Questions tagged [windows]
Windows refers to the Microsoft Windows series of operating systems.
675
questions
0
votes
2answers
197 views
Find Target to Call Dword Ptr in 16-bit Windows with IDA Pro
Looking for suggestions on steps that could be used to identify what code would get executed at call dword ptr es:[bx+0Ch] from static analysis.
cseg04:3044 loc_105D4: ; ...
1
vote
1answer
170 views
Find Reference To Resource String In Windows 3.1 16-bit DLL with IDA Pro
Experimenting Visual Basic 4 in DosBox + Windows 3.1 running on Windows 10. While I have installed SHARE.exe from MS-DOS 6.22 and it seems to run OK, it still fails to detect it.
The error I get is : ...
1
vote
0answers
88 views
Downgrade HTTPS (strip SSL ) to HTTP on Windows (if possible) [closed]
Long Question: I have an Android app: https://transfer.sh/mY240/com.phonegap.voyo.apk
which connects to an API: http://www.24ur.com/lbin/WebApp/Popplus/Android.php
the problem is the api authors are ...
0
votes
0answers
228 views
find a video file in memory dump of a process
I have a player that plays encrypted video files and works like this:
I open an encrypted video file with it
it decrypts the video file and writes it to its memory
and plays the file from the memory ...
1
vote
0answers
76 views
Dump the value of register into file
I've reverse engineering little game on windows 32bit.
I found a string in executable which was interesting for me (it is a board game and this string represents the fact that somebody made a move ...
1
vote
1answer
322 views
ACCESS_VIOLATION when attaching a debugger
I'm debugging a software and it hits access violation on wcslen function under debugger but runs normally without it.
First I thought It had some anti-debug trick, but I could not found any ...
0
votes
1answer
305 views
ASCII strings not showing up in CPU in OllyDbg, but rather in dump
I'm pretty much new to the Reverse Engineering and assembly language. I've watched some videos about OllyDbg and cracking serial numbers in programs and I got interested in them and I want to learn ...
0
votes
1answer
115 views
'local call from' in x64dbg
In OllyDbg there was a thing called "local call from xxx,xxx,xxx,xxx ... " which helps me know from where a function is being called in the entire module. Does such a feature exist in x64dbg as well?
0
votes
1answer
86 views
accessing nt!Kd_DEFAULT_MASK using dbh.exe
I would like to set the value of the above variable to 0xFFFFFFFF using command line. I was exploring dbh.exe and believe it will atleast give some clues on where the symbol is. But when I try the ...
2
votes
3answers
448 views
Debug program using peculiar anti-debugging technique
In my BA thesis, I wanted to present a program for Windows, using various anti-debugging techniques.
One of them, which I came up on my own (possibly it is well known, but I didn't find it anywhere) ...
1
vote
1answer
352 views
Analyzing Windows kernel driver
I'm trying to analyze some Windows kernel driver. What I want to achieve is full execution trace, from driver entry to end point. Driver is heavily virtualized and contains multiple anti-debugging ...
0
votes
0answers
62 views
Output address path during .exe execution
I have an obfuscated software. I'm a beginner in this area, so I don't find where a patch would be useful for what I want to do.
It turns out that I have an idea of how I could find out in which ...
2
votes
1answer
124 views
Missing Symbols RtlGetFrame, RtlPushFrame, RtlPopFrame
I'd like to use some undocumented symbols that listed in ProcessHacker project. taken from Here:
https://github.com/processhacker/processhacker/blob/master/phnt/include/ntpebteb.h#L241
https://...
0
votes
0answers
105 views
Help reverse engineering a small (60kb) .exe file used for extracting .tga images from a custom container
The executable grabs the specified container format and extracts .tga images from it. It was community-made to satisfy a certain niche, unfortunately I cannot get into contact with the original ...
4
votes
1answer
5k views
How do I import function signatures to Ghidra?
I'm working with an .exe which imports the old DirectX DLL DDRAW.DLL. The problem is, Ghidra doesn't know about it and shows all imported DDRAW functions as having no parameters. I know, I can edit ...
3
votes
1answer
109 views
GetWindowLongPtr with undocumented nIndex of -1
I'm trying to reverse functionality of scrollbars in comctrl32.dll and I keep witnessing them calling GetWindowLongPtr function with undocumented index -1 as such:
Does anybody know what that ...
0
votes
1answer
76 views
Windows GUI app without GetMessage imported?
