Questions tagged [windows]
Windows refers to the Microsoft Windows series of operating systems.
676
questions
2
votes
1answer
207 views
Finding the main function without symbols
for a C/C++ program compiled on windows using the x86 architecture, what is the best way to find the main function within disassembled code?
I've found various answers to questions similar to this, ...
1
vote
0answers
310 views
Calling undocumented kernel functions directly (xxxSendInput and xxxMouseEventDirect)
In the core my question is about how to reverse engineer undocumented functions.
I want to call the function "xxxMouseEventDirect" (located in win32kfull.sys). I have already been able to collect some ...
9
votes
3answers
1k views
Is there any way to get my own image base without calling any WinAPI functions, such as GetModuleHandle?
Is there any way to get the image base of an .exe without calling WinAPI functions (i.e. imported functions) so that it can't be easily viewed in a disassembler/debugger?
I've been thinking of ...
2
votes
2answers
1k views
Wrong RVA values inside IMAGE_IMPORT_DESCRIPTOR
I load the entire PE into an std::vector<Byte> fileContent using std::fstream.
Then I obtain the executable's dos header:
IMAGE_DOS_HEADER* imageDosHeader = (IMAGE_DOS_HEADER*)fileContent.data(...
1
vote
0answers
57 views
getting %localappdata% in asm
I have an old windows x86 application that no longer works properly since windows 8. This app creates files within its own folders for things like app settings. Unfortunately, Microsoft no longer ...
2
votes
1answer
320 views
Why is the process crashing after executing my injected payload?
I tried the following payload for APC injection in Windows.
It gets executed successfully(pops up a MessageBox) but the process crashes after the execution of payload.
What could be the possible ...
0
votes
1answer
213 views
How to see all of my changes in idb?
Is there ant way to see all of my changes in idb file ?
All of variable in psudo code that I changed here name, all the funxtion I rename.
I want to see all of this
0
votes
1answer
285 views
how to find private Key and passphrase stored inside a program?
There are some files (drivers) that are encrypted, and these files are working in a program that is installed in my computer. The program using these files needs to decrypt them. I am sure that the ...
3
votes
1answer
54 views
Are the names of COFF Data Directories fixed?
I have a PE file (notepad), the NumberOfRvaAndSize value in the COFF header is 0x10, and there are 16 DataDirectory entries as expected.
The documentation says that this value can change (though I've ...
7
votes
1answer
750 views
WHY and WHEN do we need SEH for buffer overflowing
In our course in university, we recently moved on from standard buffer-overflows to SEH based ones.
My exploit is already ready and working thanks to some nice tutorials, although I am still not sure ...
3
votes
2answers
1k views
Syscall from ntdll.dll
I am begginer in RE and also in Win NT world.
I used IDA to disassemble ntdll.dll from Win XP SP 3. I care about non oficially documented function NtCreatePort which creates LPC port. I would find out ...
6
votes
2answers
3k views
What are the difference syscall and int 0x2E instructions?
From this question: How does the Windows Native API communicate with the kernel?
Here is an example of ZwClose(HANDLE Handle); system call in NTDLL.DLL in Windows 10 X86_64:
NtClose proc near
...
1
vote
1answer
472 views
Windows : Which process sent TCP/IP packet?
How do I find out which process has sent TCP/IP network packet?
Are there some tools that can easily do this? Like in Linux.
1
vote
1answer
429 views
VirtualProtect failed to revert protections on mrdata section of ntdll, why?
i perform a loop in assembly where i am parsing the sections of ntdll change their memory permissions with VirtualProtect and then revert them back to their original permissions. the code looks like ...
0
votes
1answer
1k views
IDAPython Script works from “Script File” but not when run with -S from Terminal
I'm trying to run an IDAPython script in IDA 7.1 on Windows 10 and it runs just fine when I run it from the Script File... command, but if when I run it from the command line it isn't working properly....
3
votes
1answer
437 views
Is there a tool to reconstruct .reloc section?
Seems like unpacking UPX manually is not a trivial task any more, due to ASLR and the need to recover the relocation table. So, before reinventing the wheel, I'd like to know if there's already some ...
