Questions tagged [windows]
Windows refers to the Microsoft Windows series of operating systems.
735
questions
2
votes
1answer
88 views
Partially correctly decoded strings from pkware zip with known plaintext
I have a password-protected zip file, where the paths and filenames of each file are encrypted using PKWARE encryption.
The password is known and correct, and so is the encryption algorithm.
I also ...
-1
votes
1answer
109 views
malware analysis [closed]
I tried to use process monitor to find out what program 4.exe did on my system. However, I could not find what changes were made.
I believe that this program modifies some files and the registry, but ...
0
votes
1answer
305 views
Info on ProcMon from SysInternals
I need help. I am reversing Procmon64.exe file.
It drops procmon.Sys filesystem minifilter driver which does monitoring.
Question:
I need to know if filtering of events is done in user-mode or ...
-1
votes
1answer
144 views
The executable file makes a unique ID from each individual PC. Can anyone decipher from where the file makes these unique IDs?
The file generates random unique ID. It says hardware ID but I couldn't find it in product key, BIOS serial number or anywhere. I used IDA but I couldn't get from where the file creates the code. Even ...
4
votes
1answer
490 views
change PE file icon without re-signing the file all over again
Is there any option to set new icon for a signed PE executable in windows without re-signing it again. This means that the icon image, although fully assimilated to the PE file, won't change the hash ...
5
votes
1answer
845 views
Microsoft Edge and it's related processes may have turned protected in windows 10 1903
It seems like driver based injection using APC calls fails on MicrosoftEdge and it's related processes (browser_broker.exe , MicrosoftEdgeCP.exe and MicrosoftEdge.exe).
Looking into the problem, it ...
1
vote
1answer
972 views
Finding out what calls win32u.dll functions
There's a button which, when clicked, writes some data to the clipboard.
I'm trying to call the function this button executes using DLL Injection.
I managed to find the function in win32u.dll which ...
1
vote
1answer
2k views
Dump value of register using frida
I'm new with frida and came to this problem.
I have dll that I want to reverse engeneer(there are no debug symbols). Specifically I want to dump some data from a function. So I have this big function ...
0
votes
1answer
100 views
Exported DLL function has only stdcall with some offset
I am quite new to reverse engineering. I have opened .dll (x86) in IDA Pro and I have noticed few exported functions. The issue is that all of them looks like this:
IDA pseudocode:
int __stdcall ...
1
vote
1answer
55 views
What does -c mean in this Windbg Command Syntax?
kd> u win32k!impPsIsThreadTerminating+0xe4-c L5
| \ \ \ \ \
/ \ \ \ \ \
/ \ \ \ \ \
...
0
votes
2answers
282 views
Find Target to Call Dword Ptr in 16-bit Windows with IDA Pro
Looking for suggestions on steps that could be used to identify what code would get executed at call dword ptr es:[bx+0Ch] from static analysis.
cseg04:3044 loc_105D4: ; ...
1
vote
1answer
295 views
Find Reference To Resource String In Windows 3.1 16-bit DLL with IDA Pro
Experimenting Visual Basic 4 in DosBox + Windows 3.1 running on Windows 10. While I have installed SHARE.exe from MS-DOS 6.22 and it seems to run OK, it still fails to detect it.
The error I get is : ...
1
vote
0answers
105 views
Downgrade HTTPS (strip SSL ) to HTTP on Windows (if possible) [closed]
Long Question: I have an Android app: https://transfer.sh/mY240/com.phonegap.voyo.apk
which connects to an API: http://www.24ur.com/lbin/WebApp/Popplus/Android.php
the problem is the api authors are ...
0
votes
0answers
307 views
find a video file in memory dump of a process
I have a player that plays encrypted video files and works like this:
I open an encrypted video file with it
it decrypts the video file and writes it to its memory
and plays the file from the memory ...
1
vote
0answers
79 views
Dump the value of register into file
I've reverse engineering little game on windows 32bit.
I found a string in executable which was interesting for me (it is a board game and this string represents the fact that somebody made a move ...
1
vote
1answer
660 views
ACCESS_VIOLATION when attaching a debugger
I'm debugging a software and it hits access violation on wcslen function under debugger but runs normally without it.
First I thought It had some anti-debug trick, but I could not found any ...
