Questions tagged [windows]
Windows refers to the Microsoft Windows series of operating systems.
817
questions
3
votes
1
answer
172
views
How to call Windows console in ASM and printf some values there?
Is there a working way to embed the windows console in disasm code? I tried AllocConsole with GetStdHandle or AttachConsole with PID of an existing console but it didn't work. I have tried printf ...
- 31
2
votes
1
answer
144
views
What are latest research in reverse engineering?
I am searching research papers related to reverse engineering between 2020 and 2022 but did not found good papers with latest research in the direction of reverse engineering.
So, what are the latest ...
2
votes
1
answer
58
views
generate code execution/cpu time flame-graph of library DLL (Noob question)
I have a library DLL which I'm trying to analyze, and I have a basic understanding of its function and behavior (and can modify some input to affect how long certain operations will take to execute/...
2
votes
0
answers
48
views
How to obtain import name from disassembled assembly
I'm trying to create my own tools for reverse engineering PE. I have some assembly codes that I fetched from a clone of objdump for a program. Sometimes I see call instructions such as :
callq *...
- 21
2
votes
2
answers
217
views
Reverse function in .rdata field
I'm tracking a function called CreateIoCompletionPort in dns.exe. The import tab in IDA shows that it's imported from api-ms-win-core-io-l1-1-0.dll.
However, it appears in .rdata section in the .dll ...
- 313
1
vote
0
answers
214
views
x32dbg : exe with different code address when running
I have a 32 bits exe that works only when there is a specific usb flash disk inserted. On my new laptop, I only have a single USB port, so I want to make it works without the original key, or from a &...
- 141
3
votes
0
answers
203
views
How find all kernel functions called by a driver in windows 11
I am working on a highly obfuscated driver that is virtualized. In an attempt to work on this driver I asked a question about some python scripts which turned out not to be effective at all so I ...
- 33
1
vote
1
answer
491
views
Reverse Engineering Go obfuscated binaries
I have been trying to understand the working of this go malware by reversing it, which can be found here , so basically this stuff takes a shellcode as an input, and converts it to an exe or dll file, ...
- 11
2
votes
1
answer
76
views
How to investigate in a program of type /SUBSYSTEM:NATIVE that crashes with the RtlFreeAnsiString API?
I compiled a very simple example of an application of type /SUBSYSTEM:NATIVE writing "hello world".
It is launched thanks to the "BootExecute" key. The program works without errors....
- 61
3
votes
1
answer
181
views
Exact copy of USB flash drive
I have a USB flash drive, with 2 partitions : one is read only and contains a Windows software, and the second is read/write for user data.
In order to not damage this precious key, I want to do a ...
- 141
1
vote
1
answer
793
views
How to disassemble an entire function in Windbg?
I am trying to disassemble the function ExAcquireFastMutex using WinDbg but it gives me only 8 rows:
3: kd> u nt!ExAcquireFastMutex
nt!ExAcquireFastMutex:
fffff805`456e3820 4053 push ...
- 573
1
vote
0
answers
58
views
Is there any way to get old Windows kernel drivers?
I'm working through "Practical Reverse Engineering" and absolutely loving it so far. However, some of the exercises involve "decompiling" some Windows kernel files (like ...
- 11
0
votes
1
answer
97
views
Find out which struct RaGetUnitStorageDeviceProperty use by reverse engineering
I am trying to find out which struct storport!RaGetUnitStorageDeviceProperty uses by myself. I know I can use google and find out the correct answer is _RAID_UNIT_EXTENSION. However i want to do it ...
- 33
2
votes
1
answer
404
views
STATUS_PRIVILEGED_INSTRUCTION 0xc0000096 from kernel mode code?
Running a kernel driver I wrote. The driver includes:
mov rax, cr0
btr rax, 10h
mov cr0, rax
to clear WP bit in cr0. Curiously the last instruction faults and causes a bluescreen, ...
1
vote
1
answer
128
views
Finding Correct Segment From An Address For Windows 3.1 EXE in IDA Pro
We have an EXE that IDA pro lists the following segments:
Name Start End R W X D L Align Base Type Class AD es ss ds fs gs
cseg01 00000000 0000EA50 ? ? ? . ...
- 1,235
3
votes
0
answers
169
views
Are system dlls like NTDLL and KERNELBASE etc. are always loaded at the same address on a per-session basis?
If I am understanding, code and read only sections of common DLLs are given system-wide section objects for which each process gets its own section view, in order to save physical memory. As such even ...
