Questions tagged [windows]

Windows refers to the Microsoft Windows series of operating systems.

Filter by
Sorted by
Tagged with
1
vote
0answers
50 views

Ways of creating a new thread on Windows

I'd like to know about every possible way how a thread can be created in a process at the lowest possible level. There are loads of WinAPI-s to create a thread, but as far as I know all of them ends ...
0
votes
0answers
25 views

Watching a TLS Slot value in x64dbg

I am new to reverse engineering and I was trying to debug why a 3rd party application was crashing when I m injecting my DLL in it. (There are some cases where it didn't crash) So I was able to figure ...
0
votes
1answer
85 views

How to track output parameters in disassembly?

I have the following disassembly of winload!CmpFindNlsData function and I need to check the output parameters of this function. P.S.: CmpFindNLSData(int a1<eax>, int a2, PUNICODE_STRING ...
0
votes
1answer
36 views

How are processes assigned a virtual base address

So I'm trying to understand how a process is assigned a base address once its loaded into memory. If I understand correctly each process has its own virtual address space, and each virtual address is ...
0
votes
1answer
85 views

What is physical address on a pe reader?

What is physical address on a Pe file? I had search on the microsoft website article about pe files and don't have found anything.
1
vote
1answer
85 views

Trying to reverse engineer CmpFindNlsData of winload

I have a basic understanding of assembly language and I'm unable to perfectly define the algorithm of winload!CmpFindNlsData looking at the disassembly. Basically I need to understand how NLS data is ...
2
votes
0answers
57 views

Ghidra is mishandling a field access

I have a program which decompiles in Ghidra to include the line temp_5f2f2f81bc = *(CPedIntelligence **)(&DAT_000010c0 + (longlong)pCVar2); temp_5f2f2f81bc is a CPedIntelligence*. pCVar2 is a ...
4
votes
1answer
213 views

Why does PE ImageBase address change in memory?

I'm reversing a malicious 32-bit x86 Windows executable. Statically reviewing PE headers in Ghidra, I see that ImageBase is set to 0x400000 as expected. However, when the binary is loaded into memory, ...
0
votes
1answer
89 views

ASLR in Linux Vs Windows

I am quite new in binary exploitation. I am doing a lot of beginners exercise here. I am confused about ASLR. I tried some binary exploitation thing in Linux. It was recommended that I should stop ...
3
votes
1answer
71 views

reason of padding in exploit

I was doing vulnserver bufferflow exploit. I saw a tutorial where the he makes a payload to exploit the server. Take a look at the exploit: #!/usr/bin/python import socket target_ip = "10.0.2....
0
votes
0answers
50 views

Reverse engineering a “Crypto++/CryptoPP” Windows Service using Ghidra

I'm new the reversing scene (and this site!). I recently got interested in seeing how Windows Services tick, and discovered a weird encryption scheme. The binary isn't obfuscated at all (at least, it ...
1
vote
1answer
65 views

Finding mapped memory page flags in Radare2

I have a memory dump of notepad.exe. Radare's iS to print sections gives me the mapped files (executable and it's dll's) as well as the many sections simply marked 'Memory_Section', which from what I ...
0
votes
0answers
36 views

Windows pintool mismatch between call/ret instructions

So i've been trying to write a pintool that monitors call/ret instructions but i've noticed that threre was a significant inconsistency between the two. For example ret instructions without previous ...
0
votes
0answers
69 views

How to find and edit the source of a string in a DX11 game's exe/files (debug build of the game available)

I want to find and edit the values for the motion blur effect in Naruto: Ultimate Ninja Storm 3 on PC (Windows, DX11) to be more in line with the PS3 version (and the other Storm games on PC as well). ...
1
vote
1answer
100 views

how could i follow a system call from a dll -> kernel driver syscall

basically i would like to follow (system calls / internal calls) that basically lands in the kernel i would like for example to debug a specific dll ex : ntdll.dll and follow it to (NtXXX) function ...
1
vote
0answers
31 views

PE Format - How can I delete IMAGE_IAT_DIRECTORY and the app still runs fine?

I’m doing a small research regarding PE files and while I drilled every related question or the documentation itself I couldn’t explain this issue. Why can I go to CFF explorer or some other PE ...
0
votes
2answers
75 views

Where do arguments 5 and 6 go in this Microsoft x64 function call?

