Questions tagged [windows]

Windows refers to the Microsoft Windows series of operating systems.

127 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
8
votes
1answer
912 views

Red Alert 2 Windows 8 DirectDraw compatibility

The game Red Alert 2 runs on Windows 8, but as soon as I inject a DLL (via ddraw.dll or an extra DLL) it stops drawing buttons on the main menu. With the DLL it still work fine in windowed mode and it ...
4
votes
1answer
922 views

Windows 10 v.1803 boot failure after trying to install network kernel debugging with WinDbg Preview

I'm trying to set up kernel debugging on a physical hardware/desktop to test the new WinDbg Preview. Here's the steps: I'm using a desktop with Intel DG41TY board. Installed Windows 10 Pro build 1803....
3
votes
0answers
41 views

Is it possible to fake being joined to a domain in Windows 10?

I'm dealing with a malware sample from a pentest that will only execute properly if the system is a member of the target organization's Windows Active Directory domain. Rather than standing up my own ...
3
votes
1answer
182 views

Reconstructing Assembly Truth Map

So I recently read [1] which evaluates several disassemblers. The truth/test binaries are generated by the SPEC CPU 2006 Benchmark suite. The authors provide detailed build instructions for the ELF ...
3
votes
1answer
1k views

What conditions can create the "Not a Valid Win32 Application" error message upon load?

I'm doing research on the PE format/Windows Loader and I am unable to locate specifics as to what creates the error "Not a valid Win32 Application" followed by a failure to load. I've tried changing ...
3
votes
0answers
268 views

Malware analysis - AntiDebugging - Malware slows down the PC while being debugged

As part of my work, I'm debugging a malware found and his behavior is pretty basic after execution: Being executed Decrypt a lot of data from memory and obtain a new PE (from memory) Create a child ...
3
votes
0answers
318 views

Finding the correlation of imported dll's and executable vad's of a process

The memorydumps I work with are from a Windows XP SP2 run inside a VirtualBox VM. I aquire the memorydumps with vboxmanage debugvm dumpguestcore --filename dump.vmem. The windows paging is disabled. ...
3
votes
1answer
140 views

CreateToolhelp32Snapshot() access denied (while running as admin or even NT AUTHORITY\SYSTEM)

I've come across a troublesome process which refuses to allow CreateToolhelp32Snapshot(). I also noticed that in sysinternals process explorer it shows "Access Denied" for other things too, such as ...
2
votes
0answers
78 views

How to disassemble win32 function RegSetValueExW?

I have opened up advapi32.dll in IDA and found out that RegSetValueExW is just a jump to RegSetValueExW_0. And RegSetValueExW_0 seems to be an extern. How do I actually disassemble RegSetValueExW_0?
2
votes
0answers
112 views

Accessing Windows 10 Feedback Hub Data

I'm trying to make a website that displays the feedback from the Windows 10 Feedback Hub but i have met a roadblock. I'm using Fiddler 4 (Fiddler Everywhere doesn't have support for UWP yet and ...
2
votes
0answers
104 views

Ghidra is mishandling a field access

I have a program which decompiles in Ghidra to include the line temp_5f2f2f81bc = *(CPedIntelligence **)(&DAT_000010c0 + (longlong)pCVar2); temp_5f2f2f81bc is a CPedIntelligence*. pCVar2 is a ...
2
votes
3answers
290 views

Injecting C++ code, while also maximizing compatibility with other injections

Using the New Vegas Script Extender C++ API for Fallout New Vegas, I am able to write to the process' memory directly at runtime through a .dll plugin that's loaded by the NVSE injector. But it is not ...
2
votes
2answers
453 views

Analyzing Windows kernel driver

I'm trying to analyze some Windows kernel driver. What I want to achieve is full execution trace, from driver entry to end point. Driver is heavily virtualized and contains multiple anti-debugging ...
2
votes
0answers
82 views

How can I dump the output of this register , the MSR - IA32_VMX_PROCBASED_CTLS2 , to see whether unrestricted guest mode is supported/enabled?

