Questions tagged [windows]
Windows refers to the Microsoft Windows series of operating systems.
758
questions
0
votes
0
answers
50
views
Windows pintool mismatch between call/ret instructions
So i've been trying to write a pintool that monitors call/ret instructions but i've noticed that threre was a significant inconsistency between the two. For example ret instructions without previous ...
- 13
0
votes
0
answers
103
views
How to find and edit the source of a string in a DX11 game's exe/files (debug build of the game available)
I want to find and edit the values for the motion blur effect in Naruto: Ultimate Ninja Storm 3 on PC (Windows, DX11) to be more in line with the PS3 version (and the other Storm games on PC as well). ...
1
vote
1
answer
309
views
how could i follow a system call from a dll -> kernel driver syscall
basically i would like to follow (system calls / internal calls) that basically lands in the kernel i would like for example to debug a specific dll ex : ntdll.dll and follow it to (NtXXX) function ...
- 11
1
vote
0
answers
36
views
PE Format - How can I delete IMAGE_IAT_DIRECTORY and the app still runs fine?
I’m doing a small research regarding PE files and while I drilled every related question or the documentation itself I couldn’t explain this issue.
Why can I go to CFF explorer or some other PE ...
- 133
0
votes
2
answers
180
views
Where do arguments 5 and 6 go in this Microsoft x64 function call?
I'm disassembling a working-as-expected compiled C program (MS/Windows x64, MinGW gcc 10.1.0). In the main function, I have the following call which passes 6 arguments to the function DotProduct:
...
/...
- 111
1
vote
0
answers
46
views
How are AutoIT variable names stored after compiling it to a executable?
I need to write a yara rule for a autoit malware (the binary itself not the decompiled script)
As far as i know the actual script is in the resource section in the RCData, but how can i find the bytes ...
- 212
0
votes
1
answer
277
views
How to run another IDA script using IDApython?
I'm using IDA batch scripting to run a script on a dataset of malware
the problem is i need to run the VB6 idc script after auto analysis is finished, and wait for it to finish and find all the ...
- 212
1
vote
1
answer
970
views
How to know where a sequences of bytes are used in a .NET application with Dnspy?
There are a sequence of bytes that i need to find out where are used in dnspy
i tried going to hex editor and found the bytes, but right clicking and saying go to code or structure or follow reference ...
- 212
2
votes
1
answer
337
views
Pe 32 Add Export function Segment by Extending with dll or Patching pe
I need to add new function inside pe32 module.dll Export Table , in dynamic way if possible ( via extending with dll ) or by patching pe32 module.dll
What can u suggest to solve this ?
- 272
2
votes
1
answer
566
views
How to debugging activeX with Ida
When I enter to some site it ask me to install ActivX to my Internet Explorer browser so this site will work well. I installed that,and that site works well.
How can I see this ActiveX code(where ...
0
votes
1
answer
78
views
Why does an executable still run despite changes to checksum, or changes to data section without new checksum?
I have a "Hello World" console app compiled with Flat Assembler. The size of the executable is 2048 bytes and the checksum is 0x3797.
Questions:
Does it matter if I make changes to the data section ...
user33509
1
vote
0
answers
2k
views
How to bypass SSL certificate pinning on Windows 10
When reverse engineering a big application, it can be very useful to be able to see the network traffic it generates.
Because of this, many applications use HTTPS to communicate with their servers. ...
- 11
4
votes
1
answer
203
views
what routine in ntdll.dll is responsible of dispatching DllMain function of loaded dll?
I'm trying to debug a dll file using Ida disassembler and Windbg.
I'm debugging rundll32.exe and passing the target dll (debugee) as an argument.
I'm able to have a breakpoint on each Dll load & ...
- 43
1
vote
1
answer
207
views
What is the difference between mapped and private memory segments in xdbg? and what is a reserved segment?
So in xdbg in the memory map, i can see that some segments are mapped and some are private, at first i thought maybe mapped means it has a corresponding file on disk and its the mapped version of that,...
- 212
2
votes
1
answer
287
views
Get return address from syscall
I'm debugging some 32-bit process using windbg kernel debugger. This process calls some syscalls, so I set few breakpoints at kernel functions like nt!NtQuerySystemInformation. So after breakpoint hit,...
- 103
2
votes
3
answers
286
views
How does an application identify a DLL file
Sorry if this is a basic question, as I'm very new at this.
I'm trying to get an .exe to load a dummy .dll. I've created an example .dll project in VC++ 2019, added the functions listed in the .exe's ...
- 21
1
vote
1
answer
120
views
advapi32.dll changes name of function during forwarding of exports
Im trying myself at writing a manual mapper, for injection of DLLs into other processes.
