Questions tagged [windows]

Windows refers to the Microsoft Windows series of operating systems.

Filter by
Sorted by
Tagged with
3
votes
2answers
2k views

How to do Global DLL injection

How can one go about injection of a DLL into every process? Can SetwindowsHookEx() do the trick? Does AppInit_DLLs work as it used to?
3
votes
0answers
83 views

Reconstructing Assembly Truth Map

So I recently read [1] which evaluates several disassemblers. The truth/test binaries are generated by the SPEC CPU 2006 Benchmark suite. The authors provide detailed build instructions for the ELF ...
0
votes
1answer
798 views

Opening Windows 10 DMP file

Which program would you success to open a Windows 10 .DMP file. I've tried OllyDbg110(32Bit) but this is the result: Do I have to use a 64bit debugger or am I on a totally wrong route?
4
votes
2answers
1k views

What could be the purpose of XORing esp with a global variable? (stack canary protection)

I am currently looking at a function inside a Win32 executable's main module. After allocating memory on the stack (sub esp) and saving some registers on the stack, the value of esp is XORed with a ...
1
vote
2answers
593 views

Calling a function of a game inside a function hook

How can you call a game function inside a function hook? For example, I hooked the recv function of winsock. Then, I examined a packet. This packet has the value of my current hp. I check the hp. If ...
1
vote
1answer
368 views

What does NtSetInformationKey do in the Windows Native API? [closed]

ProcMon lists RegSetInfoKey as an "operation" on the registry. Process Monitor operations do not necessarily map directly to Native symbols, however, it seems that this operation uses ...
0
votes
2answers
95 views

I Need to force windows to the front So I can dump Hasp Dongle on program that runs at boot

I am trying to dump a hasp dongle on a popular arcade machine. I can only get a portion with the game not running. If I ctrl alt del while game is already running I get a memory crash. What is the ...
8
votes
1answer
3k views

How to investigate Windows 32/64bit (WOW64) transition

There is surprisingly little information about Windows WOW64 mechanism. I'm trying to investigate it. So when we have system call in 32-land, it calls an address that is stored in FS, which leads us ...
2
votes
1answer
791 views

How can I modify binary image resource data?

I've been hacking and modding software for years and have learned alot, but there are still a few things that vex me, this is one such case. I have noticed that some PEs contain an RCData section that ...
2
votes
2answers
147 views

Does IMAGE_FILE_SYSTEM actually means System file

I have some concerns related to Characteristics flag IMAGE_FILE_SYSTEM of IMAGE_FILE_HEADER structure. According to all specs it says that file having this set is System file. However it doesn't ...
2
votes
2answers
739 views

Packed PE file and weird Header

I'm new to reverse engineering, so I don't know if my question will be easy or not. Right now I have an exe file, but it seems packed. In the hex Dump I do have the followings : 000003d0: 0055 5058 ...
8
votes
1answer
994 views

How does the Windows Native API communicate with the kernel?

The windows Native API (Ntdll.dll) is a user-mode library. However, it is the final user-mode library that interfaces with the kernel. How does it actually interface with the kernel and bridge the gap ...
5
votes
1answer
2k views

How tools like PEiD find out the compiler and its version.

How tools like PEiD and CFF explorer find out the compiler and its version. I am analyzing a executable file. Which shows: Borland Delphi 3.0 But the section names .text .rsrc. Which is usually ...
0
votes
1answer
707 views

How can I insert bytes with OllyDbg?

I am developing a game in GameMaker: Studio and have run into a minor problem. No matter what I do, the games output payload is generated, named, and referenced as data.win. I would like to name it ...
2
votes
1answer
244 views

Invalid INDX entries for $I30 on NTFS harddisk

While parsing my NTFS formatted hard disk, I found some invalid entries of INDX while Windows is still able to list all the root directory contents! The structure of the Index Record in NTFS 3.1 is ...
1
vote
0answers
240 views

What do malicious programs use the ESENT registry key for?

I was analyzing a piece of malware and noticed it created this registry key. hkey_local_machine\software\microsoft\ esent\process{malware file name}\debug Some googling told me that esent is just a ...
3
votes
1answer
212 views

How can WinDbg be used to troubleshoot program loading?

