Questions tagged [windows]

Windows refers to the Microsoft Windows series of operating systems.

126 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
0
votes
0answers
88 views

Confusion about if statement in disassembly

I recently got into reverse engineering applications for fun. Can someone please help me with this if statement. 140005914 75 38 JNZ LAB_14000594e 140005916 48 8b 4 MOV ...
0
votes
0answers
42 views

IDA adding a new code

Is it possible to add a new assembler code lines in IDA to a opened, disassembled pe file? For e.g. having such disassembled code in IDA: global _main extern _printf section .text _main:...
0
votes
0answers
28 views

Ollydbg skippingover breakpoint

I am new to the ollydbg world- I am in the middle of injecting shellcode (created with msfvenom...) into a small PE, and during debugging, I can't get it to halt at the breakpoints I set. If I run the ...
0
votes
0answers
54 views

How to discover how a program gets keyboard input?

I'm reversing a windows x86 binary that I can't figure out how the program is getting the keyboard input. I've searched for the windows api functions I was used to but the program doesn't call them. ...
0
votes
0answers
61 views

Forcing embedded libcurl to disable SSL verification

I am trying to decrypt HTTPs communications in a binary that I know has been statically linked with cURL. How can I force curl to not verify SSL certificates for fiddler to intercept? I am using the ...
0
votes
3answers
287 views

How to find the address (offset) of specific driver function

I am reversing Capcom driver and in IDA I have this list of functions: I want to set breakpoint on the function sub_10590 but I don't know what is the address of this function when I am doing live ...
0
votes
0answers
66 views

String as constant , even not visible in disassembler

I was reading this article Where I saw that while reversing the WinRAR I saw that the x64dbg is not able to search for a string in all modules "evaluation copy". but why is that happening. ...
0
votes
0answers
42 views

Module name in the export table of a PE image

One of the fields of the PE export table is the image name, see screenshot below for an example. This name is part of the file, even though I can rename it to any other name after it's compiled. My ...
0
votes
0answers
29 views

What is the meaning of call ds:ApiName[registry*constant] in IDA .asm files?

I have a dataset of .ASM files generated by IDA (dont have the corresponding file) now there are a lot of calls like this : .text:00637114 5F pop edi .text:...
0
votes
0answers
57 views

Watching a TLS Slot value in x64dbg

I am new to reverse engineering and I was trying to debug why a 3rd party application was crashing when I m injecting my DLL in it. (There are some cases where it didn't crash) So I was able to figure ...
0
votes
0answers
40 views

Windows pintool mismatch between call/ret instructions

So i've been trying to write a pintool that monitors call/ret instructions but i've noticed that threre was a significant inconsistency between the two. For example ret instructions without previous ...
0
votes
0answers
89 views

How to find and edit the source of a string in a DX11 game's exe/files (debug build of the game available)

I want to find and edit the values for the motion blur effect in Naruto: Ultimate Ninja Storm 3 on PC (Windows, DX11) to be more in line with the PS3 version (and the other Storm games on PC as well). ...
0
votes
0answers
1k views

How to bypass SSL certificate pinning on Windows 10

When reverse engineering a big application, it can be very useful to be able to see the network traffic it generates. Because of this, many applications use HTTPS to communicate with their servers. ...
0
votes
0answers
216 views

How can I debug code execution on a Native->Unity/Mono/C# Application

I'm reverse engineering a Windows application which has a main executable that appears to run some boilerplate/stub code before calling UnityMain and also using Mono. This means that if I use an ...
0
votes
0answers
78 views

Intel Pin assertion failed: RTN_Valid(x)

I am working on modifying my Intel Pin based tool. As before I am using VS2015 on Windows 10. Previously, I have been testing a tool on the same system where I build it and it worked just fine. The ...
0
votes
0answers
47 views

Alternative APIs to hook instead of messagebox for message pop ups?

So i am reversing an app that pops up a message at some point, but its not doing this using messagebox i also tried to pause and then run to user code but didn't work, so what are some of the other ...
0
votes
0answers
394 views

injecting through APC using LdrLoadDll fails on `CiValidateImageHeader`

I've encountered an image validation error while trying to inject dll from driver which add apc task to be performed by alertable thread. the function task include calling to LdrLoadDll with the ...
0
votes
0answers
290 views

find a video file in memory dump of a process

I have a player that plays encrypted video files and works like this: I open an encrypted video file with it it decrypts the video file and writes it to its memory and plays the file from the memory ...
0
votes
0answers
62 views

Output address path during .exe execution

I have an obfuscated software. I'm a beginner in this area, so I don't find where a patch would be useful for what I want to do. It turns out that I have an idea of how I could find out in which ...
0
votes
0answers
106 views

Help reverse engineering a small (60kb) .exe file used for extracting .tga images from a custom container

The executable grabs the specified container format and extracts .tga images from it. It was community-made to satisfy a certain niche, unfortunately I cannot get into contact with the original ...
0
votes
1answer
64 views

Windows User Identification / HWID Limiting

I've been playing a game that has an HWID limit and a bunch of other limitations, such as: a) Cannot be ran in a VM b) Cannot be ran using Sandboxie and other Sandbox environments c) Limits 3 ...
0
votes
1answer
250 views

2 Stage Shellcode Embedded in Doc file [Out Of Memory - Can't extract it]

So, here is the context: All start with a RTF file that has 3 objects. The first one loads a non-ASLR module "MSCOMCTL.OCX" and uses it to succed on a Heap Spray technique so it allocates enough ...
-1
votes
0answers
38 views

Finding registry keys/values using IDA PRO

It's been a while since I've started optimizing my Windows 10 and the great way how to do it, is by using IDA PRO by looking for "strings" from .sys or .dll files. Problem is, that I need to ...
-1
votes
1answer
137 views

The executable file makes a unique ID from each individual PC. Can anyone decipher from where the file makes these unique IDs?

The file generates random unique ID. It says hardware ID but I couldn't find it in product key, BIOS serial number or anywhere. I used IDA but I couldn't get from where the file creates the code. Even ...
-1
votes
1answer
637 views

IDA Pro: Converting structure to decimal

I'm new with IDA pro and have little problem. Right click on some data in .rdata brings options in which I can convert, In that window D means decimal B means binary and so on, but I have multiple Ds ...
-1
votes
1answer
52 views

How to find bugs in a modern desktop application with reverse enginnering?

I would like to clarify the context for the question: I have studied different types of exploiting but all the studies I have carried out were with command line programs and with functions that I ...

1 2
3