I'm disassembling a working-as-expected compiled C program (MS/Windows x64, MinGW gcc 10.1.0). In the main function, I have the following call which passes 6 arguments to the function DotProduct: ... /...
1
vote
0answers
37 views

How are AutoIT variable names stored after compiling it to a executable?

I need to write a yara rule for a autoit malware (the binary itself not the decompiled script) As far as i know the actual script is in the resource section in the RCData, but how can i find the bytes ...
0
votes
1answer
109 views

How to run another IDA script using IDApython?

I'm using IDA batch scripting to run a script on a dataset of malware the problem is i need to run the VB6 idc script after auto analysis is finished, and wait for it to finish and find all the ...
1
vote
1answer
373 views

How to know where a sequences of bytes are used in a .NET application with Dnspy?

There are a sequence of bytes that i need to find out where are used in dnspy i tried going to hex editor and found the bytes, but right clicking and saying go to code or structure or follow reference ...
2
votes
1answer
80 views

Pe 32 Add Export function Segment by Extending with dll or Patching pe

I need to add new function inside pe32 module.dll Export Table , in dynamic way if possible ( via extending with dll ) or by patching pe32 module.dll What can u suggest to solve this ?
2
votes
1answer
162 views

How to debugging activeX with Ida

When I enter to some site it ask me to install ActivX to my Internet Explorer browser so this site will work well. I installed that,and that site works well. How can I see this ActiveX code(where ...
0
votes
1answer
51 views

Why does an executable still run despite changes to checksum, or changes to data section without new checksum?

I have a "Hello World" console app compiled with Flat Assembler. The size of the executable is 2048 bytes and the checksum is 0x3797. Questions: Does it matter if I make changes to the data section ...
0
votes
0answers
580 views

How to bypass SSL certificate pinning on Windows 10

When reverse engineering a big application, it can be very useful to be able to see the network traffic it generates. Because of this, many applications use HTTPS to communicate with their servers. ...
4
votes
1answer
129 views

what routine in ntdll.dll is responsible of dispatching DllMain function of loaded dll?

I'm trying to debug a dll file using Ida disassembler and Windbg. I'm debugging rundll32.exe and passing the target dll (debugee) as an argument. I'm able to have a breakpoint on each Dll load & ...
1
vote
1answer
52 views

What is the difference between mapped and private memory segments in xdbg? and what is a reserved segment?

So in xdbg in the memory map, i can see that some segments are mapped and some are private, at first i thought maybe mapped means it has a corresponding file on disk and its the mapped version of that,...
2
votes
1answer
110 views

Get return address from syscall

I'm debugging some 32-bit process using windbg kernel debugger. This process calls some syscalls, so I set few breakpoints at kernel functions like nt!NtQuerySystemInformation. So after breakpoint hit,...
0
votes
0answers
68 views

x64dbg call function from current thread

While debugging an executable with x64dbg, I want to make a function call (while the executable is stopped on a breakpoint), what I want to do is the same as the following gdb line: p (void*)freopen("...
2
votes
3answers
161 views

How does an application identify a DLL file

Sorry if this is a basic question, as I'm very new at this. I'm trying to get an .exe to load a dummy .dll. I've created an example .dll project in VC++ 2019, added the functions listed in the .exe's ...
1
vote
1answer
47 views

advapi32.dll changes name of function during forwarding of exports

Im trying myself at writing a manual mapper, for injection of DLLs into other processes. Ive come to the point, where I've written a simple "Hello World" dll, that im trying to inject into another ...
0
votes
0answers
82 views

How can I reassemble a DDS header with the information I have?

I have 2 files which I know for certainty to be as follows: File 1: Includes all of the DDS image data File 2: Includes some data from the header. The data it includes is the width and the height (...
1
vote
1answer
67 views

What is the mdisp field in RTTI for throw used for?

First of here is the article from which I'm looking up the fields. I was trying out different combinations to see how they affect the RTTI for a C++ throw. It seems that having a virtual base class ...
1
vote
1answer
58 views

Can I make a DDS image from headerless DDS data?

I have some files which I've decrypted that I believe are DDS images. These files do not have a DDS header, however the data looks similar to what I've seen in other DDS images. I believe to a great ...
3
votes
2answers
229 views

Windows - syscalls being called in a strange way?

