver C:\WINDOWS\System32\...
user avatar
  • 131
7 votes
2 answers
2k views

How to Attach debugger or start analysis of process that is debugging itself?

I need and advice on how to start an analysis, connect with debugger to a process that is already debugging itself. Are there any tools/plugins/techniques that might help during the analysis? UPDATE ...
user avatar
  • 2,852
16 votes
1 answer
5k views

COM interface methods

I'm reversing malware and it uses COM, which I evidently don't know. My question is how to find out what method is called using ppv (and objectstublessclient?) push offset ppv ; Address of ...
user avatar
7 votes
1 answer
2k views

Reverse engineer a proprietary save/file format structure

I am working on automating some functionality within a closed-source third party application; I want to automate the creation of "Project Files" (in its simplest form, just a collection of video files ...
user avatar
  • 173
10 votes
1 answer
5k views

Dll injection and GetProcAddress with the winapi

So i just read a little bit about how one would go about for injecting a dll into a running program on Wikipedia (the CreateRemoteThread idea). I followed the steps described and eventually got it ...
user avatar
  • 349
6 votes
1 answer
1k views

Read a struct from memory

I'm trying to load a struct defined in a program that i'm reading the memory of, so I can use it to define objects in my python debugger (in windows). What format do structs take in memory, and what ...
user avatar
  • 163
2 votes
1 answer
603 views

How to view the content of a file before it is written?

I've got a process that writes to a file (database). In process monitor I see WriteFile. After this I see the file is about to be either written or updated (offset:length). How can I reveal the ...
user avatar
-4 votes
1 answer
5k views

Set a breakpoint before WriteFile operation in OllyDbg [closed]

In the process monitor, I see a WriteFile operation. How can I set a breakpoint and view everything about this operation in OllyDbg? If this is not possible with OllyDbg, what other tools can I use?
user avatar
3 votes
2 answers
362 views

Edit Windows protected systemfiles in VMWARE?

How can I edit Windows protected system internal files in VMWARE? On a normal PC, I can simply reboot the PC and use a different Operating System to prevent the 'access denied' error... But how do I ...
user avatar
2 votes
1 answer
168 views

What is *BindW*?

I am looking at a windows library in IDA pro and I came across a function call BindW(ushort **, void **) IDA pro adds the comments Binding and StringBinding respectively to the parameters when they ...
user avatar
  • 1,022
7 votes
3 answers
2k views

How to force the loading of a DLL in Windows XP at a particular address

I need to run a debugger on an application and analyze its startup, however the main DLL gets loaded at different addresses every time, which makes my job much harder. How can I disable ASLR ...
user avatar
  • 71
6 votes
1 answer
3k views

What are general guide lines for reversing COM objects

I'm interested in revers engineer COM objects. How can I find interfaces that a particular object implements if I know what interface it is? Please tell if I need to change or rephrase the question.
user avatar
  • 2,852
3 votes
1 answer
2k views

Reverse engineering windows service

I'm trying to reverse engineer a driver that consists of 2 components, a windows service and a control panel application. My goal of reverse engineering is to replace the control panel with my own ...
user avatar
7 votes
3 answers
4k views

Reverse engineering a VC++ video game

So I know x86 machine language and C++/C language. In the last weeks I've dedicated to learn Windows internals and especially PE format. My target is retrieving the Tomb Raider The Angel of Darkness ...
user avatar
  • 391
6 votes
1 answer
190 views

Where are program resources stored in a CIL assembly?

In a CIL assembly, where are resources stored? I am trying to reverse engineer a sample that appears to be protected by a .NET crypter. The CIL assembly for the sample does a SHA256 decryption on a ...
user avatar
22 votes
2 answers
13k views

How to reverse engineer simple usb device [windows -> linux]

I'd like to reverse engineer my usb beer-can refrigurator, which does connect via USB on windows and via simple GUI tray-tool can set/query temperature. I was thinking about running virtualboxed ...
user avatar
  • 221
6 votes
2 answers
472 views

