Questions tagged [windows]

Windows refers to the Microsoft Windows series of operating systems.

Filter by
Sorted by
Tagged with
7 votes
2 answers
24k views

What happens when a DLL is added to AppInit_DLL

I have a malware sample that adds a DLL to the registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs. There is malicious functionality in the DLL referenced by the ...
user avatar
  • 1,236
66 votes
3 answers
12k views

What is the purpose of 'mov edi, edi'?

I see this instruction in the beginning of several Windows programs. It's copying a register to itself, so basically, this acts as a nop. What's the purpose of this instruction?
user avatar
  • 4,495
6 votes
1 answer
847 views

Canonical method to circumvent the ZwSetInformationThread antidebugging technique

I'm sure many of you are familiar with this classic antidebug trick accomplished by calling ZwSetInformationThread with ThreadInformationClass set to 0x11. Although many OllyDbg modules exist for the ...
user avatar
  • 1,163
8 votes
2 answers
2k views

Obfuscating Windows Executables

GCC allows you to write optimization plugins that can be used to obfuscate your compiled executable, but this wasn't ported to mingw. LLVM allows something similar but barfs when including Windows.h. ...
user avatar
  • 3,866
6 votes
2 answers
418 views

Viewing MSSQL transactions between closed-source application and server

I am reversing a closed-source legacy application that uses Microsoft SQL Server (2005) and I would like to find out precisely what queries are being executed in the background. I understand that it ...
user avatar
  • 1,048
8 votes
3 answers
286 views

How to manage/revert to specific OS versions for effective patch diffing?

For the purpose of learning about the complexities involved in writing PoC's (and gaining experience in) one could do patch diffing and have real world vulnerable examples to practice on. For now ...
user avatar
  • 1,693
14 votes
2 answers
384 views

Is there a good reference for COM object signatures?

When doing RE on some Microsoft binaries I run across COM object references all the time. Is there a good central place to translate some of the GUID's that I find to some sort of object type without ...
user avatar
  • 409

1
12 13 14 15
16