Questions tagged [windows]

Windows refers to the Microsoft Windows series of operating systems.

122 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
1
vote
0answers
102 views

Decompiling DotNet2JScript malware?

I've got a .NET malware sample that was transpiled to JScript using DotNet2JScript. The .NET malware assembly was serialized to binary form using BinaryFormatter and then embedded into the JScript ...
1
vote
0answers
166 views

Prevent windbg from context switching when stepping into assembly instructions

When I'm using Windbg (in kernel mode) to step into assembly, I would encounter context switching once in a while - which is annoying. So, for example, I placed a breakpoint for a process - let's ...
1
vote
0answers
52 views

Threads blocking in kernel when I attach, can't control them

I'm attaching to a simple program and the new thread breaks at DbgBreakPoint as expected. I'm using x64dbg (32-bit). The problem is, when I go to the Threads window it shows all the threads' EIPs as ...
1
vote
0answers
268 views

Failed to set breakpoint (Anti-debug protection)

Sorry for my bad English in advance. There is a program that has some protection. The problem is I can not set hardware and software breakpoints in x64dbg (to be more precise - not everywhere), cuz ...
1
vote
0answers
69 views

How do I hook API to get realtime stock price data?

How I can hook SSL API from proprietary software. I want to extract realtime stock price data from stock trade software that provided by securities company. There is no API in this software. And ...
1
vote
0answers
310 views

What do malicious programs use the ESENT registry key for?

I was analyzing a piece of malware and noticed it created this registry key. hkey_local_machine\software\microsoft\ esent\process{malware file name}\debug Some googling told me that esent is just a ...
1
vote
0answers
124 views

Reverse engineering proprietary database file format .IDF

I have an old (I think) Windows software on a cd-rom, that is basically a database and its interface for show the data it contains. I don't like the software view interface, want to make my own with ...
1
vote
0answers
72 views

Where can I get a good description about windows build-in exe programs like wupdmgr.exe?

I was checking the Strings for Lab01-04.exe from Practical Malware Analysis and I found wupdmgr.exe and I face this every time I search for an exe. Is there any "msdn" alike repository but for exe ...
1
vote
0answers
254 views

X64 ASSEMBLY - Cannot run compiled and linked raw shellcode in Windows

After using metasploit's windows/x64/meterpreter/reverse_tcp shellcode on my windows 10 machine (with AVs turned off), I decided to try to create a hand-made polymorphic, null-free and custom-encoded ...
1
vote
0answers
128 views

Using the AND operator to find a heap allocation size, Fermin's formula

I came across this technique, leveraging the HPA feature (Heap Page Allocator, known as PageHeap) in gflags from Windows debugging tools, to find the size of a heap allocation: Lets say you have ...
1
vote
0answers
52 views

Fighting programs that don't respond to Send/PostMessage-based input

This can be difficult to ask because 1) people assume this is necessarily malicious and 2) unrelated but effectual techniques like GetForegroundWindow can make this impossible to answer. So, to keep ...
1
vote
0answers
962 views

Symbols could not be loaded for win32k drivers

I'm doing a kernel debugging on a VmWare installed Windows 10 corporate edition (x64 version 1607 build 14393.447). I use Ida Pro 6.6 with the WinDbg plugin. On my host i have the same OS , with ...
1
vote
0answers
107 views

Record-replay tools for Windows?

Are there any user-mode record-replay tools for Windows that can capture native execution of a program so that it can be replayed deterministically later? Instructions, memory accesses, syscalls and ...
1
vote
0answers
85 views

Understanding IE11's Ineterprocess Communication via COM

I'm quite new to COM object reversing (Windows Platform). I'm trying to reverse Internet Explorer on Windows 8.1, where child IE process communicates with Parent IE process via com (Due to Protected ...
1
vote
0answers
167 views

How do I access the TEB in PIN?

In PIN's documentation it says this about PIN_SafeCopy: PIN_SafeCopy is used to copy the specified number of bytes from a source memory region to a destination memory region. This function ...
1
vote
0answers
75 views

How can I control a USB device if I have a driver for it, but no application?