How can I dump the output of this register , the MSR - IA32_VMX_PROCBASED_CTLS2 , to see whether unrestricted guest mode is supported/enabled? Context is curiosity. I'm aware that Docker in the ...
2
votes
0answers
119 views

How to track events of any software

Softwares use libraries (sdl, wxwidgets, gtk etc.) that handle events. as keystroke and mouse. I have a software that when clicking on a button, an annoying noise is reproduced how do I find the ...
2
votes
0answers
296 views

Calling original function that uses unconventional calling convention

I'm using MinHook to hook a static function with the following signature: float __usercall RadarManager::Add_Blip@<xmm0>(int position@<ecx>, int shape@<edx>, int colorId, float ...
2
votes
0answers
5k views

Invalid Win32 application/Not a valid Exe

I am currently trying to reverse a program that is EXE format, and I believe written and compiled with Microsoft Visual C++ 2010. The end goal is to map the executables functions, and find a method to ...
2
votes
0answers
589 views

How get a full memory dump of a running services.exe instance?

How can I get a full memory dump from a services.exe process on Windows 8.1 x64?
2
votes
0answers
671 views

Why is ASLR not activated though IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE is set?

Even a minimal console Delphi program that has IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE set in its PE image does not use ASLR. GetProcessMitigationPolicy() returns a PROCESS_MITIGATION_ASLR_POLICY of 0. ...
2
votes
0answers
649 views

Debugging digitally signed executable

I'm having trouble debugging a win32 executable file under Windows 7. I've tried using ollyDbg and x64dbg: the former simply does nothing, while the latter complains with an "Error starting process (...
2
votes
0answers
400 views

How allocate memory on Kernel mode by windbg?

How allocate memory on Kernel mode by windbg? I use .dvalloc on user mode but not working on kernel mode thanks.
2
votes
0answers
798 views

Attach to specific process using IDA + WINDBG in kernel debugging

I asked this question at the StackOverflow website and they referenced me here. (Previous topic: https://stackoverflow.com/questions/27917592/attach-to-specific-process-using-ida-windbg-in-kernel-...
2
votes
0answers
1k views

WinDbg is unable to communicate with the target after some time

Host and target are both Windows 7 x64. The session goes well, but sometimes after 15-20 minutes the target freezes (like a break point was hit), but WinDbg reports that the debuggee is running and it ...
2
votes
0answers
1k views

Map virtual addresses to physical addresses

I know how to translate a virtual address to a physical address, but is it possible to take one desired VA and if you detect that it's PTE (or PDE or PTPE or PML4E) is not present to actually map it ...
2
votes
0answers
648 views

Page Fault Handler in Windows

Like almost all of my questions, I feel like I'm missing something / I understood something the wrong way so help me figure out where I'm wrong with this. When a Page Fault occurs and nt!KiTrap0E ...
1
vote
0answers
22 views

Send file or non-printable character in Immunity Debugger arguments

I am a beginner in Reverse Engineering. I am on Windows and using Immunity Debugger. I would like to send my payload on the .exe file. The payload contains non-printable characters. How I can launch ...
1
vote
0answers
50 views

Reversing Logitech G933 Battery Charge Values

I have a Logitech G933 headset. I replaced the stock battery with a larger capacity. The headset now lasts many hours longer than it was originally designed, and the software is configured to give ...
1
vote
0answers
33 views

On Windows, when is a PTE a VAD prototype PTE (with address 0xFFFFFFFF0000) instead of a prototype-pointer PTE?

I have reviewed several sources on this PTE type, including Windows internals and the following: http://blog.rekall-forensic.com/2014/10/windows-virtual-address-translation-and.html https://thalium....
1
vote
0answers
21 views

Whats the difference between a MiNotMapped PFN entry with all 1s, and a MiNonCached PFN entry with all 0s and a 0 PteAddress?

On host (UEFI legacy mode): lkd> !pfn 0xf0 PFN 000000F0 at address FFFFFA8000002D00 flink FFFFFFFFFFFFFFFF blink / share count FFFFFFFFFFFFFFFF pteaddress FFFFFFFFFFFFFFFF ...
1
vote
0answers
20 views

Program closes when running Charles proxy

I came across an program that closes itself when I run Charles proxy and if I'm running charles before the progran it won't run. Anyone know what type of security if this and can it be reversed? ...
1
vote
1answer
107 views

.dll file pull source from compiled study?

Forgive me, I’m new, and not a programmer, but I am needing to see if this is possible. I have a study in my trading platform I had built a long time ago, lost the original, but have the compiled .dll ...
1
vote
0answers
48 views

Acquire command line of remote process in Windows OS

I'd like to use C/C++/CS API to get the command line that invoked another process according to PID. I've seen that this is done in processHacker that is an openSource project, but I couldn't find the ...
1
vote
0answers
69 views

Windows: Is it possible to mix FastIoDispatch with the registration of IOCTLs?

