Questions tagged [windows]
Windows refers to the Microsoft Windows series of operating systems.
576
questions
3
votes
2answers
2k views
How to do Global DLL injection
How can one go about injection of a DLL into every process? Can SetwindowsHookEx() do the trick? Does AppInit_DLLs work as it used to?
3
votes
0answers
83 views
Reconstructing Assembly Truth Map
So I recently read [1] which evaluates several disassemblers. The truth/test binaries are generated by the SPEC CPU 2006 Benchmark suite. The authors provide detailed build instructions for the ELF ...
0
votes
1answer
798 views
Opening Windows 10 DMP file
Which program would you success to open a Windows 10 .DMP file.
I've tried OllyDbg110(32Bit)
but this is the result:
Do I have to use a 64bit debugger or am I on a totally wrong route?
4
votes
2answers
1k views
What could be the purpose of XORing esp with a global variable? (stack canary protection)
I am currently looking at a function inside a Win32 executable's main module. After allocating memory on the stack (sub esp) and saving some registers on the stack, the value of esp is XORed with a ...
1
vote
2answers
593 views
Calling a function of a game inside a function hook
How can you call a game function inside a function hook?
For example, I hooked the recv function of winsock. Then, I examined a packet. This packet has the value of my current hp. I check the hp. If ...
1
vote
1answer
368 views
What does NtSetInformationKey do in the Windows Native API? [closed]
ProcMon lists RegSetInfoKey as an "operation" on the registry. Process Monitor operations do not necessarily map directly to Native symbols, however, it seems that this operation uses ...
0
votes
2answers
95 views
I Need to force windows to the front So I can dump Hasp Dongle on program that runs at boot
I am trying to dump a hasp dongle on a popular arcade machine. I can only get a portion with the game not running. If I ctrl alt del while game is already running I get a memory crash. What is the ...
8
votes
1answer
3k views
How to investigate Windows 32/64bit (WOW64) transition
There is surprisingly little information about Windows WOW64 mechanism.
I'm trying to investigate it.
So when we have system call in 32-land, it calls an address that is stored in FS, which leads us ...
2
votes
1answer
791 views
How can I modify binary image resource data?
I've been hacking and modding software for years and have learned alot, but there are still a few things that vex me, this is one such case. I have noticed that some PEs contain an RCData section that ...
2
votes
2answers
147 views
Does IMAGE_FILE_SYSTEM actually means System file
I have some concerns related to Characteristics flag IMAGE_FILE_SYSTEM of IMAGE_FILE_HEADER structure.
According to all specs it says that file having this set is System file. However it doesn't ...
2
votes
2answers
739 views
Packed PE file and weird Header
I'm new to reverse engineering, so I don't know if my question will be easy or not.
Right now I have an exe file, but it seems packed. In the hex Dump I do have the followings :
000003d0: 0055 5058 ...
8
votes
1answer
994 views
How does the Windows Native API communicate with the kernel?
The windows Native API (Ntdll.dll) is a user-mode library. However, it is the final user-mode library that interfaces with the kernel. How does it actually interface with the kernel and bridge the gap ...
5
votes
1answer
2k views
How tools like PEiD find out the compiler and its version.
How tools like PEiD and CFF explorer find out the compiler and its version.
I am analyzing a executable file. Which shows: Borland Delphi 3.0
But the section names .text .rsrc. Which is usually ...
0
votes
1answer
707 views
How can I insert bytes with OllyDbg?
I am developing a game in GameMaker: Studio and have run into a minor problem. No matter what I do, the games output payload is generated, named, and referenced as data.win. I would like to name it ...
2
votes
1answer
244 views
Invalid INDX entries for $I30 on NTFS harddisk
While parsing my NTFS formatted hard disk, I found some invalid entries of INDX while Windows is still able to list all the root directory contents!
The structure of the Index Record in NTFS 3.1 is ...
1
vote
0answers
240 views
What do malicious programs use the ESENT registry key for?
I was analyzing a piece of malware and noticed it created this registry key.
hkey_local_machine\software\microsoft\ esent\process{malware file name}\debug
Some googling told me that esent is just a ...
3
votes
1answer
212 views
How can WinDbg be used to troubleshoot program loading?