I have a Apogee filter-wheel which is connected via USB and the driver for it. However, as far as I could find out the device only comes with a driver but no application to control it. The filter ...
1
vote
0answers
616 views

Opening program via Ollydbg/Immunity in Win7 causes exception unless in XP Compatibility Mode

When opening the reverseme included with Lena's tutorials for debugging in either Immunity or Ollydbg an exception is produced within ntdll that results in termination of the process with code ...
1
vote
0answers
1k views

Getting info for undocumented APIs called by StartServiceCtrlDispatcher

I'm trying to understand the inner workings of StartServiceCtrlDispatcher. Specifically, I'm trying to figure out how it determines if its being called from the SCM. So I write a simple service in C# ...
1
vote
0answers
181 views

Reassembling Silverlight runtime

I'm trying to insert some instrumentation into libraries such as System.Windows.Browser.dll. I tried to use ildasm+ilasm and Reflexil and both failed - reassembled library causes browser crashes, ...
1
vote
1answer
575 views

Injecting exe file into process fails on windows 7 but works on windows 10 / Execution library function fails, access denied

I'm trying to inject my executable payload into remote process. I allocated memory in remote process, I converted raw payload using RVA addressing. I applied relocations and imports table. When I'm ...
0
votes
0answers
5 views

Send file or non-printable character in Immunity Debugger arguments

I am a beginner in Reverse Engineering. I am on Windows and using Immunity Debugger. I would like to send my payload on the .exe file. The payload contains non-printable characters. How I can launch ...
0
votes
0answers
33 views

Proxy dll doesn't load the original dll

I have relatively simple code here for the proxy DllMain() function: BOOL APIENTRY DllMain(HMODULE hDll, DWORD reason, LPVOID reserved) { if (reason != DLL_PROCESS_ATTACH) { return TRUE; } ...
0
votes
0answers
24 views

Can't figure out a crash in IDA “The memory could not be read -> 00000710 (exc.code c0000005, tid 20612)”

I'm trying to debug out a game. Basically, the Steam version works perfectly but the GOG version (which is 8kb smaller) has an annoying problem where for some people (which happen to be me) the game ...
0
votes
0answers
30 views

Ghidra: Identify and display a struct broken into multiple smaller fields

Me vs the 90s game, part two. I'm trying to figure out how the game detects the current date, since that part doesn't work correctly anymore. At some point, GetLocalTime() from kernel32.dll gets ...
0
votes
0answers
21 views

There is a course in which they teach you to use WinAFL?

I would like to know if there is a course that begins in a basic way, such as how to use winAFL to find bugs in app desktop.
0
votes
1answer
53 views

How to find main() of Windows EXE with Ghidra?

I'm new to Ghidra, my goal is to add localizations for a small EXE program. The program was written in Visual Studio and has Russian dialogs, which I like to convert to English. I've loaded the EXE ...
0
votes
0answers
19 views

How to replace the modified/corrupted module image on the original in the memory dump

I'm analyzing a windows kernel crash. I have instrumented “USBPORT.sys" kernel module for collecting metrics. I named the instrumented version of the module "TARGET_MODULE". After I ...
0
votes
0answers
86 views

What kind of code creates this function call pattern?

While using WinDbg: u/uf to disassemble functions in ntoskrnl.exe there are functions that are used in system calls and exception handling that have these weird function call patterns and I can't ...
0
votes
0answers
29 views

Is it possible to Direct3D 9 debug DLL in an app using the release version

I have an application using d3d9.dll, but I want to figure out which functions it calls to gain insight. Since online tools I have found are incompatible with my app (32-bit d3d9), is it instead ...
0
votes
1answer
35 views

CreateFileA returning invalid handle when file exists

I was working on a practice binary. It opens the file at C:/WINDOWS/system32/filename#123.dat, if the file does not exist, the check compares the result to -1 (An invalid handle). However, even after ...
0
votes
0answers
133 views

Windows time travel debugging performance bottleneck

First of all I wan to be clear, that this question is not about the collection performance, but indexing performance. What is the performance bottleneck of the indexing step? Some context: Action in ...
0
votes
0answers
55 views

Can I reverse engineer original file names?

