Questions tagged [windows]
Windows refers to the Microsoft Windows series of operating systems.
576
questions
1
vote
0answers
45 views
Threads blocking in kernel when I attach, can't control them
I'm attaching to a simple program and the new thread breaks at DbgBreakPoint as expected. I'm using x64dbg (32-bit). The problem is, when I go to the Threads window it shows all the threads' EIPs as ...
0
votes
1answer
485 views
IDA Pro v7 installation problem in VM
I have different problem.
I created VM (windows7x86SP1) with VMware Fusion on Mac OSX. When I try to install IDA Pro, I have a such a error. But I couldn't find any solution. I removed VM than ...
1
vote
1answer
214 views
Reverse engineering a USB Fight Stick
I am completely new to reverse engineering. I have a Razer Atrox Xbox One Fight Stick that I purchased recently. It does not work with windows 10 with the drivers installed by Microsoft version (10....
1
vote
1answer
90 views
Cannot load driver to memory
I'm trying to unpack some windows driver but I can't load it to memory. I tried OSRLoader, ProcessHacker and my own loader and all returns ERROR_FILE_NOT_FOUND at OpenService. What's strange, other ...
0
votes
1answer
657 views
Radare2 cannot debug on windows 7
I downloaded radare 2.5 for windows. I am trying to debug a binary on windows with radare and have tried the following:
radare2 -d a.exe
fork_and_ptraceme/CreateProcess: The request is not supported.
...
1
vote
0answers
177 views
Failed to set breakpoint (Anti-debug protection)
Sorry for my bad English in advance.
There is a program that has some protection. The problem is I can not set hardware and software breakpoints in x64dbg (to be more precise - not everywhere), cuz ...
1
vote
1answer
352 views
identifying function prototype from dll
I have an exe file and a dll file. This exe file uses the dll to decode input file. This exe file is gui based and does not support command line execution.
So my requirement is to create a program ...
-2
votes
2answers
140 views
Looking for reverse engneer online course [duplicate]
I looking for online reverse engeneer course.
Course that study ida,reverse and patch for windows/ linux.
Working with ida and another tool.
I like many videos lesons.
Do you know one?
1
vote
3answers
415 views
Remove a mutex on windows (with debugger/disassembler)
I'd like to patch an app to avoid it to use/create a specific mutex, because this one prevents the app from running in multiple instances. I'm already able to close the mutex's handle with the app ...
0
votes
2answers
211 views
How to obtain memory address of string literal?
I am trying to find where a specific string literal is used in a compiled program. I have already found the location of this string literal within the executable; I want to somehow deduce what the ...
0
votes
2answers
511 views
Windasm32 cant allocate enough memory to display 151680 lines
Hey I was using Windasm32 today and I loaded a .dll file and it told me this
I tried to increase my virtual memory on windows 10 to 12000 and the max to 12000 and restarted the computer and ran ...
-1
votes
1answer
197 views
how to find the strings values in a comparision using ollydbg
In OllyDbg 1.10 (assembler level deubugger) I can find all referenced text strings
The program compare if a user input string is equal a internal string.
When I debug the program, I can't find the ...
1
vote
1answer
846 views
Tracing function calls in x64dbg
I'm new with x64dbg and want to know if there is any way to get the trace of a functions inside a module?
I've used trace over option, but basically it just traces all the insturctions but doesn't "...
1
vote
1answer
115 views
Static Offset in PE
I am making a crackme, that get's hexadecimal values and converts it to ASCII to get the password.
The problem is I use a part of code into the main function to search the opcodes from .text section ...
0
votes
2answers
76 views
Magic number in resource loading routine
I'm practicing windows disassembly on x64 notepad.exe
I've managed to find buffer allocation and string resources load.
But after that follows code, which I can't fully understand:
rbx = 0, rdx = 0 ...
0
votes
1answer
83 views
Where are the arguments to this D3D11CreateDeviceAndSwapchain call stored in x64?
I have been trying to reverse a singleplayer x64 game to learn about reversing games. My problem is that I am trying to trace the arguments from a D3D11CreateDeviceAndSwapchain call and as far as I ...
2
votes
1answer
115 views
Windows x86 compability on x64 operating system
I know some about wow64 system, in x64 windows version, and i looked up into this wow64* dlls, to see how the actual syscall transition happen, but something i can't find, and this is probably done by ...
