Questions tagged [windows]

Windows refers to the Microsoft Windows series of operating systems.

Filter by
Sorted by
Tagged with
0 votes
0 answers
50 views

Windows pintool mismatch between call/ret instructions

So i've been trying to write a pintool that monitors call/ret instructions but i've noticed that threre was a significant inconsistency between the two. For example ret instructions without previous ...
user avatar
  • 13
0 votes
0 answers
103 views

How to find and edit the source of a string in a DX11 game's exe/files (debug build of the game available)

I want to find and edit the values for the motion blur effect in Naruto: Ultimate Ninja Storm 3 on PC (Windows, DX11) to be more in line with the PS3 version (and the other Storm games on PC as well). ...
user avatar
1 vote
1 answer
309 views

how could i follow a system call from a dll -> kernel driver syscall

basically i would like to follow (system calls / internal calls) that basically lands in the kernel i would like for example to debug a specific dll ex : ntdll.dll and follow it to (NtXXX) function ...
user avatar
1 vote
0 answers
36 views

PE Format - How can I delete IMAGE_IAT_DIRECTORY and the app still runs fine?

I’m doing a small research regarding PE files and while I drilled every related question or the documentation itself I couldn’t explain this issue. Why can I go to CFF explorer or some other PE ...
user avatar
0 votes
2 answers
180 views

Where do arguments 5 and 6 go in this Microsoft x64 function call?

I'm disassembling a working-as-expected compiled C program (MS/Windows x64, MinGW gcc 10.1.0). In the main function, I have the following call which passes 6 arguments to the function DotProduct: ... /...
user avatar
  • 111
1 vote
0 answers
46 views

How are AutoIT variable names stored after compiling it to a executable?

I need to write a yara rule for a autoit malware (the binary itself not the decompiled script) As far as i know the actual script is in the resource section in the RCData, but how can i find the bytes ...
user avatar
  • 212
0 votes
1 answer
277 views

How to run another IDA script using IDApython?

I'm using IDA batch scripting to run a script on a dataset of malware the problem is i need to run the VB6 idc script after auto analysis is finished, and wait for it to finish and find all the ...
user avatar
  • 212
1 vote
1 answer
970 views

How to know where a sequences of bytes are used in a .NET application with Dnspy?

There are a sequence of bytes that i need to find out where are used in dnspy i tried going to hex editor and found the bytes, but right clicking and saying go to code or structure or follow reference ...
user avatar
  • 212
2 votes
1 answer
337 views

Pe 32 Add Export function Segment by Extending with dll or Patching pe

I need to add new function inside pe32 module.dll Export Table , in dynamic way if possible ( via extending with dll ) or by patching pe32 module.dll What can u suggest to solve this ?
user avatar
2 votes
1 answer
566 views

How to debugging activeX with Ida

When I enter to some site it ask me to install ActivX to my Internet Explorer browser so this site will work well. I installed that,and that site works well. How can I see this ActiveX code(where ...
user avatar
0 votes
1 answer
78 views

Why does an executable still run despite changes to checksum, or changes to data section without new checksum?

I have a "Hello World" console app compiled with Flat Assembler. The size of the executable is 2048 bytes and the checksum is 0x3797. Questions: Does it matter if I make changes to the data section ...
user avatar
1 vote
0 answers
2k views

How to bypass SSL certificate pinning on Windows 10

When reverse engineering a big application, it can be very useful to be able to see the network traffic it generates. Because of this, many applications use HTTPS to communicate with their servers. ...
user avatar
  • 11
4 votes
1 answer
203 views

what routine in ntdll.dll is responsible of dispatching DllMain function of loaded dll?

I'm trying to debug a dll file using Ida disassembler and Windbg. I'm debugging rundll32.exe and passing the target dll (debugee) as an argument. I'm able to have a breakpoint on each Dll load & ...
user avatar
  • 43
1 vote
1 answer
207 views

What is the difference between mapped and private memory segments in xdbg? and what is a reserved segment?

So in xdbg in the memory map, i can see that some segments are mapped and some are private, at first i thought maybe mapped means it has a corresponding file on disk and its the mapped version of that,...
user avatar
  • 212
2 votes
1 answer
287 views

Get return address from syscall

I'm debugging some 32-bit process using windbg kernel debugger. This process calls some syscalls, so I set few breakpoints at kernel functions like nt!NtQuerySystemInformation. So after breakpoint hit,...
user avatar
2 votes
3 answers
286 views

How does an application identify a DLL file

Sorry if this is a basic question, as I'm very new at this. I'm trying to get an .exe to load a dummy .dll. I've created an example .dll project in VC++ 2019, added the functions listed in the .exe's ...
user avatar
  • 21
1 vote
1 answer
120 views

advapi32.dll changes name of function during forwarding of exports

Im trying myself at writing a manual mapper, for injection of DLLs into other processes. Ive come to the point, where I've written a simple "Hello World" dll, that im trying to inject into another ...
user avatar
2 votes
1 answer
115 views

What is the mdisp field in RTTI for throw used for?