2
votes
1
answer
89
views
Programmatically Find COM Object Method Offset in Image from Method Name
What is a way to lookup a COM method offset with an image, just based on the module name and method name.
For example want to find "Exec" method in "WScript.Shell" In this scenario ...
- 1,235
1
vote
0
answers
458
views
c000001d (Illegal instruction)
My Windows crashed, don't understand it shows 'Illegal instruction' on a simple 'strlen' instruction:
*******************************************************************************
* ...
- 111
2
votes
0
answers
321
views
Finding the main function on Windows compiled executables
For a C/C++ program compiled on Windows using the x86 architecture, what is the best way to find the main function within disassembled code without relying on signatures such as FLIRT?
I've found ...
- 41
0
votes
1
answer
53
views
Which function or file is responsible for initialization of g_37HashSeed
I'm checking tcpip.sys file in IDA and found that in the .data part
there is an int called g_37HashSeed.
This seed is an input for a hash function that I look into.
Can someone tell me which program ...
- 313
1
vote
0
answers
88
views
How to get the call stack of WinAPI functions?
Yesterday, I noticed an answer to a question about the purpose of a certain undocumented function, which is a call stack (including the DLL library) for this function, This got me interested in the ...
- 115
1
vote
2
answers
55
views
I need simple debugger source
How can I write a simple debugger for Windows? I need to launch another program (do not attach to an already running one, but launch it yourself) then to let it run and to catch it at a certain ...
0
votes
1
answer
73
views
Symbol name tcpip!IppInitializePathSet found in windbg but unable to find function IppInitializePathSet in tcpip.sys
I'm debugging windows server 2019 in windbg and I want to find function IppInitializePathSet. However, I can't find the function in IDA but I can find the symbol named tcpip!IppInitializePathSet. How ...
- 313
1
vote
1
answer
104
views
x86 weird register call
I am digging with disassembler inside old game (release year 2002) and something is bugging me, I noticed it has a bunch of... questionable instructions. One of the things it does is calling imported ...
- 11
2
votes
0
answers
92
views
x64 Windows: Why is ExAllocatePool stepping on the caller's stack?
I am playing around with windbg on a 64-bit machine and noticed something interesting:
nt!ExAllocatePool:
...
sub rsp, 0xd0
...
mov qword ptr [rsp+0xf8], rbx
Windows only allocated ...
- 21
1
vote
0
answers
58
views
Is there any available source code which is Windows 64 bit compatible that can disassemble binary code?
I'm writing a program that takes as input a single byte of binary (machine code from code segment) and converts it into assembly. I've done some searching online but have yet to find anything helpful. ...
- 11
1
vote
0
answers
79
views
How to reverse an import function?
I'm reversing windows .sys file and an import function RtlLookupEntryHashTable appears in my target functions. I want to know the pseudocode of it. How to achieve this?
.text:00000001C00218C2 ...
- 313
1
vote
0
answers
47
views
Need help finding a windows struct
What I know about it:
struct unknown_struct
{
struct _KAPC apc;
struct _KEVENT event;
char unknown[2056];
};
So first a kernel apc struct then a kernel event struct and the total size is ...
2
votes
1
answer
104
views
Getting "Flow analysis was incomplete, some code may be missing" on WinDbg
I wanted to perform static analysis on the Win32 function CreateFileW, so I loaded kernel32.dll using WinDbg and perform the command uf kernel32!CreateFileW.
But I am seeing the following output ...
- 205
6
votes
4
answers
3k
views
Do I have to learn computer architecture for underestanding or doing reverse engineering?
I am completely noob in reverse engineering, and I've just started to learn it.
Now I have this question in my mind, that does a reverse engineer use any computer architecture knowledge for doing his/...
- 63
1
vote
0
answers
85
views
windbg shows different instruction at address when you set the breakpoints in 2 different breaks but not the same break (nvd3d9wrapx thunk in user32)
In the first example I only set a breakpoint on user32!CreateWindowExW
In the second example, I set 2 breakpoints at the same time on user32!CreateWindowExW and notepad!WinMain
In the 3rd example I ...
- 295
1
vote
1
answer
1k
views
Why is JMP ESP required in buffer overflow?
I was reading this article by Hackers Grimoire on Windows buffer overflow attacks.
The article made sense, except for the part where the author searched for a DLL (.dll) file which contained a JMP ESP ...
- 185
3
votes
1
answer
2k
views
How do I unpack a file protected by MPRESS?
I have a file that is protected by MPRESS packer and I want to know how to unpack it on Windows. Is there a specific program for that or something else? I am new to this so every help is appreciated.