1
vote
0answers
59 views
How do I hook API to get realtime stock price data?
How I can hook SSL API from proprietary software.
I want to extract realtime stock price data from stock trade software that provided by securities company.
There is no API in this software. And ...
2
votes
1answer
113 views
Is there a command in Windbg which prints MINIDUMP_MISC_INFO_N from the Windows mini dumps?
There's time zone information in windows dumps stored in MINIDUMP_MISC_INFO_N, yet I couldn't find the command which prints this information in windbg. So, I have to extract this information from the ...
1
vote
1answer
2k views
Running script on the command line with IDA Pro 7.0
I'm trying to run a script with IDAPython on Windows:
PS: C:\Users\user\Downloads> ida.exe -S"tmp.py" -t
>>
PS: C:\Users\user\Downloads>
and I had to press Ctrl+C to get out of the >&...
2
votes
1answer
105 views
What other methods can be used to find file paths in an executable?
I'm hacking a game in my library (Mirror's Edge) to re-route where the save data is located. I've done this with many other games successfully, but this one has me stumped. Normally, I start with HxD ...
1
vote
1answer
219 views
How to set bp in a dll which loads later in pykd?
I am using pykd to debug an application which loads a dll only when some condition is met. How do I set a breakpoint in the dll which has not loaded yet in pykd such that my handler gets the callback? ...
0
votes
1answer
3k views
[windbg]kd - sxe ld <dll> from a process context won't fire
I'm trying to stop at a specific module load from a kernel debugger inside a specific process context.
What i do is to first set sxe ld [process-name] let's say calc.exe.
Now, when I run calc it ...
0
votes
1answer
2k views
How is CreateProcessAsUser impersonation implemented in Windows services?
CreateProcessAsUser is often used by Windows services in case an executable is started that the user has specified in order to run it with Medium Integrity Level to ensure privilege isolation.
...
0
votes
1answer
205 views
2 Stage Shellcode Embedded in Doc file [Out Of Memory - Can't extract it]
So, here is the context: All start with a RTF file that has 3 objects. The first one loads a non-ASLR module "MSCOMCTL.OCX" and uses it to succed on a Heap Spray technique so it allocates enough ...
0
votes
1answer
184 views
Is it possible to use an xref on memory address in IDA Pro?
Say, if I have the following disassembly:
How do I find out where else is that byte at [eax+0xFCA] is referenced? I can't seem to use the IDA's xref command on it, but doing xref on fs:18h gives me ...
5
votes
3answers
2k views
Batch disassembling DLL and EXE files?
In %SYSTEMROOT%, there are about 2000 DLL and EXE files. I am looking into reverse engineering some of them which are dependencies of other applications.
However, what I would preferably want is ...
2
votes
2answers
522 views
Is there a ProcMon style program for Kernel-Mode?
Is there any way to monitor kernel-mode code execution on Windows with a program like Process Monitor or is that something for WinDbg only?
2
votes
2answers
71 views
Can we see local variable directly by inspecting the disk image (file in disk)?
As far as I know, global and static variables are stored in heap memory, while local variables are on stack memory. I think this is the case when we speak about a binary file (like PE) that is located ...
4
votes
1answer
2k views
Reverse Engineering Windows PowerBuilder Binaries
I recently stumbled across a binary file built using Sybase PowerBuilder 12.5 and I am looking for any assistance in reversing it as it's actually quite different than a typical C++ binary. I'm ...
3
votes
1answer
303 views
If we have IMAGE_IMPORT_DESCRIPTOR, Is the IAT redundant?
Since each IMAGE_IMPORT_DESCRIPTOR already points to a RVA for the resolved virtual addresses the IAT seems to be redundant. Why is this data directory included? If I overwrite the RVA/size for the ...
1
vote
2answers
79 views
Can a Data Type Span Multiple Virtual Pages? (Windows)
Can a multi-byte primitive data type (ie int, double, float, etc) span multiple virtual pages on Windows?
ex) The first 4-bytes of a double on a virtual page, and the next 4-bytes of a double on the ...
3
votes
1answer
1k views
How to step into kernel code from a user-mode code using IDA Pro and WinDbg as a debugger?
I'm using IDA Pro and WinDbg as a debugger to step through a WinAPI from a user-mode code. I can do all this, except that when the assembly code encounters the syscall instruction (that enters ring-0 ...