I am reverse engineering a Windows device driver. My main previous experience was with drivers I had written before, or toy drivers from tutorials. I started reversing the driver by searching for ...
1
vote
0answers
39 views

Instruction-level hooking library for win32?

I am looking for instruction-level hooking library for win32 x86/x64. I want to write hook insertion and hook implementation code in C/C++ (compiled into dll). (Therefore instrumentation tools are ...
1
vote
0answers
59 views

Ways of creating a new thread on Windows

I'd like to know about every possible way how a thread can be created in a process at the lowest possible level. There are loads of WinAPI-s to create a thread, but as far as I know all of them ends ...
1
vote
0answers
34 views

PE Format - How can I delete IMAGE_IAT_DIRECTORY and the app still runs fine?

I’m doing a small research regarding PE files and while I drilled every related question or the documentation itself I couldn’t explain this issue. Why can I go to CFF explorer or some other PE ...
1
vote
0answers
44 views

How are AutoIT variable names stored after compiling it to a executable?

I need to write a yara rule for a autoit malware (the binary itself not the decompiled script) As far as i know the actual script is in the resource section in the RCData, but how can i find the bytes ...
1
vote
0answers
54 views

Possible to inject a new menu into a program's menu bar?

Is it be possible to inject a new menu/menu item into a program's menu bar? As an example, in Notepad's (Windows) "Help" menu, would it be possible to add a new entry to that menu like "Open ...
1
vote
1answer
279 views

Adding a static variable to Windows DLL

I'm trying to patch a function in a Windows x86 DLL, however it turned out that I need a static variable to store some state that wasn't correctly preserved by the original executable across calls. I ...
1
vote
0answers
56 views

How does this wannacry sample work?

I downloaded wannacry sample here: https://github.com/fadyosman/WannaCrySample/releases. Don't forget to enter password for archive. I figured out how most of the binary works, except the very last ...
1
vote
0answers
88 views

Find High Entropy VA (64-bit ALSR) Incompatibility in Disassembly

Have a 64-bit plugin DLL (no source code) and the host application in an update changed its DLL characteristic to include "high-entropy 64-bit address space layout randomization (ASLR)" When this is ...
1
vote
0answers
44 views

Memory modified at jump far

Observing a trace of Wow64 switching on Windows 7, the following situation makes me confused ... 0x77491dbe 64 ff 15 c0 00 00 00 call fs:[0xc0] ; syswow64\ntdll.dll 0x74632320 ea 1e 27 63 ...
1
vote
0answers
104 views

Why can I inherit handles from WSASocketA and not from socket?

I'm trying to write some custom shellcode to obtain a shell from a program. Looking at the program intermodular calls, I found a call to socket(), and my initial plan was to use that to create a new ...
1
vote
0answers
78 views

Finding PEM passphrase that may be in an executable?

I'm trying to capture the TLSv1.2 traffic of an application. In the applications directory is the file cacert.pem that I assume holds the cert for decrypting the TLS traffic. I tried to load it into ...
1
vote
2answers
283 views

Call function by ebp

When I looking at exe file with Ida I see call dword ptr [ebp -70p] What is that? Why this function calling by ebp and not call sub_0xabcd How can I know which function is that to enter to this ...
1
vote
0answers
125 views

How to identify the NonPagedPool Start Memory address from a memory dump

I need to find the memory address where starts the NonPagedPool. I saw some people doing it with Rekall, but I'm having a lot of problems with it. Is that possible with Volatility ? Tks
1
vote
0answers
78 views

Dump the value of register into file

I've reverse engineering little game on windows 32bit. I found a string in executable which was interesting for me (it is a board game and this string represents the fact that somebody made a move ...
1
vote
0answers
178 views

Detouring with Unreal Engine 4, importing exe functions

I'm not sure that this is the right SO community to be asking this in, but I thought I'd give it a try. Some friends and I have successfully detoured a game built with UE4 by loading a modified ...
1
vote
0answers
72 views

Set Breakpoint on ActiveX Property Being Set (No Symbols)

A program is loading an VB6 based ActiveX control that has several property, for example ConnectionString. The application is dynamically generating the values it provides at runtime, so it is not ...
1
vote
0answers
368 views

Calling undocumented kernel functions directly (xxxSendInput and xxxMouseEventDirect)

In the core my question is about how to reverse engineer undocumented functions. I want to call the function "xxxMouseEventDirect" (located in win32kfull.sys). I have already been able to collect some ...