First of here is the article from which I'm looking up the fields. I was trying out different combinations to see how they affect the RTTI for a C++ throw. It seems that having a virtual base class ...
user avatar
  • 425
1 vote
1 answer
158 views

Can I make a DDS image from headerless DDS data?

I have some files which I've decrypted that I believe are DDS images. These files do not have a DDS header, however the data looks similar to what I've seen in other DDS images. I believe to a great ...
user avatar
3 votes
2 answers
548 views

Windows - syscalls being called in a strange way?

I've been reading about the way syscalls are called in windows. The general theme in all the articles I read is: 64bit- called inside ntdll 32bit- from ntdll jumping to KiFastSystemcall but when I ...
user avatar
4 votes
1 answer
193 views

Where do mouse/keyboard GUI inputs get queued or stored?

Where do mouse-clicks in a program's GUI window/menus (Windows OS) get stored in memory? Is there some sort of input/GUI "queue" similar to Windows messages queuing? I'm wondering if it'd be possible ...
user avatar
3 votes
1 answer
210 views

CreateToolhelp32Snapshot() access denied (while running as admin or even NT AUTHORITY\SYSTEM)

I've come across a troublesome process which refuses to allow CreateToolhelp32Snapshot(). I also noticed that in sysinternals process explorer it shows "Access Denied" for other things too, such as ...
user avatar
  • 129
2 votes
2 answers
143 views

Modern methods of fuzzing/locating heap bugs and potential vulnerabilites

really glad I found this great learning resource. I was wondering, is there any way to fuzz or automate heap vulnerability assesment? I know a lot of practical frameworks for stack based fuzzing in ...
user avatar
2 votes
1 answer
183 views

I can't set a hardware breakpoint on RIP + N-byte after calling NtContinue()

#include <Windows.h> int handle_exception (EXCEPTION_POINTERS *exception_pointers) { exception_pointers->ContextRecord->Rip += 4; return EXCEPTION_CONTINUE_EXECUTION; } int main (...
user avatar
4 votes
1 answer
1k views

Reverse engineer Listen to this device on Windows - Reverse engineer Windows when there's no API

I'm writing an Autohotkey script to toggle Listen to this device for my microphone, without interacting with a GUI. I thought it would be a simple registry key being modified so I used RegShot to ...
user avatar
  • 91
2 votes
1 answer
293 views

Hiding a file in a Windows operating system

I am trying to understand how to hide a file in windows as a way to learn about win api and malware analysis. What I am trying to do is to make a file "disappear" via some kind of manipulation. But I ...
user avatar
  • 21
0 votes
3 answers
170 views

What is the best way to change the call-graph of a PE file without changing its real behavior and without packing it?

What i want to do is take a PE file, extract its call-graph, and then inject a junk function in it, so for example by injecting a junk function inside of it, and changing a call instruction's opcode ...
user avatar
0 votes
0 answers
311 views

How can I debug code execution on a Native->Unity/Mono/C# Application

I'm reverse engineering a Windows application which has a main executable that appears to run some boilerplate/stub code before calling UnityMain and also using Mono. This means that if I use an ...
user avatar
  • 1,625
0 votes
3 answers
544 views

How To Identify Which Process Is Being Written To With WriteProcessMemory?

Basically, I cannot find which process is being written to when WriteProcessMemory is being called. Currently I'm Setting Breakpoints on WriteProcessMemory and OpenProcess. However, the process handle ...
user avatar
2 votes
1 answer
396 views

Anti-debug clearing hardware breakpoints

An application I am debugging somehow manages to clear my hardware breakpoints. I am using TitanHide and x64dbg. I am observing the following behaviour: When placing the first hw breakpoint, it is ...
user avatar
1 vote
2 answers
312 views

NOPed encrypt/decrypt functions in a Path of Exile client and now it crashes without message. Next step?

I am reversing an old Path of Exile client with the purpose of building an emulator. I managed to reach the character select screen in a newer, 64-bit client but I am struggling to make the same ...
user avatar
1 vote
0 answers
60 views

Possible to inject a new menu into a program's menu bar?

Is it be possible to inject a new menu/menu item into a program's menu bar? As an example, in Notepad's (Windows) "Help" menu, would it be possible to add a new entry to that menu like "Open ...
user avatar
1 vote
1 answer
320 views

Adding a static variable to Windows DLL

I'm trying to patch a function in a Windows x86 DLL, however it turned out that I need a static variable to store some state that wasn't correctly preserved by the original executable across calls. I ...
user avatar
  • 111
-1 votes
1 answer
303 views

Why cant we find ransomware keys?

