Questions tagged [windows]
Windows refers to the Microsoft Windows series of operating systems.
735
questions
2
votes
1answer
142 views
I can't set a hardware breakpoint on RIP + N-byte after calling NtContinue()
#include <Windows.h>
int handle_exception (EXCEPTION_POINTERS *exception_pointers) {
exception_pointers->ContextRecord->Rip += 4;
return EXCEPTION_CONTINUE_EXECUTION;
}
int main (...
4
votes
1answer
883 views
Reverse engineer Listen to this device on Windows - Reverse engineer Windows when there's no API
I'm writing an Autohotkey script to toggle Listen to this device for my microphone, without interacting with a GUI.
I thought it would be a simple registry key being modified so I used RegShot to ...
2
votes
1answer
259 views
Hiding a file in a Windows operating system
I am trying to understand how to hide a file in windows as a way to learn about win api and malware analysis.
What I am trying to do is to make a file "disappear" via some kind of manipulation. But I ...
0
votes
3answers
147 views
What is the best way to change the call-graph of a PE file without changing its real behavior and without packing it?
What i want to do is take a PE file, extract its call-graph, and then inject a junk function in it, so for example by injecting a junk function inside of it, and changing a call instruction's opcode ...
0
votes
0answers
242 views
How can I debug code execution on a Native->Unity/Mono/C# Application
I'm reverse engineering a Windows application which has a main executable that appears to run some boilerplate/stub code before calling UnityMain and also using Mono. This means that if I use an ...
0
votes
3answers
450 views
How To Identify Which Process Is Being Written To With WriteProcessMemory?
Basically, I cannot find which process is being written to when WriteProcessMemory is being called.
Currently I'm Setting Breakpoints on WriteProcessMemory and OpenProcess. However, the process handle ...
2
votes
1answer
311 views
Anti-debug clearing hardware breakpoints
An application I am debugging somehow manages to clear my hardware breakpoints. I am using TitanHide and x64dbg.
I am observing the following behaviour:
When placing the first hw breakpoint, it is ...
1
vote
2answers
256 views
NOPed encrypt/decrypt functions in a Path of Exile client and now it crashes without message. Next step?
I am reversing an old Path of Exile client with the purpose of building an emulator. I managed to reach the character select screen in a newer, 64-bit client but I am struggling to make the same ...
1
vote
0answers
57 views
Possible to inject a new menu into a program's menu bar?
Is it be possible to inject a new menu/menu item into a program's menu bar?
As an example, in Notepad's (Windows) "Help" menu, would it be possible to add a new entry to that menu like "Open ...
1
vote
1answer
297 views
Adding a static variable to Windows DLL
I'm trying to patch a function in a Windows x86 DLL, however it turned out that I need a static variable to store some state that wasn't correctly preserved by the original executable across calls.
I ...
-1
votes
1answer
294 views
Why cant we find ransomware keys?
From my understanding most ransomware has a secret key used for encryption in a server which it contacts to send over the key and use it for encryption
But I am wondering, couldn't someone easily ...
1
vote
1answer
77 views
Executable code in the same location differs in memory and on disk
I'm trying to inject code to change the byte value of a CMP in an executable from 0 to 2 at runtime, in order to effectively no-op a boolean comparison as part of an effort to insert my own behavior. ...
3
votes
1answer
297 views
Reverse old win32 app to find encryption vulnerability
I’m trying to reverse engineer an old win32 application used on SCADA and ICS (Industrial Control Systems). This app has a silly encryption function to protect the user password to prevent ...
1
vote
0answers
57 views
How does this wannacry sample work?
I downloaded wannacry sample here: https://github.com/fadyosman/WannaCrySample/releases. Don't forget to enter password for archive.
I figured out how most of the binary works, except the very last ...
1
vote
0answers
91 views
Find High Entropy VA (64-bit ALSR) Incompatibility in Disassembly
Have a 64-bit plugin DLL (no source code) and the host application in an update changed its DLL characteristic to include "high-entropy 64-bit address space layout randomization (ASLR)" When this is ...
1
vote
0answers
47 views
Memory modified at jump far
Observing a trace of Wow64 switching on Windows 7, the following situation makes me confused
...
0x77491dbe 64 ff 15 c0 00 00 00 call fs:[0xc0] ; syswow64\ntdll.dll
0x74632320 ea 1e 27 63 ...
