Questions tagged [windows]
Windows refers to the Microsoft Windows series of operating systems.
834
questions
5
votes
2
answers
21k
views
Why my Resource Hacker doesn't work with some .EXE files
I use Resource Hacker Application for Reverse Engineering purposes, I've cracked 3 softwares by using this software, but it doesn't grab all .EXE, .DLL files.
sometimes It says, This is not a valid ...
- 293
5
votes
3
answers
860
views
Is there any websites to get malware files using YARA rules?
I want to know, Is there any websites which has malware files (Windows OS) that are detected by YARA rules?
Note: I know some websites to get android malware samples using YARA.
But, I need Windows ...
- 121
5
votes
2
answers
2k
views
How are addresses calculated from the values in x86 segment registers?
How are the 16-bit values in segment registers used to represent large memory addresses?
ES 0023 32bit 0(FFFFFFFF)
CS 001B 32bit 0(FFFFFFFF)
SS 0023 32bit 0(FFFFFFFF)
DS 0023 32bit 0(FFFFFFFF)
FS ...
- 83
5
votes
1
answer
6k
views
How to change address in the hex view in IDA debugger?
I'm just learning the IDA pro debugger, so I apologize if this is something simple. Say, if I opened a debugee process and started stepping through it with a debugger (WinDbg) and then want to look up ...
- 1,659
5
votes
2
answers
10k
views
Tracing function calls in x64dbg
I'm new with x64dbg and want to know if there is any way to get the trace of a functions inside a module?
I've used trace over option, but basically it just traces all the insturctions but doesn't "...
- 203
5
votes
2
answers
895
views
Safe way to download a malware payload?
I'm trying to analyze a piece of malware that is most-likely a downloader. During dynamic analysis on an isolated VM network, Wireshark registered a GET request to a server for what I believe is the ...
- 163
5
votes
1
answer
2k
views
What is the command to "go to current statement" in IDA debugger?
I'm trying to learn how to use the IDA pro debugger (having used Visual Studio's C++ debugger for years) and I'm struggling to find how to switch the code/asm view back to the current instruction that ...
- 1,659
5
votes
1
answer
8k
views
What tools are available to trace system resources a program is touching in windows?
What is the best tool to trace system resources a program is touching. For example, which registry keys, other files or DLLs it's loading, internet connections it's opening, etc...?
I saw this ...
5
votes
2
answers
6k
views
How to hook the entry point of a DLL?
I have written a C API with support for static import hooking via overwriting the corresponding IAT entry of an exported function. It works nicely for older simple applications, but for more modern ...
- 398
5
votes
1
answer
1k
views
Microsoft Edge and it's related processes may have turned protected in windows 10 1903
It seems like driver based injection using APC calls fails on MicrosoftEdge and it's related processes (browser_broker.exe , MicrosoftEdgeCP.exe and MicrosoftEdge.exe).
Looking into the problem, it ...
- 293
5
votes
3
answers
567
views
How to backport Vista program to XP without source code?
Generally when I have Vista application it upgrade few function from kernel32.dll
most often being InitializeCriticalSection -> InitializeCriticalSectionEx
Is it possibly to backport such? beside ...
- 53
5
votes
1
answer
2k
views
Prevent malware from deleting itself during installation on Windows x64
Can anyone suggest a tool to prevent a malware from deleting itself on Windows x64? The purpose is to collect all the components of the whole process of infection.
I've looked at CaptureBat, but its ...
- 3,052
5
votes
2
answers
2k
views
Viewing memory permissions in Ollydbg for memory segments
I'm looking for a way to view memory permissions on a specific section of memory using OllyDbg (technically I'm using Immunity but I'm assuming if it exists in Olly it'll be the same there).
The ...
- 1,022
5
votes
3
answers
607
views
Is there a tool to see kernel space mapping of a Windows exe?
In Microsoft Windows, a 32bits process calc.exe has 0x0-0x80000000 (2GB) reserved as its user-space and the rest is kernel-space (2GB). So, a process has 2+2 = 4GB of virtual space. This ratio could ...
- 391
5
votes
1
answer
837
views
What is an indicator that a PE section definitely contains stuff of a specific type?
I was recently working with the Microsoft documentation about the PE and COFF specifications.
Chapter 5 shows several more or less "soft" indicators and characteristics to recognize what kind of ...