I have a stubborn PE file which I cannot get to load. The PE headers seem to be intact and the file even parses fine in several PE tools. I am receiving a "Invalid Win32 Application" error when I try ...
1
vote
1answer
138 views

Find the code used when you right click and select “Bring To Front” in Task Manager

How can I find out what code is being called when you right click on a process in Windows Task Manager, and click on "Bring To Front" ? This is related to https://stackoverflow.com/questions/45046765/...
2
votes
0answers
598 views

What conditions can create the “Not a Valid Win32 Application” error message upon load?

I'm doing research on the PE format/Windows Loader and I am unable to locate specifics as to what creates the error "Not a valid Win32 Application" followed by a failure to load. I've tried changing ...
3
votes
1answer
798 views

Debugger always paused in ntdll

I'm a beginner at reverse engineering so any help would be appreciated. I apologise if a similar question has already been asked or if this is a dumb question, but I couldn't find anything. I have ...
2
votes
2answers
837 views

Obtain .exe/.dll/.sys for a given .pdb file

If I have an executable file (let's say ntoskrnl.exe) I can obtain it's .pdb file from Microsoft. Is it possible to do the reverse? If I have a .pdb can I obtain the .exe? Or the only method is to ...
0
votes
2answers
760 views

Trying to call a function in an unknown DLL

My goal is far from nefarious. After several polite attempts to try and get Lenovo to implement a proper keyboard backlight control, I've had no response. They do have a Windows Store app which adds ...
3
votes
0answers
362 views

What does fs register value mean in x86 application? [duplicate]

I know that FS points to Thread Environment Block - which is seen by the address at the right part of what OllyDbg shows: What does this value 0x53 mean? Does it have some connection with the address ...
1
vote
0answers
108 views

Reverse engineering proprietary database file format .IDF

I have an old (I think) Windows software on a cd-rom, that is basically a database and its interface for show the data it contains. I don't like the software view interface, want to make my own with ...
2
votes
1answer
2k views

Is it possible to extract / read a variable out of a running .exe file?

I am completely new to Windows programming so please excuse any naivety on my part when asking this question. I'll briefly describe my situation and then hopefully you'll be able to answer my question....
0
votes
1answer
55 views

Are Windows Store Apps in a VM and can they be identified by PE header info?

I have no experience with Windows Store Apps and there appears to be limited info out because they are still relatively new. I have 3 questions: When I open a store app in analysis tools such as PE ...
0
votes
1answer
974 views

Ollydbg: Function name list like in IDA

I'm new with reverse engineering and especially with Ollydbg, I have little experience with IDA and currently trying to get used to Olly. My questions are: 1.Is there any window which would show ...
4
votes
2answers
553 views

What PE anomalies can crash the Windows Loader or cause a file to not load?

I do malware analysis on Windows. I run hundreds of Windows PEs per day and it is actually relatively common for a file to not run (or sometimes not run on just one specific version of Windows) and I ...
1
vote
0answers
71 views

Where can I get a good description about windows build-in exe programs like wupdmgr.exe?

I was checking the Strings for Lab01-04.exe from Practical Malware Analysis and I found wupdmgr.exe and I face this every time I search for an exe. Is there any "msdn" alike repository but for exe ...
1
vote
1answer
467 views

windows kernel debugging on Mac host (using VirtualBox)

I'm running on MacOS Sierra (version 10.12.4). And I created two virtual machine on Virtualbox (version 5.1.22). 1- Host Machine : Windows 10 Pro x64 (I installed Windows Driver kit 10) 2- Target ...
2
votes
2answers
2k views

Immunity debugger anti anti debug

I using Windows, and I was wondering what is the best anti anti debug plugin that exist, I tried to use hidedebug by Bob -> Team PEiD, but unfortunately it catch only the regular ways, I know that ...
-1
votes
1answer
477 views

IDA Pro: Converting structure to decimal

I'm new with IDA pro and have little problem. Right click on some data in .rdata brings options in which I can convert, In that window D means decimal B means binary and so on, but I have multiple Ds ...
-2
votes
1answer
281 views

Crack an executable in PE [closed]