Tool for checking for in-memory code modifications of loaded DLLs

A common anti-debugging practice is to overwrite functions such as DbgUiRemoteBreakin within ntdll.dll. Since in-memory representation of common libraries is always the same on each platform, it ...
user avatar
  • 570
4 votes
2 answers
1k views

windbg crashdump process by pid from kernel

What is the best way to dump user space process by pid debugging the kernel with windbg? I'm able to attach to the process from user-space with windbg and generate crash by .dump, but how would I do ...
user avatar
  • 41
10 votes
5 answers
18k views

Freely available resource hacking applications

I am using Resource Hacker as a tool to extract out resources like icon, images, etc. from .dll or .exe file. In addition, I am using it to crack some small Windows application. However, it does not ...
8 votes
1 answer
4k views

IDA pro and default windows (lib) functions

Why can't IDA Pro successfully determine which exact functions are called after successful disassembly of inline functions? For example, statically linked functions like printf(), memcpy(), memset() ...
user avatar
  • 561
4 votes
1 answer
1k views

Prevent malware from deleting itself during installation on Windows x64

Can anyone suggest a tool to prevent a malware from deleting itself on Windows x64? The purpose is to collect all the components of the whole process of infection. I've looked at CaptureBat, but its ...
user avatar
  • 2,852
6 votes
2 answers
1k views

Making Visual C++ harder to reverse engineer

This is similar in nature to this question and this question; I'm interested in what compiler settings to enabled/disable to make a Visual C++ harder to reverse engineer. Here's a few compiler flags ...
user avatar
  • 163
7 votes
1 answer
5k views

How does services.exe trigger the start of a service?

I'm trying to work out the internals of how a Windows process starts and maintains communication with services.exe. This is on Windows 8 x64, but if you have tips for Windows 7 that is fine too. So ...
user avatar
2 votes
1 answer
2k views

How to debug using OpenWatcom's debugger?

OpenWatcom's debugger just executes the binary instead of single-stepping through it, when I attempt the following steps: File->Open, select executable Run->Trace Into This attempt is on ...
user avatar
5 votes
1 answer
699 views

What could this sequence of assembly instructions possibly mean?

I have recently came across the following sequence of assembly instructions. call ds:WSAStartup push ecx push edi mov ecx, 69E65AC4h mov edi, 2776452Ah pop edi pop ecx jmp ...
user avatar
  • 2,948
1 vote
0 answers
56 views

What are possible ways to dynamically analyze windows service? [duplicate]

I am working executable, which is meant to be loaded as windows service. I have statically determine certain breakpoints that I'd like it to break upon execution. Is there any particular way to ...
user avatar
  • 2,948
20 votes
1 answer
33k views

Get the function prototypes from an unknown .dll

I have an unknown .dll from another program which I want to work with. With DLL Export Viewer I was able to find the exported functions. But to call them I need the information about the parameters ...
user avatar
  • 2,879
4 votes
2 answers
2k views

Viewing memory permissions in Ollydbg for memory segments

I'm looking for a way to view memory permissions on a specific section of memory using OllyDbg (technically I'm using Immunity but I'm assuming if it exists in Olly it'll be the same there). The ...
user avatar
  • 972
6 votes
4 answers
2k views

Program with no dependencies

while reading the answers to Can I statically link (not import) the Windows system DLLs? I came up with another question. So: Is there a way to write a program that has no dependencies (nothing is ...
user avatar
  • 2,852
14 votes
3 answers
21k views

Difference between DllMain and DllEntryPoint

I have a piece a malware to analyze. It is a DLL according to the IMAGE_FILE_HEADER->Characteristics. I was trying to do some dynamic analysis on it. I have done the following: Run it with ...
user avatar
  • 471
29 votes
4 answers
12k views

Can I statically link (not import) the Windows system DLLs?

I have compiled following C source code in VS2010 console project. #include <stdio.h> int main(int argc, char* argv[]){ printf("hello world\n"); return 0; } then I used /MT option for ...
user avatar
  • 553
4 votes
2 answers
18k views

Why my Resource Hacker doesn't work with some .EXE files

I use Resource Hacker Application for Reverse Engineering purposes, I've cracked 3 softwares by using this software, but it doesn't grab all .EXE, .DLL files. sometimes It says, This is not a valid ...
user avatar
  • 263
14 votes
4 answers
4k views

Debugging malware that will only run as a service

I'm trying to debug a malware sample that installs to a system as service and then will only start if it starts as a service. Other functions are still available without the service start, like ...
user avatar
  • 143
22 votes
1 answer
11k views

What's 'fs:[0]' doing and how can I execute it step by step?