1
vote
1answer
84 views
RtlCheckSandboxedToken
Does anyone know what is the purpose of RtlCheckSandboxedToken() in ntdll.dll,
i cannot find any documentation,
its prototype is:
NTSYSAPI
NTSTATUS
NTAPI
RtlCheckSandboxedToken(
_In_opt_ HANDLE ...
1
vote
1answer
172 views
How to set hardware breakpoint by value?
I want to set in IDA breakpoint when a specific value is written on the stack.
I know how to set hardware breakpoint, but I can set it only by address.
0
votes
2answers
93 views
How are images found inside DLLs accessed? [closed]
Sometimes a program displays images that don't exist as jpegs or bmps that come with the program so they have to be residing inside the exe itself or inside a DLL that comes with the program. So My ...
1
vote
1answer
609 views
Game's anti-cheat complains when driver test-signing mode is on
I use Windows 7 64 bit, thus in order to load a test-signed driver, I need to enable test-signing mode.
My driver bypasses some of the game's anti-cheat features to allow me to run a debugger and ...
1
vote
2answers
215 views
How to reach functions triggered by non-standard buttons?
I've already read related posts such as:
link1: https://stackoverflow.com/questions/24138087/how-can-i-set-a-breakpoint-for-a-button-click-using-ollydbg
link2: How can I set a breakpoint for a button ...
1
vote
1answer
528 views
Injecting exe file into process fails on windows 7 but works on windows 10 / Execution library function fails, access denied
I'm trying to inject my executable payload into remote process.
I allocated memory in remote process, I converted raw payload using RVA addressing. I applied relocations and imports table.
When I'm ...
0
votes
1answer
45 views
How to protect memory area, not segment or page!
I want to protect the certain memory area, like 0x12345678 ~ 0x12345679.
so if another thread accesses to that area, I want to generate exception.
To solve my problem, I've found and used ...
2
votes
1answer
252 views
Missing kernel32.dll in import table
I have very basic application which is console app dispaying message box.
In Visual Studio I change following options:
- C/C++ -> SecurityCheck -> Disable Security Check (/GS-)
- Linker -> ...
1
vote
1answer
80 views
Is there any way to call function instead of breakpoint, when certain memory area is accessed or register value is matched?
I am studying assembly and hooking.
I know how to hook x86 assembly now.
so if any thread goes to certain address which is overwritten with my code, it automatically returns to my function.
I think ...
1
vote
1answer
442 views
What is ObjectStublessClientXX in ole32dll?
When I do dynamic reversing I saw usage with ObjectStublessClientXX in ole32.dll .
What is that function? What does it do?
Is there any way that it supposed to transfer message between 2 processes? ...
0
votes
1answer
435 views
When to create a keygen versus when to bypass the security jumps
I am a newbie reverse engineer.
I was wondering: assuming I want to crack a program (With the permission of the author of course) and I have detected the Assembly where the program begins to check the ...
2
votes
1answer
1k views
Trap Flag - Anti-debugging trick
I am trying to reverse a program which is employing some kind of anti-debugging trick based on the use of SEHs and the TF. The code stars with:
So apparently it's generating an exception with
XOR ...
1
vote
0answers
174 views
Immunity error BB010002
I am trying to make this exploit work and having some difficulty.
So I skipped to a 'fixed' version of it from here and the only thing I changed was the shell code:
https://github.com/cokebottle/oscp-...
3
votes
1answer
166 views
Catch connection string between exe and mdb
I have an exe file that read and write from a local DB file.
I checked this file with Detect It Easy and it shows that this is a mdb file.
I can open this file with microsoft access, and watch all ...
4
votes
2answers
6k views
What is the difference between IDA and OllyDbg?
When I want to debug an exe in Windows, what advantages does OllyDbg have over IDA?
In IDA, I'm using the WinDbg debugger back-end.
3
votes
2answers
285 views
Why doesn't this retn instruction return from the function?
I disassembled an exe file on Windows with IDA and saw this function prologue:
I see that when the retn executes instead of returning it jumps to sub_1314cba4.
Why doesn't the retn instruction ...
1
vote
1answer
703 views
How debug process that not started with ida? [duplicate]
I am trying to debug two different exe files,in windows.
The first exe launches the second, and the second exe doesn't work well unless the first starts it.
I want to be able to debug the second exe....
0
votes
2answers
891 views
How to breakpoint exe tcp packet
I am debugging an executable in windows with IDA.