So I noticed that I can write something in PE from the executable For example if I write 1911 he tells me [!]Cracked By RAZOR 1911 But if I write something else it will not tell me anything. What ...
3
votes
1answer
1k views

explain the vulnerable code used by EternalBlue SMB attack

The recent WannaCry ransomware attack exploited a vulnerability in older Windows SMB code. The presumably reverse-engineered function that has been cited 1 as vulnerable is as follows: unsigned int ...
1
vote
2answers
1k views

newbie trying to understand disassembled code

I have been writing small C programs and then disassembling them to try to understand what is actually happening under the hood. I am using mingw-w64 on Windows 7 for my work, and I have run into a ...
1
vote
1answer
67 views

Copy Export Symbols From Mac to Windows PE

I have both a Mac and Windows version of the same library. However, while the Mac version has export symbols, the Windows version exports by ordinal. The Mac version uses the PPC architecture making ...
1
vote
0answers
188 views

X64 ASSEMBLY - Cannot run compiled and linked raw shellcode in Windows

After using metasploit's windows/x64/meterpreter/reverse_tcp shellcode on my windows 10 machine (with AVs turned off), I decided to try to create a hand-made polymorphic, null-free and custom-encoded ...
1
vote
1answer
194 views

What are ways to find Windows constant macro definitions?

This happens a lot where when I am reversing a program in a disassembler or debugger, I run into something like this: push eax ; lParam push 1 ; wParam push 80h ...
1
vote
0answers
114 views

Using the AND operator to find a heap allocation size, Fermin's formula

I came across this technique, leveraging the HPA feature (Heap Page Allocator, known as PageHeap) in gflags from Windows debugging tools, to find the size of a heap allocation: Lets say you have ...
3
votes
3answers
575 views

How to debug ServiceMain function of a service?

I have a malware which is checking for keyboard type and locale information. After that, it creates a service with BinaryPathName as malware's exe address. After creating a service, malware starts it ...
1
vote
2answers
757 views

Can corrupted PE files be executed in some versions of Windows but not others?

I'm doing some research on corrupted PE files and I wanted to hear your thoughts and experiences with them. I've been processing a ton of samples which are essentially corrupted Windows Portable ...
2
votes
2answers
1k views

IOCTL Code for Windows driver

Recently I tried to obtain OICTL Codes from the iscflashx64.sys driver and I have found it in DispatchDeviceControl function. After driver being installed and have started with SCM it displayed in ...
1
vote
1answer
286 views

Need script to analyze process dump file (windows)

I have a program written in c++, it's compiled with Visual Studio. I have a mini dump file of a running process (process generates it using winapi MiniDumpWriteDump function). I also have several ...
2
votes
1answer
212 views

Trying to reverse engineer teamviewer's printer driver

Unlike LogMeIn or GoToMyPC, TeamViewer does not have any driver files except for the INF and GPD files. LogMeIn and GoToMyPC have their own configuration and driver dlls, while TeamViewer uses the ...
1
vote
1answer
421 views

Get list of functions (including non-exported functions!) in running executable

I'm working on a native binary patching library. It currently works on Linux and I'm trying to add Windows support. For that, I need to implement a way to enumerate all functions in a PE binary (EXE) ...
5
votes
3answers
634 views

Is there any websites to get malware files using YARA rules?

I want to know, Is there any websites which has malware files (Windows OS) that are detected by YARA rules? Note: I know some websites to get android malware samples using YARA. But, I need Windows ...
5
votes
2answers
476 views

Safe way to download a malware payload?

I'm trying to analyze a piece of malware that is most-likely a downloader. During dynamic analysis on an isolated VM network, Wireshark registered a GET request to a server for what I believe is the ...
2
votes
1answer
2k views

Get address of where process mapped in Windbg

I'm looking for the start address of where myfile.exe mapped into memory using Windbg. For this I connected to a VMWare for kernel debugging through serial port, after that I run myfile.exe in guest ...
10
votes
1answer
2k views

What are the Vectored Continue Handlers

Practically everyone knows what Vectored Exception Handlers are, but I couldn't find a lot of information about the similar "Vectored Continue Handlers" and related functions I encountered today, such ...
0
votes
3answers
2k views

PE Sections Permissions

I wanted to know which permissions each section of the following PE Sections have (windows): .idata .rsrc .data .text .bss .rdata .edata Thanks in advance, I couldn't found an answer using google. :...