- 31
2
votes
0
answers
51
views
How do I read/edit a .xuk file extension?
I am trying to reverse engineer a license key for some software, the company that made it went out of business. In doing so, if you didn't already have the key their $50,000 machines become ...
- 21
2
votes
1
answer
735
views
Function pointer and symbols in Ghidra
I am using Ghidra and I see that when it uses function pointers it never shows the paraments that are being sent to the function(In IDA pro, it always show the parameters). How can I fix that it will ...
- 41
0
votes
1
answer
99
views
ida jumping to address I can't see in driver
When I open this driver in IDA i can't seem to see the instructions that this jmp at 0x1400DC46D jumps to.
I've tried to undefine bytes and re-analyze the function but it then ends up will garbage. ...
- 41
2
votes
1
answer
251
views
Mov instruction from a pointed location at the beginning of a program
I am trying to learn how to read assembly code. So far I have understood the basic instructions. Now I am trying to see if I can understand a dissassembly from a linked executable. So this is an ...
- 143
1
vote
1
answer
82
views
Calling a function with a variable number of args from a proxy DLL
The program I'm messing with has builtin logging. Using a proxy DLL, I managed to activate it by calling the right functions from the real DLL. However, I got stuck at using the actual logging ...
- 149
2
votes
1
answer
1k
views
Understanding disassembly information from Visual Studio's dumpbin and GNU's objdump
I usually write my code on Windows, and there are two different types of development environments, each providing their own tools to view the assembly code of an object file(*.obj) or executable (*....
- 143
1
vote
0
answers
118
views
How to convert addresses shown by IDA when statically analyzing a DLL to real addresses in runtime
In a DLL I am trying to reverse there often is a reference to something I believe to be a fixed pointer (like a global var) which looks like dword_10038534. The references I am talking about look like ...
- 11
3
votes
1
answer
3k
views
How to load a PDB file into x64dbg?
I want to see symbols in the disassembly wherever possible, and I have a PDB file for the .exe I'm debugging, but I can't find a way to load the PDB file from disk. Is it even possible?
- 177
0
votes
1
answer
3k
views
Frida hook multiple processes
There was such a situation. I run the frida hook on the process like this:
frida -f '..\hack2\hackme.exe' -l .\start.js
In the script itself I do this
var moduleData = Process.getModuleByName("...
- 65
1
vote
1
answer
233
views
What are these Device Object Characteristics / Flags in Windows 10 ntoskrnl!IopParseDevice
In Windows 10 looking at ntoskrnl!IopParseDevice I'm trying to work out the name / purpose of the flags in this check, which seem to be testing for values in a DEVICE_OBJECT Characteristics property ...
- 1,235
1
vote
2
answers
177
views
IDA show xrefs in .pdata and nothing else
I'm debugging the Windows ARM64 version's EFI (bootaa64.efi).
Using QEMU and GDB I was able to find that bootaa64.efi was stuck in one of the two functions BlKernelSp0SystemErrorHandler and ...
- 249
2
votes
0
answers
31
views
Why does OllyDbg label data segment as read only?
I'm working on this problem: Challenge 53
When compiling with cl c53.c /Fac53.asm /MD in VS2019 X86 Development Console and loading the .exe into OllyDbg, I found OllyDbg labels all segments of c53 as ...
1
vote
1
answer
241
views
Why is Visual Studio compiling my EXE file with an entry point that is not in the file?
So I am trying to open my test app EXE file in ollydbg to study the assembly, the stack, registers and all that stuff for educational purposes and it gives me this message saying that the entry point ...
- 11
2
votes
1
answer
356
views
Instructions to compare two strings
I made a list of which instructions compare two strings in disassembly so that when I get to intermodular calls in x64dbg, I can simply type this instructions to see if there is a comparison have been ...
2
votes
0
answers
104
views
Reverse engineering unknown data file
I have a set of datafiles that I want to reverse engineer which are used by a software that controls my heating system. I want to extract the commands to then use these commands in my home automation ...
- 21
1
vote
1
answer
66
views
funcion calls extern function without body
I wanted to look at how does the Windows API get the size of a file, so I opened kernel32.dll in a disassembler. I searched for GetFileSizeEx, and it seems to call a stub(?), but the disassembler ...
- 145
0
votes
1
answer
103
views
Understanding the meaning of EBP + 0xffff98b4
I'm currently reverse-engineering an old game from 2003 to extend its functionality. I have now found what I am looking for and since it was written in C++ I'm trying to re-create the used classes. I ...
- 3