Questions tagged [windows]
Windows refers to the Microsoft Windows series of operating systems.
614
questions
0
votes
1answer
343 views
Windows : Which process sent TCP/IP packet?
How do I find out which process has sent TCP/IP network packet?
Are there some tools that can easily do this? Like in Linux.
1
vote
1answer
385 views
VirtualProtect failed to revert protections on mrdata section of ntdll, why?
i perform a loop in assembly where i am parsing the sections of ntdll change their memory permissions with VirtualProtect and then revert them back to their original permissions. the code looks like ...
0
votes
1answer
798 views
IDAPython Script works from “Script File” but not when run with -S from Terminal
I'm trying to run an IDAPython script in IDA 7.1 on Windows 10 and it runs just fine when I run it from the Script File... command, but if when I run it from the command line it isn't working properly....
3
votes
1answer
316 views
Is there a tool to reconstruct .reloc section?
Seems like unpacking UPX manually is not a trivial task any more, due to ASLR and the need to recover the relocation table. So, before reinventing the wheel, I'd like to know if there's already some ...
1
vote
1answer
80 views
RtlCheckSandboxedToken
Does anyone know what is the purpose of RtlCheckSandboxedToken() in ntdll.dll,
i cannot find any documentation,
its prototype is:
NTSYSAPI
NTSTATUS
NTAPI
RtlCheckSandboxedToken(
_In_opt_ HANDLE ...
1
vote
1answer
157 views
How to set hardware breakpoint by value?
I want to set in IDA breakpoint when a specific value is written on the stack.
I know how to set hardware breakpoint, but I can set it only by address.
0
votes
2answers
90 views
How are images found inside DLLs accessed? [closed]
Sometimes a program displays images that don't exist as jpegs or bmps that come with the program so they have to be residing inside the exe itself or inside a DLL that comes with the program. So My ...
1
vote
1answer
486 views
Game's anti-cheat complains when driver test-signing mode is on
I use Windows 7 64 bit, thus in order to load a test-signed driver, I need to enable test-signing mode.
My driver bypasses some of the game's anti-cheat features to allow me to run a debugger and ...
1
vote
2answers
189 views
How to reach functions triggered by non-standard buttons?
I've already read related posts such as:
link1: https://stackoverflow.com/questions/24138087/how-can-i-set-a-breakpoint-for-a-button-click-using-ollydbg
link2: How can I set a breakpoint for a button ...
1
vote
1answer
434 views
Injecting exe file into process fails on windows 7 but works on windows 10 / Execution library function fails, access denied
I'm trying to inject my executable payload into remote process.
I allocated memory in remote process, I converted raw payload using RVA addressing. I applied relocations and imports table.
When I'm ...
0
votes
1answer
45 views
How to protect memory area, not segment or page!
I want to protect the certain memory area, like 0x12345678 ~ 0x12345679.
so if another thread accesses to that area, I want to generate exception.
To solve my problem, I've found and used ...
2
votes
1answer
216 views
Missing kernel32.dll in import table
I have very basic application which is console app dispaying message box.
In Visual Studio I change following options:
- C/C++ -> SecurityCheck -> Disable Security Check (/GS-)
- Linker -> ...
1
vote
1answer
73 views
Is there any way to call function instead of breakpoint, when certain memory area is accessed or register value is matched?
I am studying assembly and hooking.
I know how to hook x86 assembly now.
so if any thread goes to certain address which is overwritten with my code, it automatically returns to my function.
I think ...
1
vote
1answer
329 views
What is ObjectStublessClientXX in ole32dll?
When I do dynamic reversing I saw usage with ObjectStublessClientXX in ole32.dll .
What is that function? What does it do?
Is there any way that it supposed to transfer message between 2 processes? ...
0
votes
1answer
365 views
When to create a keygen versus when to bypass the security jumps
I am a newbie reverse engineer.
I was wondering: assuming I want to crack a program (With the permission of the author of course) and I have detected the Assembly where the program begins to check the ...
2
votes
1answer
864 views
Trap Flag - Anti-debugging trick
I am trying to reverse a program which is employing some kind of anti-debugging trick based on the use of SEHs and the TF. The code stars with:
So apparently it's generating an exception with
XOR ...
