Questions tagged [windows]

Windows refers to the Microsoft Windows series of operating systems.

Filter by
Sorted by
Tagged with
2
votes
1answer
161 views

Finding the main function without symbols

for a C/C++ program compiled on windows using the x86 architecture, what is the best way to find the main function within disassembled code? I've found various answers to questions similar to this, ...
1
vote
0answers
189 views

Calling undocumented kernel functions directly (xxxSendInput and xxxMouseEventDirect)

In the core my question is about how to reverse engineer undocumented functions. I want to call the function "xxxMouseEventDirect" (located in win32kfull.sys). I have already been able to collect some ...
9
votes
3answers
785 views

Is there any way to get my own image base without calling any WinAPI functions, such as GetModuleHandle?

Is there any way to get the image base of an .exe without calling WinAPI functions (i.e. imported functions) so that it can't be easily viewed in a disassembler/debugger? I've been thinking of ...
2
votes
2answers
575 views

Wrong RVA values inside IMAGE_IMPORT_DESCRIPTOR

I load the entire PE into an std::vector<Byte> fileContent using std::fstream. Then I obtain the executable's dos header: IMAGE_DOS_HEADER* imageDosHeader = (IMAGE_DOS_HEADER*)fileContent.data(...
1
vote
0answers
50 views

getting %localappdata% in asm

I have an old windows x86 application that no longer works properly since windows 8. This app creates files within its own folders for things like app settings. Unfortunately, Microsoft no longer ...
2
votes
1answer
209 views

Why is the process crashing after executing my injected payload?

I tried the following payload for APC injection in Windows. It gets executed successfully(pops up a MessageBox) but the process crashes after the execution of payload. What could be the possible ...
0
votes
1answer
117 views

How to see all of my changes in idb?

Is there ant way to see all of my changes in idb file ? All of variable in psudo code that I changed here name, all the funxtion I rename. I want to see all of this
0
votes
1answer
109 views

how to find private Key and passphrase stored inside a program?

There are some files (drivers) that are encrypted, and these files are working in a program that is installed in my computer. The program using these files needs to decrypt them. I am sure that the ...
3
votes
1answer
49 views

Are the names of COFF Data Directories fixed?

I have a PE file (notepad), the NumberOfRvaAndSize value in the COFF header is 0x10, and there are 16 DataDirectory entries as expected. The documentation says that this value can change (though I've ...
7
votes
1answer
439 views

WHY and WHEN do we need SEH for buffer overflowing

In our course in university, we recently moved on from standard buffer-overflows to SEH based ones. My exploit is already ready and working thanks to some nice tutorials, although I am still not sure ...
1
vote
2answers
715 views

Syscall from ntdll.dll

I am begginer in RE and also in Win NT world. I used IDA to disassemble ntdll.dll from Win XP SP 3. I care about non oficially documented function NtCreatePort which creates LPC port. I would find out ...
3
votes
2answers
1k views

What are the difference syscall and int 0x2E instructions?

From this question: How does the Windows Native API communicate with the kernel? Here is an example of ZwClose(HANDLE Handle); system call in NTDLL.DLL in Windows 10 X86_64: NtClose proc ...
0
votes
1answer
181 views

Windows : Which process sent TCP/IP packet?

How do I find out which process has sent TCP/IP network packet? Are there some tools that can easily do this? Like in Linux.
1
vote
1answer
286 views

VirtualProtect failed to revert protections on mrdata section of ntdll, why?

i perform a loop in assembly where i am parsing the sections of ntdll change their memory permissions with VirtualProtect and then revert them back to their original permissions. the code looks like ...
0
votes
1answer
416 views

IDAPython Script works from “Script File” but not when run with -S from Terminal

I'm trying to run an IDAPython script in IDA 7.1 on Windows 10 and it runs just fine when I run it from the Script File... command, but if when I run it from the command line it isn't working properly....
3
votes
1answer
213 views

Is there a tool to reconstruct .reloc section?