Ive come to the point, where I've written a simple "Hello World" dll, that im trying to inject into another ...
- 31
2
votes
1
answer
115
views
What is the mdisp field in RTTI for throw used for?
First of here is the article from which I'm looking up the fields.
I was trying out different combinations to see how they affect the RTTI for a C++ throw. It seems that having a virtual base class ...
- 425
1
vote
1
answer
158
views
Can I make a DDS image from headerless DDS data?
I have some files which I've decrypted that I believe are DDS images. These files do not have a DDS header, however the data looks similar to what I've seen in other DDS images. I believe to a great ...
3
votes
2
answers
548
views
Windows - syscalls being called in a strange way?
I've been reading about the way syscalls are called in windows.
The general theme in all the articles I read is:
64bit- called inside ntdll
32bit- from ntdll jumping to KiFastSystemcall
but when I ...
- 33
4
votes
1
answer
193
views
Where do mouse/keyboard GUI inputs get queued or stored?
Where do mouse-clicks in a program's GUI window/menus (Windows OS) get stored in memory? Is there some sort of input/GUI "queue" similar to Windows messages queuing?
I'm wondering if it'd be possible ...
- 169
3
votes
1
answer
210
views
CreateToolhelp32Snapshot() access denied (while running as admin or even NT AUTHORITY\SYSTEM)
I've come across a troublesome process which refuses to allow CreateToolhelp32Snapshot().
I also noticed that in sysinternals process explorer it shows "Access Denied" for other things too, such as ...
- 129
2
votes
2
answers
143
views
Modern methods of fuzzing/locating heap bugs and potential vulnerabilites
really glad I found this great learning resource.
I was wondering, is there any way to fuzz or automate heap vulnerability assesment? I know a lot of practical frameworks for stack based fuzzing in ...
- 21
2
votes
1
answer
183
views
I can't set a hardware breakpoint on RIP + N-byte after calling NtContinue()
#include <Windows.h>
int handle_exception (EXCEPTION_POINTERS *exception_pointers) {
exception_pointers->ContextRecord->Rip += 4;
return EXCEPTION_CONTINUE_EXECUTION;
}
int main (...
- 131
4
votes
1
answer
1k
views
Reverse engineer Listen to this device on Windows - Reverse engineer Windows when there's no API
I'm writing an Autohotkey script to toggle Listen to this device for my microphone, without interacting with a GUI.
I thought it would be a simple registry key being modified so I used RegShot to ...
- 91
2
votes
1
answer
293
views
Hiding a file in a Windows operating system
I am trying to understand how to hide a file in windows as a way to learn about win api and malware analysis.
What I am trying to do is to make a file "disappear" via some kind of manipulation. But I ...
- 21
0
votes
3
answers
170
views
What is the best way to change the call-graph of a PE file without changing its real behavior and without packing it?
What i want to do is take a PE file, extract its call-graph, and then inject a junk function in it, so for example by injecting a junk function inside of it, and changing a call instruction's opcode ...
- 320
0
votes
0
answers
311
views
How can I debug code execution on a Native->Unity/Mono/C# Application
I'm reverse engineering a Windows application which has a main executable that appears to run some boilerplate/stub code before calling UnityMain and also using Mono. This means that if I use an ...
- 1,625
0
votes
3
answers
544
views
How To Identify Which Process Is Being Written To With WriteProcessMemory?
Basically, I cannot find which process is being written to when WriteProcessMemory is being called.
Currently I'm Setting Breakpoints on WriteProcessMemory and OpenProcess. However, the process handle ...
- 11
2
votes
1
answer
396
views
Anti-debug clearing hardware breakpoints
An application I am debugging somehow manages to clear my hardware breakpoints. I am using TitanHide and x64dbg.
I am observing the following behaviour:
When placing the first hw breakpoint, it is ...
- 47
1
vote
2
answers
312
views
NOPed encrypt/decrypt functions in a Path of Exile client and now it crashes without message. Next step?
I am reversing an old Path of Exile client with the purpose of building an emulator. I managed to reach the character select screen in a newer, 64-bit client but I am struggling to make the same ...
- 11
1
vote
0
answers
60
views
Possible to inject a new menu into a program's menu bar?
Is it be possible to inject a new menu/menu item into a program's menu bar?
As an example, in Notepad's (Windows) "Help" menu, would it be possible to add a new entry to that menu like "Open ...
- 169
1
vote
1
answer
320
views
Adding a static variable to Windows DLL
I'm trying to patch a function in a Windows x86 DLL, however it turned out that I need a static variable to store some state that wasn't correctly preserved by the original executable across calls.