In a 32 bits Windows binary, I see this code: push next push fs:[0] mov fs:[0], esp int3 ... next: I see that something happens on the int3 (an error), but I don't understand why,...
user avatar
  • 6,529
7 votes
1 answer
8k views

WinDbg fails to connect to IDA Pro debugger server

Environment: Host: Win7 SP1 x64: VMWare Workstation 9.02, VirtualKD, IDA Pro 6.4.13 (x64) and WinDbg Guest: Win7 SP1 x64 I have VirtualKD setup correctly in my guest and host. I say this because ...
user avatar
7 votes
3 answers
939 views

Working with DOS .COM files

What can I do to reverse engineer a DOS .COM file? As far as debugging goes, I've looked DEBUG and DEBUGX from the creators of FreeDOS, as well as the default DEBUG command that comes with Windows. ...
user avatar
  • 832
10 votes
1 answer
2k views

Kernel level Dynamic Binary Instrumentation

Is there anything like PIN or DynamoRIO to instrument at Kernel level? The platforms I'm more interested on are Windows and OSX.
user avatar
  • 4,325
17 votes
5 answers
7k views

Is there any simple open source Windows packer?

There are great questions here about different types of packers and that is very interesting to me. I would like to try my hand at reverse engineering one. Since I am very new to this, I would like ...
user avatar
21 votes
1 answer
4k views

Windows Wiki : Books and Tutorials [closed]

This post is for collecting all the best books and tutorials that exist dealing with windows specific reverse engineering techniques and concepts. The content will be added to the Windows wiki. Any ...
14 votes
7 answers
11k views

How to see what data is being transmitted when an application calls home?

Always wondered how it would be possible to see what data is being transmitted back and forth with an application that calls home. Let's say we emulate the server via host file redirect. Would it be ...
user avatar
  • 143
17 votes
4 answers
5k views

Server-side Query interception with MS SQL Server

I'm researching into intercepting queries that arrive at the SQL Server 2008 process. SQLOS architecture is divided in the following system DLLs: sqlmin.dll: Storage, replication, security features,...
user avatar
  • 273
18 votes
8 answers
7k views

Determining if a file is managed code or not

How can I quickly tell if a EXE or DLL I have is managed code or not? I spent some time recently trying to disassemble a file and then later learned through some traces in the code that I could have ...
user avatar
  • 343
15 votes
4 answers
6k views

INT 2D Anti-Forensic Method

Inclusion of an INT 2D instruction appears to be a fairly common anti-debugging tactic used by Windows malware authors. From what I understand, it causes a process to act differently when a debugger ...
user avatar
  • 253
33 votes
5 answers
27k views

Open source GUI tool for decomposing a PDF

I've been looking for an open-source GUI tool to extract PDF's in an automated way on Windows systems. I've used Didier Steven's tools with great interest for a while, but cannot make sense of how to ...
user avatar
  • 443
17 votes
3 answers
11k views

Are there any tools or scripts for identifying compression algorithms in executables?

I know there are tools for identifying common ciphers and hash algorithms in code, but are there any similar scripts / tools / plugins for common compression algorithms such as gzip, deflate, etc? ...
user avatar
  • 1,212
9 votes
2 answers
2k views

Is there an easy way to detect if the SSDT has been patched from a memory dump?

The SSDT is a dispatch table inside the Windows NT kernel, and it is used for handling calls to various internal kernel APIs. Often malware will change addresses in the SSDT in order to hook certain ...
user avatar
  • 1,212
12 votes
3 answers
2k views

How to prevent use of Resource editors

There are variety of tools that allow editing the resources of Windows executables. These tools allow a very easy interface for changing the programs look and feel. Replacing icons, text, menus can be ...
user avatar
  • 4,495
10 votes
2 answers
2k views

Debugging EXE with TLS

How do I debug an executable that uses TLS callbacks? It's my understanding that these run before my debugger will attach.
user avatar
  • 3,866