Seems like unpacking UPX manually is not a trivial task any more, due to ASLR and the need to recover the relocation table. So, before reinventing the wheel, I'd like to know if there's already some ...
1
vote
1answer
67 views

RtlCheckSandboxedToken

Does anyone know what is the purpose of RtlCheckSandboxedToken() in ntdll.dll, i cannot find any documentation, its prototype is: NTSYSAPI NTSTATUS NTAPI RtlCheckSandboxedToken( _In_opt_ HANDLE ...
1
vote
1answer
127 views

How to set hardware breakpoint by value?

I want to set in IDA breakpoint when a specific value is written on the stack. I know how to set hardware breakpoint, but I can set it only by address.
0
votes
2answers
84 views

How are images found inside DLLs accessed? [closed]

Sometimes a program displays images that don't exist as jpegs or bmps that come with the program so they have to be residing inside the exe itself or inside a DLL that comes with the program. So My ...
1
vote
1answer
317 views

Game's anti-cheat complains when driver test-signing mode is on

I use Windows 7 64 bit, thus in order to load a test-signed driver, I need to enable test-signing mode. My driver bypasses some of the game's anti-cheat features to allow me to run a debugger and ...
1
vote
2answers
166 views

How to reach functions triggered by non-standard buttons?

I've already read related posts such as: link1: https://stackoverflow.com/questions/24138087/how-can-i-set-a-breakpoint-for-a-button-click-using-ollydbg link2: How can I set a breakpoint for a button ...
1
vote
1answer
243 views

Injecting exe file into process fails on windows 7 but works on windows 10 / Execution library function fails, access denied

I'm trying to inject my executable payload into remote process. I allocated memory in remote process, I converted raw payload using RVA addressing. I applied relocations and imports table. When I'm ...
0
votes
1answer
44 views

How to protect memory area, not segment or page!

I want to protect the certain memory area, like 0x12345678 ~ 0x12345679. so if another thread accesses to that area, I want to generate exception. To solve my problem, I've found and used ...
2
votes
1answer
179 views

Missing kernel32.dll in import table

I have very basic application which is console app dispaying message box. In Visual Studio I change following options: - C/C++ -> SecurityCheck -> Disable Security Check (/GS-) - Linker -> ...
1
vote
1answer
64 views

Is there any way to call function instead of breakpoint, when certain memory area is accessed or register value is matched?

I am studying assembly and hooking. I know how to hook x86 assembly now. so if any thread goes to certain address which is overwritten with my code, it automatically returns to my function. I think ...
1
vote
1answer
237 views

What is ObjectStublessClientXX in ole32dll?

When I do dynamic reversing I saw usage with ObjectStublessClientXX in ole32.dll . What is that function? What does it do? Is there any way that it supposed to transfer message between 2 processes? ...
0
votes
1answer
242 views

When to create a keygen versus when to bypass the security jumps

I am a newbie reverse engineer. I was wondering: assuming I want to crack a program (With the permission of the author of course) and I have detected the Assembly where the program begins to check the ...
2
votes
1answer
562 views

Trap Flag - Anti-debugging trick

I am trying to reverse a program which is employing some kind of anti-debugging trick based on the use of SEHs and the TF. The code stars with: So apparently it's generating an exception with XOR ...
1
vote
0answers
149 views

Immunity error BB010002

I am trying to make this exploit work and having some difficulty. So I skipped to a 'fixed' version of it from here and the only thing I changed was the shell code: https://github.com/cokebottle/oscp-...
2
votes
0answers
55 views

Catch connection string between exe and mdb

I have an exe file that read and write from a local DB file. I checked this file with Detect It Easy and it shows that this is a mdb file. I can open this file with microsoft access, and watch all ...
2
votes
2answers
3k views

What is the difference between IDA and OllyDbg?

When I want to debug an exe in Windows, what advantages does OllyDbg have over IDA? In IDA, I'm using the WinDbg debugger back-end.
3
votes
2answers
194 views

Why doesn't this retn instruction return from the function?

I disassembled an exe file on Windows with IDA and saw this function prologue: I see that when the retn executes instead of returning it jumps to sub_1314cba4. Why doesn't the retn instruction ...
1
vote
1answer
260 views

How debug process that not started with ida? [duplicate]

I am trying to debug two different exe files,in windows. The first exe launches the second, and the second exe doesn't work well unless the first starts it. I want to be able to debug the second exe....
0
votes
2answers
390 views

How to breakpoint exe tcp packet

I am debugging an executable in windows with IDA. My exe sends a TCP packet and I want to see which function it uses to send the packets. I looked on the import tab and haven't found any function ...
2
votes
2answers
155 views

Is there a good place to search information about known DLLs?