I ...
- 111
-1
votes
1
answer
303
views
Why cant we find ransomware keys?
From my understanding most ransomware has a secret key used for encryption in a server which it contacts to send over the key and use it for encryption
But I am wondering, couldn't someone easily ...
- 7
1
vote
1
answer
83
views
Executable code in the same location differs in memory and on disk
I'm trying to inject code to change the byte value of a CMP in an executable from 0 to 2 at runtime, in order to effectively no-op a boolean comparison as part of an effort to insert my own behavior. ...
- 21
3
votes
1
answer
364
views
Reverse old win32 app to find encryption vulnerability
I’m trying to reverse engineer an old win32 application used on SCADA and ICS (Industrial Control Systems). This app has a silly encryption function to protect the user password to prevent ...
- 31
1
vote
0
answers
60
views
How does this wannacry sample work?
I downloaded wannacry sample here: https://github.com/fadyosman/WannaCrySample/releases. Don't forget to enter password for archive.
I figured out how most of the binary works, except the very last ...
- 45
1
vote
0
answers
107
views
Find High Entropy VA (64-bit ALSR) Incompatibility in Disassembly
Have a 64-bit plugin DLL (no source code) and the host application in an update changed its DLL characteristic to include "high-entropy 64-bit address space layout randomization (ASLR)" When this is ...
- 1,111
1
vote
0
answers
64
views
Memory modified at jump far
Observing a trace of Wow64 switching on Windows 7, the following situation makes me confused
...
0x77491dbe 64 ff 15 c0 00 00 00 call fs:[0xc0] ; syswow64\ntdll.dll
0x74632320 ea 1e 27 63 ...
- 1,370
0
votes
2
answers
570
views
How to compare two different executions of the same file?
When i start the program by just double clicking the .exe, it has a certain behavior. This behavior differs when i start the program from running the launcher provided. I’d like to figure out how to ...
- 1
1
vote
1
answer
99
views
How to track/debug/manipulate Windows processes in a VM?
I am trying to make some deep-level windows debuggig/tracing, utilizing virtualization.
Considering that if a Windows runs in a virtual machine, theoretically I have total power over it - I could ...
- 179
1
vote
1
answer
98
views
How did Kaspersky replicate UAC overlay on Windows XP [closed]
How did Kaspersky replicate UAC overlay on Windows XP? Here is the screenshot to what I relate to,
Upon encountering the overlay,
If you click outside the "attention" Window, system will beep and ...
- 177
0
votes
2
answers
279
views
Is it possible to use a program's GUI abilities without the GUI?
Is it possible to use/call programs' GUI abilities directly without using the GUI (programmatically, not by keyboarding)?
For example, a program with abilities nested too deeply in cascading submenus:...
- 169
1
vote
0
answers
133
views
Why can I inherit handles from WSASocketA and not from socket?
I'm trying to write some custom shellcode to obtain a shell from a program.
Looking at the program intermodular calls, I found a call to socket(), and my initial plan was to use that to create a new ...
- 111
1
vote
1
answer
696
views
Where can you find the name of a driver causing a kernel mode crash?
I am in an interesting situation. I have very limited Windows kernel experience, so I just don't know what data structure to look for in order to find what I need to know.
There is a driver that is ...
- 1,216
0
votes
1
answer
117
views
Can a program's memory be dumped and then reinserted?
Is it possible to dump a running program's memory (Windows OS), and then later "reinsert" that memory when the program is run again?
- 169
1
vote
0
answers
91
views
Finding PEM passphrase that may be in an executable?
I'm trying to capture the TLSv1.2 traffic of an application. In the applications directory is the file cacert.pem that I assume holds the cert for decrypting the TLS traffic. I tried to load it into ...
2
votes
2
answers
399
views
Call function by ebp
When I looking at exe file with Ida I see
call dword ptr [ebp -70p]
What is that? Why this function calling by ebp and not call sub_0xabcd
How can I know which function is that to enter to this ...
3
votes
1
answer
424
views
IAT vs GOT address resolving: which of them resolve during runtime and which during load time by default?
So based on my knowledge on windows apps, as far as i know the IAT gets filled with correct addresses when the library gets loaded (correct me if I'm wrong)
now in linux, they use GOT, and again ...
- 320
0
votes
0
answers
101
views
Intel Pin assertion failed: RTN_Valid(x)
I am working on modifying my Intel Pin based tool. As before I am using VS2015 on Windows 10. Previously, I have been testing a tool on the same system where I build it and it worked just fine. The ...
- 124