0
votes
2answers
474 views
How to compare two different executions of the same file?
When i start the program by just double clicking the .exe, it has a certain behavior. This behavior differs when i start the program from running the launcher provided. I’d like to figure out how to ...
1
vote
1answer
80 views
How to track/debug/manipulate Windows processes in a VM?
I am trying to make some deep-level windows debuggig/tracing, utilizing virtualization.
Considering that if a Windows runs in a virtual machine, theoretically I have total power over it - I could ...
1
vote
1answer
94 views
How did Kaspersky replicate UAC overlay on Windows XP [closed]
How did Kaspersky replicate UAC overlay on Windows XP? Here is the screenshot to what I relate to,
Upon encountering the overlay,
If you click outside the "attention" Window, system will beep and ...
0
votes
2answers
249 views
Is it possible to use a program's GUI abilities without the GUI?
Is it possible to use/call programs' GUI abilities directly without using the GUI (programmatically, not by keyboarding)?
For example, a program with abilities nested too deeply in cascading submenus:...
1
vote
0answers
111 views
Why can I inherit handles from WSASocketA and not from socket?
I'm trying to write some custom shellcode to obtain a shell from a program.
Looking at the program intermodular calls, I found a call to socket(), and my initial plan was to use that to create a new ...
1
vote
1answer
582 views
Where can you find the name of a driver causing a kernel mode crash?
I am in an interesting situation. I have very limited Windows kernel experience, so I just don't know what data structure to look for in order to find what I need to know.
There is a driver that is ...
0
votes
1answer
107 views
Can a program's memory be dumped and then reinserted?
Is it possible to dump a running program's memory (Windows OS), and then later "reinsert" that memory when the program is run again?
1
vote
0answers
83 views
Finding PEM passphrase that may be in an executable?
I'm trying to capture the TLSv1.2 traffic of an application. In the applications directory is the file cacert.pem that I assume holds the cert for decrypting the TLS traffic. I tried to load it into ...
1
vote
2answers
319 views
Call function by ebp
When I looking at exe file with Ida I see
call dword ptr [ebp -70p]
What is that? Why this function calling by ebp and not call sub_0xabcd
How can I know which function is that to enter to this ...
3
votes
1answer
332 views
IAT vs GOT address resolving: which of them resolve during runtime and which during load time by default?
So based on my knowledge on windows apps, as far as i know the IAT gets filled with correct addresses when the library gets loaded (correct me if I'm wrong)
now in linux, they use GOT, and again ...
0
votes
0answers
87 views
Intel Pin assertion failed: RTN_Valid(x)
I am working on modifying my Intel Pin based tool. As before I am using VS2015 on Windows 10. Previously, I have been testing a tool on the same system where I build it and it worked just fine. The ...
1
vote
1answer
282 views
mfc140 dll , what is the usage?
While I open exe file in ida I can see lot of calls to mfc140_6153
or mfc140_8718.
What are those functions ? what they do ?
thanks
2
votes
1answer
432 views
Get NonPagedPool (NPP) Base Address on any Windows OS
Is there a way to get the the base(start) address of the NonPagedPool in Windows ?
I know that it's dynamic for Post windows 7 Operating Systems (Does this include Windows server 2008 ?)
0
votes
0answers
53 views
Alternative APIs to hook instead of messagebox for message pop ups?
So i am reversing an app that pops up a message at some point, but its not doing this using messagebox
i also tried to pause and then run to user code but didn't work, so what are some of the other ...
0
votes
2answers
421 views
Is relocation table only used for absolute addresses?
I was reading about mapped and unmapped PE format, and how the alignment between sections changes after loading it into memory and that caused two question for me:
is the relocation table used before ...
0
votes
2answers
61 views
Which APIs are responsible for terminating process icons in Taskbar?
I am trying to reverse and debug a program but it exists after certain point, tried setting breakpoint on any inter module call that starts with exit or terminate, now here's the weird part :
it does ...
-1
votes
2answers
218 views
How to add a message box to a PE [closed]
So, I have a "simple" question. I have this PE that I want to show a message box when the file is launched. How can I patch the file and make the window? Thanks!
0
votes
1answer
418 views
Can GUI elements of a running program be found/located in memory?
Is it possible for a particular GUI element of a running program (on Windows platform) to be located in memory, such as a text element from a dialog box? For example, locating title text of a drop-...