2
votes
1answer
1k views
How to change the strings in rdata section of a executable file?
I'm a programmer and have an application (an executable file that maybe compiled from a c++ source).
It has an rdata section (read-only data section) that include many (several thousand) strings of ...
1
vote
1answer
64 views
HighWaterNumberOfObjects/Handles meaning?
I've been looking at some kernel debugging and came to see this:
0: kd> dt nt!_OBJECT_TYPE ffffd0851aad6c90
+0x000 TypeList : _LIST_ENTRY [ 0xffffd085`1aad6c90 - 0xffffd085`1aad6c90 ]
...
3
votes
1answer
136 views
Why does this function calls offset move when I restart windows
Every time I restart windows it breaks the patch I've made to an executable where I've called a function from the dll user32.dll. Currently the offset for the function call resides at 0x76E3CDB4, but ...
2
votes
0answers
87 views
How to track events of any software
Softwares use libraries (sdl, wxwidgets, gtk etc.) that handle events.
as keystroke and mouse.
I have a software that when clicking on a button, an annoying noise is reproduced
how do I find the ...
2
votes
0answers
160 views
Calling original function that uses unconventional calling convention
I'm using MinHook to hook a static function with the following signature:
float __usercall RadarManager::Add_Blip@<xmm0>(int position@<ecx>, int shape@<edx>, int colorId, float ...
0
votes
1answer
38k views
How to decompile an exe file? [duplicate]
I have been wondering, if every program is based on machine code, can we not decompile a program until it hits machine code and make it up to real programming languages?
How to decompile exe files ...
0
votes
1answer
281 views
What do I need to know in order to reverse-engineer software on Windows? [duplicate]
My question is: What do I need to know in order to reverse-engineer software on Windows? I have knowledge of Assembly already and now what else I need to learn? Also, can you recommend any book/...
4
votes
3answers
2k views
Reverse engineering USB peripheral driver
I'm looking to reverse engineer a Windows driver for a printer I have here. I found out a bit about USB sniffing but I don't think Snoopy runs on Windows 7. I know the driver is on my computer ...
1
vote
1answer
278 views
Why do debuggers sometimes not show entire call stack?
There is something I am not understanding. Why do debuggers sometimes show only part of the call stack? The ones I tried are WinDbg and OllyDbg.
Let me explain what I mean. Consider this example:
I ...
3
votes
2answers
893 views
Disassembling at a memory address
I started to use radare2 to debug a PE file because it stops working as soon as I run it. When I attach my debugger and continue execution to the point where the exception is thrown I get a memory ...
1
vote
1answer
275 views
See how classes are used in a Unity 3D game [closed]
I'm trying to understand how the procedural generation in a particular Unity 3D game works. I do not have the source code/project file, just a windows build.
I've opened up a dll called Assembly-...
0
votes
2answers
73 views
Tracing the last written value of a memory location without slowdown
I'm trying to debug the corruption of a linked list structure inside of a Win32 DLL with IDA Pro and Hexrays. The offending assembly traverses a doubly-linked list forwards checking a condition, and ...
6
votes
2answers
3k views
Struggling between syscall or sysenter ( Windows )
As i understand, from windows xp, there is a sysenter instruction introduced, instead of 'int 2e' interrupt. But on win 10 there is syscall instruction used in ntdll. So is the sysenter used only for ...
1
vote
2answers
3k views
What is \Sessions\1\BaseNamedObjects\NamedBuffer?
I see those in a debugger (OllyDbg, handles subwindow), but I never meet an explanation on what those are.
Here is the full content of it, and to be honest I want to know the meaning of all of this. ...
3
votes
2answers
4k views
How to edit and modify a class with ILSpy + Reflexil
In the Maxsea.SmartDesktop.dll, I want to edit and modify class b1g.
There is this in :
if (isCrackedResult != null && isCrackedResult.IsCracked)
and I want to modify for this :
if (...
4
votes
2answers
308 views
Kernel debug - internet explorer in kernelmode?
My setup: Windows 10 with windbg and target machine is Windows 7 N SP1. I'm debugging via com (i know it's slow ;).
So I get the process list with !process, one active process is Internet Explorer:
...
3
votes
1answer
1k views
Where ES/GS/FS are pointing to?
As far as I know those segments are extra or general. But at which part of program memory they are actually pointing? If I undestand it correctly DS is poining at entry point of Dump, SS stands for ...