I have a stubborn PE file which I cannot get to load. The PE headers seem to be intact and the file even parses fine in several PE tools. I am receiving a "Invalid Win32 Application" error when I try ...
1
vote
1answer
138 views
Find the code used when you right click and select “Bring To Front” in Task Manager
How can I find out what code is being called when you right click on a process in Windows Task Manager, and click on "Bring To Front" ?
This is related to https://stackoverflow.com/questions/45046765/...
2
votes
0answers
598 views
What conditions can create the “Not a Valid Win32 Application” error message upon load?
I'm doing research on the PE format/Windows Loader and I am unable to locate specifics as to what creates the error "Not a valid Win32 Application" followed by a failure to load.
I've tried changing ...
3
votes
1answer
798 views
Debugger always paused in ntdll
I'm a beginner at reverse engineering so any help would be appreciated. I apologise if a similar question has already been asked or if this is a dumb question, but I couldn't find anything.
I have ...
2
votes
2answers
837 views
Obtain .exe/.dll/.sys for a given .pdb file
If I have an executable file (let's say ntoskrnl.exe) I can obtain it's .pdb file from Microsoft. Is it possible to do the reverse? If I have a .pdb can I obtain the .exe? Or the only method is to ...
0
votes
2answers
760 views
Trying to call a function in an unknown DLL
My goal is far from nefarious. After several polite attempts to try and get Lenovo to implement a proper keyboard backlight control, I've had no response.
They do have a Windows Store app which adds ...
3
votes
0answers
362 views
What does fs register value mean in x86 application? [duplicate]
I know that FS points to Thread Environment Block - which is seen by the address at the right part of what OllyDbg shows:
What does this value 0x53 mean? Does it have some connection with the address ...
1
vote
0answers
108 views
Reverse engineering proprietary database file format .IDF
I have an old (I think) Windows software on a cd-rom, that is basically a database and its interface for show the data it contains.
I don't like the software view interface, want to make my own with ...
2
votes
1answer
2k views
Is it possible to extract / read a variable out of a running .exe file?
I am completely new to Windows programming so please excuse any naivety on my part when asking this question. I'll briefly describe my situation and then hopefully you'll be able to answer my question....
0
votes
1answer
55 views
Are Windows Store Apps in a VM and can they be identified by PE header info?
I have no experience with Windows Store Apps and there appears to be limited info out because they are still relatively new.
I have 3 questions:
When I open a store app in analysis tools such as PE ...
0
votes
1answer
974 views
Ollydbg: Function name list like in IDA
I'm new with reverse engineering and especially with Ollydbg, I have little experience with IDA and currently trying to get used to Olly. My questions are: 1.Is there any window which would show ...
4
votes
2answers
553 views
What PE anomalies can crash the Windows Loader or cause a file to not load?
I do malware analysis on Windows. I run hundreds of Windows PEs per day and it is actually relatively common for a file to not run (or sometimes not run on just one specific version of Windows) and I ...
1
vote
0answers
71 views
Where can I get a good description about windows build-in exe programs like wupdmgr.exe?
I was checking the Strings for Lab01-04.exe from Practical Malware Analysis and I found wupdmgr.exe and I face this every time I search for an exe.
Is there any "msdn" alike repository but for exe ...
1
vote
1answer
467 views
windows kernel debugging on Mac host (using VirtualBox)
I'm running on MacOS Sierra (version 10.12.4). And I created two virtual machine on Virtualbox (version 5.1.22).
1- Host Machine : Windows 10 Pro x64 (I installed Windows Driver kit 10)
2- Target ...
2
votes
2answers
2k views
Immunity debugger anti anti debug
I using Windows, and I was wondering what is the best anti anti debug plugin that exist,
I tried to use hidedebug by Bob -> Team PEiD, but unfortunately it catch only the regular ways, I know that ...
-1
votes
1answer
477 views
IDA Pro: Converting structure to decimal
I'm new with IDA pro and have little problem. Right click on some data in .rdata brings options in which I can convert, In that window D means decimal B means binary and so on, but I have multiple Ds ...
-2
votes
1answer
281 views
Crack an executable in PE [closed]
So I noticed that I can write something in PE from the executable
For example if I write 1911 he tells me
[!]Cracked By RAZOR 1911
But if I write something else it will not tell me anything. What ...