I'm just starting in learning some Reverse Engineering and there are a lot of DLLs being imported or called at runtime and I'd like to know what they do. I would have expected that there would be ...
1
vote
2answers
152 views

How to stop debugging while a specific value is on the stack?

I'm debugging an .exe file with IDA , and always I see specific value in my stack , for ex. AABBCCDDEEFF . That value interests me, I want to know where this value comes from, how it gets pushed onto ...
2
votes
1answer
606 views

How to see all my comments on idb file

I add some comments to exe file with ida(save on idb). Is there any simple way how to see all my comments in 1 windows?
5
votes
1answer
858 views

How to make type libraries from Windows 10 SDK and DDK?

I want to make type libraries from Windows 10 SDK and DDK version 16299 and/or 17134. I saw this tutorial TILIB - utility to create type libraries for IDA. Then I downloaded it from IDA Support: ...
1
vote
1answer
308 views

How to move one step back in a debugger

When I debug a .exe file on Windows with IDA, I do it step by step. Can I move one step back and reset all the registers and stack to what they were one instruction ago? By the way, when I'm looking ...
2
votes
2answers
690 views

What is the difference between Windbg and local debugger in IDA

When I want to debug an .exe on Windows with IDA I can choose between Windbg or local debugger. What is the difference? By the way, is there any difference if I use Windbg tool (windows software) ...
2
votes
1answer
66 views

How to identify when a function is being called using IDA?

I'm debugging a .exe file on Windows with IDA's debugger. How can I identify when the code calls the random() function?
3
votes
1answer
181 views

Unable to use CreateRemoteThread in target process

I'm trying to get a debugger attached to a malware, but it seems to pick up whenever a new remote thread is created (which makes it so I can't use Scyllahide). Even if I suspend all threads, it does ...
12
votes
3answers
616 views

Trying to understand this construct in Dbgv.sys driver for DbgView tool

I'm trying to reverse the Dbgv.sys (x86 kernel driver) for the DbgView tool. It has this sub_10D4A function that is called almost at the beginning of the driver's DriverEntry function. It goes as such:...
1
vote
1answer
222 views

Reverse engineering a VST to learn about signal processing and hopefully help me make my own.

I have been trying to simply open and view the source code for a VST I am researching as I hope to create my own VST sometime in the future. I have two .dat files which I presume contain the audio ...
4
votes
0answers
776 views

Windows 10 v.1803 boot failure after trying to install network kernel debugging with WinDbg Preview

I'm trying to set up kernel debugging on a physical hardware/desktop to test the new WinDbg Preview. Here's the steps: I'm using a desktop with Intel DG41TY board. Installed Windows 10 Pro build 1803....
1
vote
0answers
73 views

Decompiling DotNet2JScript malware?

I've got a .NET malware sample that was transpiled to JScript using DotNet2JScript. The .NET malware assembly was serialized to binary form using BinaryFormatter and then embedded into the JScript ...
1
vote
1answer
357 views

How do TDBCtrlGrid or TDBCtrlPanel Borland Delphi controls add new text rows?

I am trying to reverse engineer an old native application written in Borland Delphi in order to modify it for my needs: The application interfaces with the special hardware and displays events that ...
1
vote
0answers
123 views

Prevent windbg from context switching when stepping into assembly instructions

When I'm using Windbg (in kernel mode) to step into assembly, I would encounter context switching once in a while - which is annoying. So, for example, I placed a breakpoint for a process - let's ...
3
votes
1answer
160 views

ntoskrnl checksum mismatch

I had hex-edited windows kernel file c:\windows\system32\ntoskrnl.exe to fix some assembly bytes in the way i need it. System wont boot because of STATUS_IMAGE_CHECKSUM_MISMATCH error (0xC0000221; ...
3
votes
2answers
380 views

Is pointer decryption possible?

I’m pretty new to reverse engineering, so bear with me... I’m trying to get a few struct definitions (or whatever they’re called) from this one binary. After some time fiddling around with it, I’ve ...