0
votes
1answer
458 views
ASCII strings not showing up in CPU in OllyDbg, but rather in dump
I'm pretty much new to the Reverse Engineering and assembly language. I've watched some videos about OllyDbg and cracking serial numbers in programs and I got interested in them and I want to learn ...
1
vote
1answer
181 views
'local call from' in x64dbg
In OllyDbg there was a thing called "local call from xxx,xxx,xxx,xxx ... " which helps me know from where a function is being called in the entire module. Does such a feature exist in x64dbg as well?
0
votes
1answer
97 views
accessing nt!Kd_DEFAULT_MASK using dbh.exe
I would like to set the value of the above variable to 0xFFFFFFFF using command line. I was exploring dbh.exe and believe it will atleast give some clues on where the symbol is. But when I try the ...
2
votes
3answers
789 views
Debug program using peculiar anti-debugging technique
In my BA thesis, I wanted to present a program for Windows, using various anti-debugging techniques.
One of them, which I came up on my own (possibly it is well known, but I didn't find it anywhere) ...
2
votes
2answers
463 views
Analyzing Windows kernel driver
I'm trying to analyze some Windows kernel driver. What I want to achieve is full execution trace, from driver entry to end point. Driver is heavily virtualized and contains multiple anti-debugging ...
0
votes
0answers
62 views
Output address path during .exe execution
I have an obfuscated software. I'm a beginner in this area, so I don't find where a patch would be useful for what I want to do.
It turns out that I have an idea of how I could find out in which ...
2
votes
1answer
158 views
Missing Symbols RtlGetFrame, RtlPushFrame, RtlPopFrame
I'd like to use some undocumented symbols that listed in ProcessHacker project. taken from Here:
https://github.com/processhacker/processhacker/blob/master/phnt/include/ntpebteb.h#L241
https://...
0
votes
0answers
108 views
Help reverse engineering a small (60kb) .exe file used for extracting .tga images from a custom container
The executable grabs the specified container format and extracts .tga images from it. It was community-made to satisfy a certain niche, unfortunately I cannot get into contact with the original ...
6
votes
1answer
8k views
How do I import function signatures to Ghidra?
I'm working with an .exe which imports the old DirectX DLL DDRAW.DLL. The problem is, Ghidra doesn't know about it and shows all imported DDRAW functions as having no parameters. I know, I can edit ...
3
votes
1answer
173 views
GetWindowLongPtr with undocumented nIndex of -1
I'm trying to reverse functionality of scrollbars in comctrl32.dll and I keep witnessing them calling GetWindowLongPtr function with undocumented index -1 as such:
Does anybody know what that ...
0
votes
1answer
79 views
Windows GUI app without GetMessage imported?
I am currently trying to reverse an app and I have one very stupid question I cannot figure out by myself.
The app was packed using FSG 2.0 and I successfully manually unpacked it and rebuilt the IAT ...
9
votes
1answer
3k views
Can I define custom enum-type to be used in Ghidra as a data type?
I'm trying to learn Ghidra. Say, if it generated the following code for loading functions from an array of function names from gpfnCommCtrlAPI:
I was able to retype gpfnCommCtrlAPI into char*[14] ...
2
votes
0answers
84 views
How can I dump the output of this register , the MSR - IA32_VMX_PROCBASED_CTLS2 , to see whether unrestricted guest mode is supported/enabled?
How can I dump the output of this register , the MSR - IA32_VMX_PROCBASED_CTLS2 , to see whether unrestricted guest mode is supported/enabled?
Context is curiosity.
I'm aware that Docker in the ...
2
votes
2answers
2k views
windbg - Why does the GS register resolve to offset 0x0?
I'm trying to understand how to resolve segment addressing (specifically the GS register in X64).
My toy program:
int main()
{
unsigned long long x;
__debugbreak();
x = __readgsqword(...
1
vote
1answer
1k views
windbg - What is the relation between the VAD (!vad), the PTEs (!pte), and loaded modules and sections (lm and !dh)?
[cross-posted (but closed the original) from https://stackoverflow.com/q/55438806/254959]
I'm trying to gain a better understanding on Windows process memory, and have some gaps with regards to the ...
1
vote
0answers
191 views
Detouring with Unreal Engine 4, importing exe functions
I'm not sure that this is the right SO community to be asking this in, but I thought I'd give it a try. Some friends and I have successfully detoured a game built with UE4 by loading a modified ...