3
votes
1answer
1k views
explain the vulnerable code used by EternalBlue SMB attack
The recent WannaCry ransomware attack exploited a vulnerability in older Windows SMB code. The presumably reverse-engineered function that has been cited 1 as vulnerable is as follows:
unsigned int ...
1
vote
2answers
1k views
newbie trying to understand disassembled code
I have been writing small C programs and then disassembling them to try to understand what is actually happening under the hood.
I am using mingw-w64 on Windows 7 for my work, and I have run into a ...
1
vote
1answer
67 views
Copy Export Symbols From Mac to Windows PE
I have both a Mac and Windows version of the same library. However, while the Mac version has export symbols, the Windows version exports by ordinal. The Mac version uses the PPC architecture making ...
1
vote
0answers
188 views
X64 ASSEMBLY - Cannot run compiled and linked raw shellcode in Windows
After using metasploit's windows/x64/meterpreter/reverse_tcp shellcode on my windows 10 machine (with AVs turned off), I decided to try to create a hand-made polymorphic, null-free and custom-encoded ...
1
vote
1answer
194 views
What are ways to find Windows constant macro definitions?
This happens a lot where when I am reversing a program in a disassembler or debugger, I run into something like this:
push eax ; lParam
push 1 ; wParam
push 80h ...
1
vote
0answers
114 views
Using the AND operator to find a heap allocation size, Fermin's formula
I came across this technique, leveraging the HPA feature (Heap Page Allocator, known as PageHeap) in gflags from Windows debugging tools, to find the size of a heap allocation:
Lets say you have ...
3
votes
3answers
575 views
How to debug ServiceMain function of a service?
I have a malware which is checking for keyboard type and locale information.
After that, it creates a service with BinaryPathName as malware's exe address. After creating a service, malware starts it ...
1
vote
2answers
757 views
Can corrupted PE files be executed in some versions of Windows but not others?
I'm doing some research on corrupted PE files and I wanted to hear your thoughts and experiences with them. I've been processing a ton of samples which are essentially corrupted Windows Portable ...
2
votes
2answers
1k views
IOCTL Code for Windows driver
Recently I tried to obtain OICTL Codes from the iscflashx64.sys driver and I have found it in DispatchDeviceControl function. After driver being installed and have started with SCM it displayed in ...
1
vote
1answer
286 views
Need script to analyze process dump file (windows)
I have a program written in c++, it's compiled with Visual Studio.
I have a mini dump file of a running process (process generates it using winapi MiniDumpWriteDump function).
I also have several ...
2
votes
1answer
212 views
Trying to reverse engineer teamviewer's printer driver
Unlike LogMeIn or GoToMyPC, TeamViewer does not have any driver files except for the INF and GPD files. LogMeIn and GoToMyPC have their own configuration and driver dlls, while TeamViewer uses the ...
1
vote
1answer
421 views
Get list of functions (including non-exported functions!) in running executable
I'm working on a native binary patching library. It currently works on Linux and I'm trying to add Windows support.
For that, I need to implement a way to enumerate all functions in a PE binary (EXE) ...
5
votes
3answers
634 views
Is there any websites to get malware files using YARA rules?
I want to know, Is there any websites which has malware files (Windows OS) that are detected by YARA rules?
Note: I know some websites to get android malware samples using YARA.
But, I need Windows ...
5
votes
2answers
476 views
Safe way to download a malware payload?
I'm trying to analyze a piece of malware that is most-likely a downloader. During dynamic analysis on an isolated VM network, Wireshark registered a GET request to a server for what I believe is the ...
2
votes
1answer
2k views
Get address of where process mapped in Windbg
I'm looking for the start address of where myfile.exe mapped into memory using Windbg.
For this I connected to a VMWare for kernel debugging through serial port, after that I run myfile.exe in guest ...
10
votes
1answer
2k views
What are the Vectored Continue Handlers
Practically everyone knows what Vectored Exception Handlers are, but I couldn't find a lot of information about the similar "Vectored Continue Handlers" and related functions I encountered today, such ...
0
votes
3answers
2k views
PE Sections Permissions
I wanted to know which permissions each section of the following PE Sections have (windows):
.idata
.rsrc
.data
.text
.bss
.rdata
.edata
Thanks in advance, I couldn't found an answer using google. :...