1
vote
0answers
169 views
Immunity error BB010002
I am trying to make this exploit work and having some difficulty.
So I skipped to a 'fixed' version of it from here and the only thing I changed was the shell code:
https://github.com/cokebottle/oscp-...
2
votes
1answer
108 views
Catch connection string between exe and mdb
I have an exe file that read and write from a local DB file.
I checked this file with Detect It Easy and it shows that this is a mdb file.
I can open this file with microsoft access, and watch all ...
2
votes
2answers
5k views
What is the difference between IDA and OllyDbg?
When I want to debug an exe in Windows, what advantages does OllyDbg have over IDA?
In IDA, I'm using the WinDbg debugger back-end.
3
votes
2answers
242 views
Why doesn't this retn instruction return from the function?
I disassembled an exe file on Windows with IDA and saw this function prologue:
I see that when the retn executes instead of returning it jumps to sub_1314cba4.
Why doesn't the retn instruction ...
1
vote
1answer
487 views
How debug process that not started with ida? [duplicate]
I am trying to debug two different exe files,in windows.
The first exe launches the second, and the second exe doesn't work well unless the first starts it.
I want to be able to debug the second exe....
0
votes
2answers
611 views
How to breakpoint exe tcp packet
I am debugging an executable in windows with IDA.
My exe sends a TCP packet and I want to see which function it uses to send the packets.
I looked on the import tab and haven't found any function ...
2
votes
2answers
219 views
Is there a good place to search information about known DLLs?
I'm just starting in learning some Reverse Engineering and there are a lot of DLLs being imported or called at runtime and I'd like to know what they do. I would have expected that there would be ...
1
vote
2answers
208 views
How to stop debugging while a specific value is on the stack?
I'm debugging an .exe file with IDA , and always I see specific value in my stack , for ex. AABBCCDDEEFF .
That value interests me, I want to know where this value comes from, how it gets pushed onto ...
3
votes
1answer
966 views
How to see all my comments on idb file
I add some comments to exe file with ida(save on idb).
Is there any simple way how to see all my comments in 1 windows?
5
votes
1answer
1k views
How to make type libraries from Windows 10 SDK and DDK?
I want to make type libraries from Windows 10 SDK and DDK version 16299 and/or 17134. I saw this tutorial TILIB - utility to create type libraries for IDA. Then I downloaded it from IDA Support: ...
1
vote
1answer
462 views
How to move one step back in a debugger
When I debug a .exe file on Windows with IDA, I do it step by step.
Can I move one step back and reset all the registers and stack to what they were one instruction ago?
By the way, when I'm looking ...
2
votes
2answers
1k views
What is the difference between Windbg and local debugger in IDA
When I want to debug an .exe on Windows with IDA I can choose between Windbg or local debugger.
What is the difference?
By the way, is there any difference if I use Windbg tool (windows software) ...
2
votes
1answer
69 views
How to identify when a function is being called using IDA?
I'm debugging a .exe file on Windows with IDA's debugger.
How can I identify when the code calls the random() function?
3
votes
1answer
215 views
Unable to use CreateRemoteThread in target process
I'm trying to get a debugger attached to a malware, but it seems to pick up whenever a new remote thread is created (which makes it so I can't use Scyllahide).
Even if I suspend all threads, it does ...
12
votes
3answers
695 views
Trying to understand this construct in Dbgv.sys driver for DbgView tool
I'm trying to reverse the Dbgv.sys (x86 kernel driver) for the DbgView tool. It has this sub_10D4A function that is called almost at the beginning of the driver's DriverEntry function. It goes as such:...
1
vote
1answer
319 views
Reverse engineering a VST to learn about signal processing and hopefully help me make my own.
I have been trying to simply open and view the source code for a VST I am researching as I hope to create my own VST sometime in the future. I have two .dat files which I presume contain the audio ...
4
votes
0answers
827 views
Windows 10 v.1803 boot failure after trying to install network kernel debugging with WinDbg Preview
I'm trying to set up kernel debugging on a physical hardware/desktop to test the new WinDbg Preview. Here's the steps:
I'm using a desktop with Intel DG41TY board.
Installed Windows 10 Pro build 1803....
1
vote
0answers
86 views
Decompiling DotNet2JScript malware?