0
votes
1answer
392 views
Possible to get address of DRIVER OBJECT programmatically?
I am looking into getting the address of a dispatch routine. For example, I can get it with windbg easily like so:
0: kd> !drvobj HEVD 2
Driver object (ffffa70752fdbe30) is for:
\Driver\HEVD
...
2
votes
2answers
338 views
Find a instruction in a binary file (PE) based on a virtual address of a string reference
English is not my first language, so I'm sorry if my text isn't so clear.
I'm trying to program an automatic patcher for a PE binary that should work for multiple versions of this executable. For ...
1
vote
1answer
298 views
I'm trying to understand the SEH mechanism
I'm trying to understand the mechanism of SEH (Structured Exception Handling). I understood how it was recorded and saved in FS: [0] on the previous three instructions. But why add interrupt 1 (step ...
4
votes
1answer
1k views
__security_cookie for function pointers in Windows 10
I'm curious about this __security_cookie that I keep seeing all over the msvcp140.dll from my Windows 10 x64 (insider build.)
Here's an example:
Note that the address for indirect function call (or ...
2
votes
3answers
294 views
Injecting C++ code, while also maximizing compatibility with other injections
Using the New Vegas Script Extender C++ API for Fallout New Vegas, I am able to write to the process' memory directly at runtime through a .dll plugin that's loaded by the NVSE injector. But it is not ...
1
vote
0answers
126 views
How to identify the NonPagedPool Start Memory address from a memory dump
I need to find the memory address where starts the NonPagedPool. I saw some people doing it with Rekall, but I'm having a lot of problems with it.
Is that possible with Volatility ?
Tks
1
vote
3answers
3k views
How to find the starting address of text section of a DLL inside a process? (64 bit)
There was a question about this a year ago, but the answer doesn't explain how to do it in C/C++:
How to find start of .text section?
I'm not talking about module start address, which we can get ...
0
votes
0answers
425 views
injecting through APC using LdrLoadDll fails on `CiValidateImageHeader`
I've encountered an image validation error while trying to inject dll from
driver which add apc task to be performed by alertable thread. the function task include calling to LdrLoadDll with the ...
1
vote
2answers
616 views
Does the loader fill the IAT table of an .exe in load time by checking the corresponding export tables or during run time?
I came upon this question :
Can we hook the Nt or Zw functions using IAT hooking, or just inline hooking?
and it got me wondering, lets say for some reason some function was not in the IAT of our ...
0
votes
1answer
751 views
Can we hook the Nt or Zw functions using IAT hooking, or just inline hooking?
So i was trying to hook the ZwQuerySystemInformation or NtZwQuerySystemInformation using IAT, but i found out that these are not inside the IAT inside the memory nor in the PE file
but maybe i am not ...
2
votes
1answer
199 views
How to hide a process from all the methods of getting the list of processes?
So it seems that there are a lot of ways of getting the process list, although I'm not sure whether in the low level do they acquire them from same place or not
so these are the ways i know :
...
1
vote
1answer
427 views
Why address 7FFE0308 always gets compared in 64bit applications before making a syscall in Ntdll?
So there was a question asked before about this :
What are the difference syscall and int 0x2E instructions?
and it has two answer, one says that is just a way to check if we are in a 32 bit or 64 ...
1
vote
1answer
146 views
What is the ending bytes in the MOV instruction in 32 bit applications in windows? (B8 mov)
So i just compared NTterminateProcess between 32 and 64 bit version of a program, and the mov instruction which moves the syscall into eax is almost the same, both 5 byte, (both the B8 mov) but the ...
0
votes
1answer
219 views
PE Header: What do SizeOfHeapCommit and SizeOfHeapReserve do?
SizeOfHeapReserve and SizeOfHeapCommit are in the optional header of windows executables. They are set to 0x100000 and 0x1000 respectively in most executables (my firefox has 0x40000 as reserve for ...
1
vote
1answer
102 views
What does BindImageEx actually do?
Docs.
If I understand this correctly, this function pre-computes virtual addresses of imported DLLs and writes them to the IAT of an image (provided that BIND_NO_UPDATE is not set as parameter). My ...
1
vote
1answer
224 views
Getting started with RE, with eventually goal being able to make a keygen [closed]
I want to get started in RE and eventually want to be able to figure out how to calculate a serial from a username/license number from program number, etc... (meaning the software tests the serial ...