My exe sends a TCP packet and I want to see which function it uses to send the packets.
I looked on the import tab and haven't found any function ...
2
votes
2answers
273 views
Is there a good place to search information about known DLLs?
I'm just starting in learning some Reverse Engineering and there are a lot of DLLs being imported or called at runtime and I'd like to know what they do. I would have expected that there would be ...
1
vote
2answers
273 views
How to stop debugging while a specific value is on the stack?
I'm debugging an .exe file with IDA , and always I see specific value in my stack , for ex. AABBCCDDEEFF .
That value interests me, I want to know where this value comes from, how it gets pushed onto ...
3
votes
1answer
1k views
How to see all my comments on idb file
I add some comments to exe file with ida(save on idb).
Is there any simple way how to see all my comments in 1 windows?
5
votes
1answer
2k views
How to make type libraries from Windows 10 SDK and DDK?
I want to make type libraries from Windows 10 SDK and DDK version 16299 and/or 17134. I saw this tutorial TILIB - utility to create type libraries for IDA. Then I downloaded it from IDA Support: ...
1
vote
1answer
608 views
How to move one step back in a debugger
When I debug a .exe file on Windows with IDA, I do it step by step.
Can I move one step back and reset all the registers and stack to what they were one instruction ago?
By the way, when I'm looking ...
2
votes
2answers
1k views
What is the difference between Windbg and local debugger in IDA
When I want to debug an .exe on Windows with IDA I can choose between Windbg or local debugger.
What is the difference?
By the way, is there any difference if I use Windbg tool (windows software) ...
2
votes
1answer
69 views
How to identify when a function is being called using IDA?
I'm debugging a .exe file on Windows with IDA's debugger.
How can I identify when the code calls the random() function?
3
votes
1answer
253 views
Unable to use CreateRemoteThread in target process
I'm trying to get a debugger attached to a malware, but it seems to pick up whenever a new remote thread is created (which makes it so I can't use Scyllahide).
Even if I suspend all threads, it does ...
12
votes
3answers
758 views
Trying to understand this construct in Dbgv.sys driver for DbgView tool
I'm trying to reverse the Dbgv.sys (x86 kernel driver) for the DbgView tool. It has this sub_10D4A function that is called almost at the beginning of the driver's DriverEntry function. It goes as such:...
1
vote
1answer
407 views
Reverse engineering a VST to learn about signal processing and hopefully help me make my own.
I have been trying to simply open and view the source code for a VST I am researching as I hope to create my own VST sometime in the future. I have two .dat files which I presume contain the audio ...
4
votes
0answers
872 views
Windows 10 v.1803 boot failure after trying to install network kernel debugging with WinDbg Preview
I'm trying to set up kernel debugging on a physical hardware/desktop to test the new WinDbg Preview. Here's the steps:
I'm using a desktop with Intel DG41TY board.
Installed Windows 10 Pro build 1803....
1
vote
0answers
98 views
Decompiling DotNet2JScript malware?
I've got a .NET malware sample that was transpiled to JScript using DotNet2JScript. The .NET malware assembly was serialized to binary form using BinaryFormatter and then embedded into the JScript ...
1
vote
1answer
619 views
How do TDBCtrlGrid or TDBCtrlPanel Borland Delphi controls add new text rows?
I am trying to reverse engineer an old native application written in Borland Delphi in order to modify it for my needs:
The application interfaces with the special hardware and displays events that ...
1
vote
0answers
161 views
Prevent windbg from context switching when stepping into assembly instructions
When I'm using Windbg (in kernel mode) to step into assembly, I would encounter context switching once in a while - which is annoying.
So, for example, I placed a breakpoint for a process - let's ...
4
votes
1answer
297 views
ntoskrnl checksum mismatch
I had hex-edited windows kernel file c:\windows\system32\ntoskrnl.exe to fix some assembly bytes in the way i need it.
System wont boot because of STATUS_IMAGE_CHECKSUM_MISMATCH error (0xC0000221; ...
3
votes
2answers
705 views
Is pointer decryption possible?
I’m pretty new to reverse engineering, so bear with me...
I’m trying to get a few struct definitions (or whatever they’re called) from this one binary. After some time fiddling around with it, I’ve ...