I am currently trying to reverse an app and I have one very stupid question I cannot figure out by myself.
The app was packed using FSG 2.0 and I successfully manually unpacked it and rebuilt the IAT ...
8
votes
1answer
2k views
Can I define custom enum-type to be used in Ghidra as a data type?
I'm trying to learn Ghidra. Say, if it generated the following code for loading functions from an array of function names from gpfnCommCtrlAPI:
I was able to retype gpfnCommCtrlAPI into char*[14] ...
2
votes
0answers
63 views
How can I dump the output of this register , the MSR - IA32_VMX_PROCBASED_CTLS2 , to see whether unrestricted guest mode is supported/enabled?
How can I dump the output of this register , the MSR - IA32_VMX_PROCBASED_CTLS2 , to see whether unrestricted guest mode is supported/enabled?
Context is curiosity.
I'm aware that Docker in the ...
2
votes
2answers
1k views
windbg - Why does the GS register resolve to offset 0x0?
I'm trying to understand how to resolve segment addressing (specifically the GS register in X64).
My toy program:
int main()
{
unsigned long long x;
__debugbreak();
x = __readgsqword(...
1
vote
1answer
717 views
windbg - What is the relation between the VAD (!vad), the PTEs (!pte), and loaded modules and sections (lm and !dh)?
[cross-posted (but closed the original) from https://stackoverflow.com/q/55438806/254959]
I'm trying to gain a better understanding on Windows process memory, and have some gaps with regards to the ...
1
vote
0answers
140 views
Detouring with Unreal Engine 4, importing exe functions
I'm not sure that this is the right SO community to be asking this in, but I thought I'd give it a try. Some friends and I have successfully detoured a game built with UE4 by loading a modified ...
0
votes
3answers
391 views
Most efficient way to begin analyzing malware binary
I'm taking a reverse engineering course and the class has just been given a big project where we have to analyze a packed malware binary. I am using a Windows 10 VM. I am a little confused on where to ...
1
vote
2answers
700 views
How can I enumerate and hook into a Windows 10 RPC interface?
Suppose that I have a certain Windows service that I know exposes a local RPC interface. I want to create a client program that calls into these procedures; however, I do not have the source code for ...
10
votes
2answers
5k views
How to load symbols from a symbol server in Ghidra?
I've been trying to learn Ghidra by attempting to reverse the comctl32.dll system library, which has many of its functions documented. I started the de-compilation analysis in it, and after a while it ...
6
votes
1answer
594 views
Detecting protected processes and critical processes from windows driver
I've got a driver that tamper user-space processes by sending APC calls upon process start using the call PsSetCreateProcessNotifyRoutine.
I wish to avoid tampering with any process that is critical ...
1
vote
1answer
57 views
Startdard singleton class implementation generate access to TLS memory
I'v examine the assembly output in Windows of basic singleton implementation of using static variable to be initialized with new class instance from static function.
to my surprise, although the ...
1
vote
1answer
277 views
How to get IOCTLs from all NtDeviceIoControlFile function call?
Inspired by this answer about RE-ing IOCTLs, I tried to get the IOCTLs from
NtDeviceIoControlFile() syscall. Here is an example of that syscall
in Beep() function in KernelBase.dll file:
In x86_64 (...
1
vote
2answers
1k views
How to inject JavaScript into a browser with Frida?
I'm learning how to use Frida, and would like to do something basic like inject JavaScript into a browser on Windows to list all running tabs. It seems like it should be possible as Frida allows you ...
1
vote
1answer
91 views
When can trapping be used?
This is the beginning of one of the functions inside NTDLL of Windows XP:
MOV EDI,EDI
PUSH EBP
MOV EBP,ESP
...
The book on reverse engineering I am reading(Eldad Eilam - Reversing: Secrets of ...
1
vote
0answers
63 views
Set Breakpoint on ActiveX Property Being Set (No Symbols)
A program is loading an VB6 based ActiveX control that has several property, for example ConnectionString.
The application is dynamically generating the values it provides at runtime, so it is not ...
1
vote
1answer
499 views
How does ASLR in Windows work?
I had recently this situation where in a program I was debugging I found:
03CD38D4: 8B15 8C5FF703 MOV EDX, DWORD PTR DS:[3F75F8C]
If I look for these bytes in the physical file I found nothing. I ...