I've been reading about the way syscalls are called in windows. The general theme in all the articles I read is: 64bit- called inside ntdll 32bit- from ntdll jumping to KiFastSystemcall but when I ...
3
votes
1answer
80 views

Where do mouse/keyboard GUI inputs get queued or stored?

Where do mouse-clicks in a program's GUI window/menus (Windows OS) get stored in memory? Is there some sort of input/GUI "queue" similar to Windows messages queuing? I'm wondering if it'd be possible ...
3
votes
1answer
74 views

CreateToolhelp32Snapshot() access denied (while running as admin or even NT AUTHORITY\SYSTEM)

I've come across a troublesome process which refuses to allow CreateToolhelp32Snapshot(). I also noticed that in sysinternals process explorer it shows "Access Denied" for other things too, such as ...
0
votes
0answers
67 views

fuzzing GDI/BITMAP kernel vulnerabilities

i was wondering about gdi/bitmap vulnerabilities in windows kernel(preferably windowds 10). i saw several exploits and papers regarding this subject, and while it all seem really interesting, i did ...
2
votes
2answers
88 views

Modern methods of fuzzing/locating heap bugs and potential vulnerabilites

really glad I found this great learning resource. I was wondering, is there any way to fuzz or automate heap vulnerability assesment? I know a lot of practical frameworks for stack based fuzzing in ...
2
votes
1answer
100 views

I can't set a hardware breakpoint on RIP + N-byte after calling NtContinue()

#include <Windows.h> int handle_exception (EXCEPTION_POINTERS *exception_pointers) { exception_pointers->ContextRecord->Rip += 4; return EXCEPTION_CONTINUE_EXECUTION; } int main (...
3
votes
1answer
593 views

Reverse engineer Listen to this device on Windows - Reverse engineer Windows when there's no API

I'm writing an Autohotkey script to toggle Listen to this device for my microphone, without interacting with a GUI. I thought it would be a simple registry key being modified so I used RegShot to ...
1
vote
1answer
141 views

Hiding a file in a Windows operating system

I am trying to understand how to hide a file in windows as a way to learn about win api and malware analysis. What I am trying to do is to make a file "disappear" via some kind of manipulation. But I ...
0
votes
3answers
102 views

What is the best way to change the call-graph of a PE file without changing its real behavior and without packing it?

What i want to do is take a PE file, extract its call-graph, and then inject a junk function in it, so for example by injecting a junk function inside of it, and changing a call instruction's opcode ...
0
votes
0answers
146 views

How can I debug code execution on a Native->Unity/Mono/C# Application

I'm reverse engineering a Windows application which has a main executable that appears to run some boilerplate/stub code before calling UnityMain and also using Mono. This means that if I use an ...
0
votes
3answers
237 views

How To Identify Which Process Is Being Written To With WriteProcessMemory?

Basically, I cannot find which process is being written to when WriteProcessMemory is being called. Currently I'm Setting Breakpoints on WriteProcessMemory and OpenProcess. However, the process handle ...
2
votes
1answer
179 views

Anti-debug clearing hardware breakpoints

An application I am debugging somehow manages to clear my hardware breakpoints. I am using TitanHide and x64dbg. I am observing the following behaviour: When placing the first hw breakpoint, it is ...
0
votes
0answers
103 views

Reverse Engineering a Keygen

I have a keygen for some programs from a manufacturer. But not for all. I suspect that the manufacturer uses very similar algorithms. Is there an easy way to find out the algorithms of the different ...
1
vote
2answers
140 views

NOPed encrypt/decrypt functions in a Path of Exile client and now it crashes without message. Next step?

I am reversing an old Path of Exile client with the purpose of building an emulator. I managed to reach the character select screen in a newer, 64-bit client but I am struggling to make the same ...
1
vote
0answers
45 views

Possible to inject a new menu into a program's menu bar?

Is it be possible to inject a new menu/menu item into a program's menu bar? As an example, in Notepad's (Windows) "Help" menu, would it be possible to add a new entry to that menu like "Open ...
1
vote
1answer
177 views

Adding a static variable to Windows DLL

I'm trying to patch a function in a Windows x86 DLL, however it turned out that I need a static variable to store some state that wasn't correctly preserved by the original executable across calls. I ...
-1
votes
1answer
218 views

Why cant we find ransomware keys?

From my understanding most ransomware has a secret key used for encryption in a server which it contacts to send over the key and use it for encryption But I am wondering, couldn't someone easily ...

1
2
3 4 5
14