From my understanding most ransomware has a secret key used for encryption in a server which it contacts to send over the key and use it for encryption But I am wondering, couldn't someone easily ...
user avatar
  • 7
1 vote
1 answer
83 views

Executable code in the same location differs in memory and on disk

I'm trying to inject code to change the byte value of a CMP in an executable from 0 to 2 at runtime, in order to effectively no-op a boolean comparison as part of an effort to insert my own behavior. ...
user avatar
  • 21
3 votes
1 answer
364 views

Reverse old win32 app to find encryption vulnerability

I’m trying to reverse engineer an old win32 application used on SCADA and ICS (Industrial Control Systems). This app has a silly encryption function to protect the user password to prevent ...
user avatar
1 vote
0 answers
60 views

How does this wannacry sample work?

I downloaded wannacry sample here: https://github.com/fadyosman/WannaCrySample/releases. Don't forget to enter password for archive. I figured out how most of the binary works, except the very last ...
user avatar
1 vote
0 answers
107 views

Find High Entropy VA (64-bit ALSR) Incompatibility in Disassembly

Have a 64-bit plugin DLL (no source code) and the host application in an update changed its DLL characteristic to include "high-entropy 64-bit address space layout randomization (ASLR)" When this is ...
user avatar
1 vote
0 answers
64 views

Memory modified at jump far

Observing a trace of Wow64 switching on Windows 7, the following situation makes me confused ... 0x77491dbe 64 ff 15 c0 00 00 00 call fs:[0xc0] ; syswow64\ntdll.dll 0x74632320 ea 1e 27 63 ...
user avatar
0 votes
2 answers
570 views

How to compare two different executions of the same file?

When i start the program by just double clicking the .exe, it has a certain behavior. This behavior differs when i start the program from running the launcher provided. I’d like to figure out how to ...
user avatar
  • 1
1 vote
1 answer
99 views

How to track/debug/manipulate Windows processes in a VM?

I am trying to make some deep-level windows debuggig/tracing, utilizing virtualization. Considering that if a Windows runs in a virtual machine, theoretically I have total power over it - I could ...
user avatar
  • 179
1 vote
1 answer
98 views

How did Kaspersky replicate UAC overlay on Windows XP [closed]

How did Kaspersky replicate UAC overlay on Windows XP? Here is the screenshot to what I relate to, Upon encountering the overlay, If you click outside the "attention" Window, system will beep and ...
user avatar
  • 177
0 votes
2 answers
279 views

Is it possible to use a program's GUI abilities without the GUI?

Is it possible to use/call programs' GUI abilities directly without using the GUI (programmatically, not by keyboarding)? For example, a program with abilities nested too deeply in cascading submenus:...
user avatar
1 vote
0 answers
133 views

Why can I inherit handles from WSASocketA and not from socket?

I'm trying to write some custom shellcode to obtain a shell from a program. Looking at the program intermodular calls, I found a call to socket(), and my initial plan was to use that to create a new ...
user avatar
  • 111
1 vote
1 answer
696 views

Where can you find the name of a driver causing a kernel mode crash?

I am in an interesting situation. I have very limited Windows kernel experience, so I just don't know what data structure to look for in order to find what I need to know. There is a driver that is ...
user avatar
  • 1,216
0 votes
1 answer
117 views

Can a program's memory be dumped and then reinserted?

Is it possible to dump a running program's memory (Windows OS), and then later "reinsert" that memory when the program is run again?
user avatar
1 vote
0 answers
91 views

Finding PEM passphrase that may be in an executable?

I'm trying to capture the TLSv1.2 traffic of an application. In the applications directory is the file cacert.pem that I assume holds the cert for decrypting the TLS traffic. I tried to load it into ...
user avatar
2 votes
2 answers
399 views

Call function by ebp

When I looking at exe file with Ida I see call dword ptr [ebp -70p] What is that? Why this function calling by ebp and not call sub_0xabcd How can I know which function is that to enter to this ...
user avatar
3 votes
1 answer
424 views

IAT vs GOT address resolving: which of them resolve during runtime and which during load time by default?

So based on my knowledge on windows apps, as far as i know the IAT gets filled with correct addresses when the library gets loaded (correct me if I'm wrong) now in linux, they use GOT, and again ...
user avatar
0 votes
0 answers
101 views

Intel Pin assertion failed: RTN_Valid(x)

I am working on modifying my Intel Pin based tool. As before I am using VS2015 on Windows 10. Previously, I have been testing a tool on the same system where I build it and it worked just fine. The ...
user avatar
  • 124

1 2 3
4
5
16