0
votes
1answer
306 views
Remote debugger for Linux from one VM (IDA) to another (running the debuggee)
I want to debug a Linux program (ELF), but my IDA Pro is on a Windows 10 VM and I want to use remote debugging to debug the program on Ubuntu (also in a VM).
So, is it possible to debug if both ...
0
votes
1answer
63 views
Finding “controller vibration” function in game
I want to build a "force feedback chair" for Need for Speed: Payback, so I thought about hooking the function responsible for the controller vibration and sending the motor speed parameter to a motor ...
0
votes
1answer
2k views
x64dbg - Conditional breakpoint based on function argument
How can I set a conditional breakpoint based on the argument of a function?
I am trying to break on the windows function LoadLibraryExW: https://docs.microsoft.com/en-us/windows/desktop/api/...
0
votes
1answer
145 views
The callstack does not show the message handler
After clicking a button or doing anything which might generate a message to be translated and dispatched, why is that the callstack might not show the message handler?
Say I am reversing an ...
0
votes
1answer
75 views
x64dbg “System” meaning
I'm a bit confused about what "system" refers to when looking at the callstack in x64dbg. Does it mean the code is currently being executed in ring0? I thought that only system calls are executed in ...
0
votes
1answer
2k views
How to export function from exe file?
I open exe file (running on Windows) in Ida , and saw a function (for example sub_ABC) that I want to export , so I can call this function from c# code.
How can I export function that I Know the name ...
3
votes
1answer
200 views
How to wrap dump process and execute it in another PC
I debug exe file in Ida , and put breakpoint in some address.
I want to create a dump of this process that I can continue running it in another Pc (without Ida) from the point I pause it with ...
2
votes
1answer
227 views
dongle check happen before a debugger start debugging
i'm trying to fake the test ( dongle exist )
but one problem that i encounter is that the application detect it before i start debugging it .
this is what happen with more details : open( not ...
4
votes
3answers
725 views
How to run part of exe file that is being reversed
I reverse exe file with IDA, there is a function (that is running some other function) that I don't want to understand how it works, but I want to run it.
How can I run an exe file from a specific ...
2
votes
1answer
1k views
What is the difference between kernelBase.dll and Kernel32.dll
What is the difference between kernelBase.dll and Kernel32.dll in system32 folder ?
Why both of them implement WideCharToMultiByte ?
1
vote
1answer
207 views
Find address of kernel function
Let's say I have a kernel driver abc.sys. I do not have the symbols for abc.sys. In IDA, I find a function sub_1400AAAAA and I want to find this in WinDbg. I attach WinDbg (kd) and then type lm. I ...
0
votes
1answer
2k views
How to run ida in windows xp
I tried to install IDA 6.6 on Windows XP VM. After the installation I get that this is not a valid win 32 application.
I search and found that IDA is not supported with Windows XP.
How can I run IDA ...
4
votes
3answers
2k views
Get interface definition of undocumented COM objects
I have started exploring COM objects, initially I got to it from UAC bypass methods but I guess my question is general. The general question is: How can I get from (elevated) CLSID in the registry to ...
3
votes
1answer
258 views
Questions about enabling special pool on win32k
So there is win32k.sys, win32kbase.sys, win32kfull.sys in Windows 10
Does verifier /driver win32k.sys /flags 0x1 enable special pool on all three drivers? (win32k.sys is kinda like stub to other ...
1
vote
1answer
1k views
I want to decompile a exe and change the code to not need Admin to run
I want to decompile an .exe and change the code to not need Admin to run. I know that it does something with:
<requestedPrivileges>
<requestedExecutionLevel
level="requireAdministrator"
...
3
votes
0answers
179 views
int 2eh instead of syscall/sysenter [duplicate]
I have been looking into ntdll.dll on windows 10 x64 bit, and i noticed a check inside the ntdll like this:
So after testing some bit, it tries to execute the system call via int 2eh. I have tried to ...
12
votes
2answers
3k views
What kind of code would produce this assemby with loads of jump statements?
00EE16CC . E9 DFBB0000 JMP BinFile.00EED2B0
00EE16D1 . E9 64AF0000 JMP <JMP.&MSVCP140D.?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@>
00EE16D6 . E9 15DB0000 JMP BinFile....
2
votes
1answer
207 views
Finding the main function without symbols
for a C/C++ program compiled on windows using the x86 architecture, what is the best way to find the main function within disassembled code?
I've found various answers to questions similar to this, ...