I'm new to IT and I turned my external hard-drive into a windows boot disc. I managed to recover files with testdisc & photorec_win. The downside is I got more than I bargened for and I have twice ...
0
votes
0answers
95 views

WMI Spoofing by Fastprox.dll Hooking

I m trying to spoof WMI output by hooking the fastprox.dll. Here is the code I m working on: typedef HRESULT(__stdcall* tGetFunc)(IWbemClassObject*, LPCWSTR, LONG, VARIANT*, CIMTYPE*, long*); static ...
0
votes
0answers
39 views

new to malware analysis and disassembly. dotpeek has been helpful. is this unreadable code due to SuppressIldasmAttribute?

just getting into rev engineering malware. i want to get to source on my own. i could use run.any or VT but that's no fun. any reason why this is unreadable the way it is? is it due to the module ...
0
votes
0answers
34 views

Set standard input/output to a process using NtCreateProcessEx

In the official Windows API function CreateProcessA is possible set or change the standar input and output of the process vía LPSTARTUPINFO structure. How can do this using the undocumented function ...
0
votes
0answers
33 views

How to apply complete type information from PDB for multiple images in one IDA database?

IDA is capable of loading multiple images/DLLs into the same database. In this scenario, ntdll.dll and kernel.dll have been loaded additionally to the main target .exe-file into the database. On top ...
0
votes
0answers
53 views

Reversing Windows binary to find where the error is with Ollydbg

I've some experience with gdb and debugging in Linux environment (I'm studying computer science at University and I'm able to handle bof in Linux). The problem now is on a Windows program. I start it ...
0
votes
0answers
101 views

SSL pinning and bypass

I'm currently investigating one very suspicious app on my system (Windows 10 x64 bit). I wanted to try and understand outgoing https traffic it utilizes by trying to MITM it using Fiddler but as I ...
0
votes
0answers
23 views

Smart Battery Issues, a RE Quest?

TL;DR: Perhaps this doesn't sound like a RE post at first, but it's kind of moving in that direction. Essentially, I replaced the battery in my Surface laptop with 2x different new batteries, and they ...
0
votes
0answers
25 views

Thread keeps generating page fault

So i was recently trying to exploit a kernel mode driver (HEVD) and I encountered a problem which doesn't make sense to me. After i jumped to my shellcode (which resides in usermode), the thread keeps ...
0
votes
0answers
36 views

Fuzzing Third Party Windows Drivers

I want to contribute to vendors while learning how to be a security researcher, and I was wondering: How can I fuzz third party windows drivers? (For instance, those that come with cpu/gpu and similar ...
0
votes
2answers
278 views

CaptureBAT equivalent on Windows 10?

Hello RE community on stack ! I am a beginner, so please pardon any commonplace errors I am looking to run CaptureBAT on a Windows 10 VM, to capture network activity of different kinds of Malwares I ...
0
votes
0answers
50 views

Patching a program in IDA

I've opened a simple Hello World program in IDA (Pro 7.5) like that: global _main extern _printf section .text _main: push message call _printf add esp, 4 push ...
0
votes
0answers
39 views

Renesas Chip reverse engineer mcu

I need to access MCU (the MCU is the Renesas R5H30211) – goal is to reset a register value to 24 as card counts down to 0 for each cycle – I want to reset the card. Can anyone help with this, I do ...
0
votes
0answers
62 views

How to Find Password/ Bypass Password in a Switch Statement using IDA

I'm new to reverse engineering, wondering how access or bypass the password contained in the switch statement ? File Link
0
votes
0answers
88 views

Confusion about if statement in disassembly

I recently got into reverse engineering applications for fun. Can someone please help me with this if statement. 140005914 75 38 JNZ LAB_14000594e 140005916 48 8b 4 MOV ...
0
votes
0answers
40 views

IDA adding a new code

Is it possible to add a new assembler code lines in IDA to a opened, disassembled pe file? For e.g. having such disassembled code in IDA: global _main extern _printf section .text _main:...
0
votes
0answers
25 views

Ollydbg skippingover breakpoint

I am new to the ollydbg world- I am in the middle of injecting shellcode (created with msfvenom...) into a small PE, and during debugging, I can't get it to halt at the breakpoints I set. If I run the ...
0
votes
0answers
46 views

How to discover how a program gets keyboard input?

I'm reversing a windows x86 binary that I can't figure out how the program is getting the keyboard input. I've searched for the windows api functions I was used to but the program doesn't call them. ...
0
votes
0answers
54 views

Forcing embedded libcurl to disable SSL verification

I am trying to decrypt HTTPs communications in a binary that I know has been statically linked with cURL. How can I force curl to not verify SSL certificates for fiddler to intercept? I am using the ...