0
votes
3answers
489 views
Most efficient way to begin analyzing malware binary
I'm taking a reverse engineering course and the class has just been given a big project where we have to analyze a packed malware binary. I am using a Windows 10 VM. I am a little confused on where to ...
2
votes
2answers
1k views
How can I enumerate and hook into a Windows 10 RPC interface?
Suppose that I have a certain Windows service that I know exposes a local RPC interface. I want to create a client program that calls into these procedures; however, I do not have the source code for ...
10
votes
2answers
6k views
How to load symbols from a symbol server in Ghidra?
I've been trying to learn Ghidra by attempting to reverse the comctl32.dll system library, which has many of its functions documented. I started the de-compilation analysis in it, and after a while it ...
6
votes
1answer
866 views
Detecting protected processes and critical processes from windows driver
I've got a driver that tamper user-space processes by sending APC calls upon process start using the call PsSetCreateProcessNotifyRoutine.
I wish to avoid tampering with any process that is critical ...
1
vote
1answer
68 views
Startdard singleton class implementation generate access to TLS memory
I'v examine the assembly output in Windows of basic singleton implementation of using static variable to be initialized with new class instance from static function.
to my surprise, although the ...
1
vote
1answer
399 views
How to get IOCTLs from all NtDeviceIoControlFile function call?
Inspired by this answer about RE-ing IOCTLs, I tried to get the IOCTLs from
NtDeviceIoControlFile() syscall. Here is an example of that syscall
in Beep() function in KernelBase.dll file:
In x86_64 (...
1
vote
2answers
1k views
How to inject JavaScript into a browser with Frida?
I'm learning how to use Frida, and would like to do something basic like inject JavaScript into a browser on Windows to list all running tabs. It seems like it should be possible as Frida allows you ...
1
vote
1answer
98 views
When can trapping be used?
This is the beginning of one of the functions inside NTDLL of Windows XP:
MOV EDI,EDI
PUSH EBP
MOV EBP,ESP
...
The book on reverse engineering I am reading(Eldad Eilam - Reversing: Secrets of ...
1
vote
0answers
76 views
Set Breakpoint on ActiveX Property Being Set (No Symbols)
A program is loading an VB6 based ActiveX control that has several property, for example ConnectionString.
The application is dynamically generating the values it provides at runtime, so it is not ...
1
vote
1answer
614 views
How does ASLR in Windows work?
I had recently this situation where in a program I was debugging I found:
03CD38D4: 8B15 8C5FF703 MOV EDX, DWORD PTR DS:[3F75F8C]
If I look for these bytes in the physical file I found nothing. I ...
0
votes
1answer
421 views
Remote debugger for Linux from one VM (IDA) to another (running the debuggee)
I want to debug a Linux program (ELF), but my IDA Pro is on a Windows 10 VM and I want to use remote debugging to debug the program on Ubuntu (also in a VM).
So, is it possible to debug if both ...
0
votes
1answer
66 views
Finding "controller vibration" function in game
I want to build a "force feedback chair" for Need for Speed: Payback, so I thought about hooking the function responsible for the controller vibration and sending the motor speed parameter to a motor ...
0
votes
1answer
3k views
x64dbg - Conditional breakpoint based on function argument
How can I set a conditional breakpoint based on the argument of a function?
I am trying to break on the windows function LoadLibraryExW: https://docs.microsoft.com/en-us/windows/desktop/api/...
0
votes
1answer
166 views
The callstack does not show the message handler
After clicking a button or doing anything which might generate a message to be translated and dispatched, why is that the callstack might not show the message handler?
Say I am reversing an ...
0
votes
1answer
79 views
x64dbg "System" meaning
I'm a bit confused about what "system" refers to when looking at the callstack in x64dbg. Does it mean the code is currently being executed in ring0? I thought that only system calls are executed in ...
0
votes
1answer
3k views
How to export function from exe file?
I open exe file (running on Windows) in Ida , and saw a function (for example sub_ABC) that I want to export , so I can call this function from c# code.
How can I export function that I Know the name ...
3
votes
1answer
235 views
How to wrap dump process and execute it in another PC
I debug exe file in Ida , and put breakpoint in some address.
I want to create a dump of this process that I can continue running it in another Pc (without Ida) from the point I pause it with ...
2
votes
1answer
310 views
dongle check happen before a debugger start debugging
i'm trying to fake the test ( dongle exist )
but one problem that i encounter is that the application detect it before i start debugging it .
this is what happen with more details : open( not ...