I've got a .NET malware sample that was transpiled to JScript using DotNet2JScript. The .NET malware assembly was serialized to binary form using BinaryFormatter and then embedded into the JScript ...
1
vote
1answer
505 views
How do TDBCtrlGrid or TDBCtrlPanel Borland Delphi controls add new text rows?
I am trying to reverse engineer an old native application written in Borland Delphi in order to modify it for my needs:
The application interfaces with the special hardware and displays events that ...
1
vote
0answers
149 views
Prevent windbg from context switching when stepping into assembly instructions
When I'm using Windbg (in kernel mode) to step into assembly, I would encounter context switching once in a while - which is annoying.
So, for example, I placed a breakpoint for a process - let's ...
4
votes
1answer
232 views
ntoskrnl checksum mismatch
I had hex-edited windows kernel file c:\windows\system32\ntoskrnl.exe to fix some assembly bytes in the way i need it.
System wont boot because of STATUS_IMAGE_CHECKSUM_MISMATCH error (0xC0000221; ...
3
votes
2answers
546 views
Is pointer decryption possible?
I’m pretty new to reverse engineering, so bear with me...
I’m trying to get a few struct definitions (or whatever they’re called) from this one binary. After some time fiddling around with it, I’ve ...
1
vote
0answers
47 views
Threads blocking in kernel when I attach, can't control them
I'm attaching to a simple program and the new thread breaks at DbgBreakPoint as expected. I'm using x64dbg (32-bit). The problem is, when I go to the Threads window it shows all the threads' EIPs as ...
0
votes
1answer
568 views
IDA Pro v7 installation problem in VM
I have different problem.
I created VM (windows7x86SP1) with VMware Fusion on Mac OSX. When I try to install IDA Pro, I have a such a error. But I couldn't find any solution. I removed VM than ...
1
vote
1answer
237 views
Reverse engineering a USB Fight Stick
I am completely new to reverse engineering. I have a Razer Atrox Xbox One Fight Stick that I purchased recently. It does not work with windows 10 with the drivers installed by Microsoft version (10....
1
vote
1answer
111 views
Cannot load driver to memory
I'm trying to unpack some windows driver but I can't load it to memory. I tried OSRLoader, ProcessHacker and my own loader and all returns ERROR_FILE_NOT_FOUND at OpenService. What's strange, other ...
0
votes
1answer
792 views
Radare2 cannot debug on windows 7
I downloaded radare 2.5 for windows. I am trying to debug a binary on windows with radare and have tried the following:
radare2 -d a.exe
fork_and_ptraceme/CreateProcess: The request is not supported.
...
1
vote
0answers
223 views
Failed to set breakpoint (Anti-debug protection)
Sorry for my bad English in advance.
There is a program that has some protection. The problem is I can not set hardware and software breakpoints in x64dbg (to be more precise - not everywhere), cuz ...
1
vote
1answer
466 views
identifying function prototype from dll
I have an exe file and a dll file. This exe file uses the dll to decode input file. This exe file is gui based and does not support command line execution.
So my requirement is to create a program ...
-2
votes
2answers
147 views
Looking for reverse engneer online course [duplicate]
I looking for online reverse engeneer course.
Course that study ida,reverse and patch for windows/ linux.
Working with ida and another tool.
I like many videos lesons.
Do you know one?
1
vote
3answers
614 views
Remove a mutex on windows (with debugger/disassembler)
I'd like to patch an app to avoid it to use/create a specific mutex, because this one prevents the app from running in multiple instances. I'm already able to close the mutex's handle with a program ...
0
votes
2answers
300 views
How to obtain memory address of string literal?
I am trying to find where a specific string literal is used in a compiled program. I have already found the location of this string literal within the executable; I want to somehow deduce what the ...
0
votes
2answers
887 views
Windasm32 cant allocate enough memory to display 151680 lines
Hey I was using Windasm32 today and I loaded a .dll file and it told me this
I tried to increase my virtual memory on windows 10 to 12000 and the max to 12000 and restarted the computer and ran ...
-1
votes
1answer
266 views
how to find the strings values in a comparision using ollydbg
In OllyDbg 1.10 (assembler level deubugger) I can find all referenced text strings
The program compare if a user input string is equal a internal string.
When I debug the program, I can't find the ...