- 1,083
5
votes
1
answer
3k
views
__security_cookie for function pointers in Windows 10
I'm curious about this __security_cookie that I keep seeing all over the msvcp140.dll from my Windows 10 x64 (insider build.)
Here's an example:
Note that the address for indirect function call (or ...
- 1,659
5
votes
2
answers
1k
views
windbg crashdump process by pid from kernel
What is the best way to dump user space process by pid debugging the kernel with windbg? I'm able to attach to the process from user-space with windbg and generate crash by .dump, but how would I do ...
- 51
5
votes
2
answers
1k
views
Fixing/recompiling a heavily control flow obfuscated function
I've recently come across a binary that has been obfuscated with a very obscure protection.
Obfuscation
From what I understand, the obfuscator is effective in several ways.
Multiple JMPs via relative ...
user29468
5
votes
1
answer
226
views
Where can I, as an individual, find clean programs to analyze?
This question includes a good list of sources where an individual might collect malware samples for analysis.
I'd like to get a large number of public, non-malicious programs for the purpose of ...
- 159
5
votes
1
answer
356
views
Why is function in kernel32.dll jumping into a api-ms-win-core stub
I was trying to look into the implementation of GetVersion function in kernel32.dll.
I was surprised to see that the GetVersion thunk is issuing a jump to API-MS-WIN-CORE-SYSINFO-L1-1-0.DLL::...
- 205
5
votes
1
answer
920
views
Why is ASLR not activated though IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE is set?
Even a minimal console Delphi program that has IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE set in its PE image does not use ASLR.
GetProcessMitigationPolicy() returns a PROCESS_MITIGATION_ASLR_POLICY of 0.
...
- 51
5
votes
1
answer
207
views
Replace a function in a Windows 32-bit binary with a custom C function
I am reverse engineering a Windows game from 1995 using Ghidra, and I'm currently documenting all the decompiled functions. My goal is to replace a function in the original binary with a custom C ...
- 191
5
votes
0
answers
791
views
Page Fault Handler in Windows
Like almost all of my questions, I feel like I'm missing something / I understood something the wrong way, so help me figure out where I'm wrong with this.
When a Page Fault occurs and nt!KiTrap0E ...
- 327
4
votes
3
answers
28k
views
Could not find main function in IDA pro?
I have newbie question that concerns IDA pro and Visual studio 2010. Basically I started a new "Empty Project" in VS 2010 and added a main function to the .cpp file. Then I compiled it to binary and ...
- 253
4
votes
2
answers
11k
views
What is the difference between IDA and OllyDbg?
When I want to debug an exe in Windows, what advantages does OllyDbg have over IDA?
In IDA, I'm using the WinDbg debugger back-end.
- 523
4
votes
2
answers
2k
views
What could be the purpose of XORing esp with a global variable? (stack canary protection)
I am currently looking at a function inside a Win32 executable's main module. After allocating memory on the stack (sub esp) and saving some registers on the stack, the value of esp is XORed with a ...
4
votes
5
answers
5k
views
How to find a subroutine (or next instruction) called after returning from a (Windows) dialog box?
The dialog box is a password challenge, and I'd like to catch/trace/observe the code (hopefully the password-checking code) that gets executed right after clicking the OK button of the dialog box.
I ...
- 151
4
votes
2
answers
3k
views
Is it possible to download program database (PDB) files of Microsoft Windows binaries without installing any software?
I want to download the .pdb files of Windows binaries (e.g., notpad.exe) on machines where the user doesn't have admin rights, nor has any debugger available. I was wondering if it is possible to ...
- 189
4
votes
3
answers
4k
views
Get interface definition of undocumented COM objects
I have started exploring COM objects, initially I got to it from UAC bypass methods but I guess my question is general. The general question is: How can I get from (elevated) CLSID in the registry to ...
- 143
4
votes
2
answers
4k
views
How to do Global DLL injection
How can one go about injection of a DLL into every process? Can SetwindowsHookEx() do the trick? Does AppInit_DLLs work as it used to?
- 41
4
votes
2
answers
2k
views
Find the kernel structure that contains device name
I'm using WinDbg to try enumerate drivers and their associated devices. Getting the driver name is very easy. It is found in the _DRIVER_OBJECT structure. Unfortunately, the _DEVICE_OBJECT does not ...
- 323
4
votes
2
answers
678
views
Forcing a legacy Windows application to use an older version of ntdll.dll
There is this old Windows application I've been using for more than a decade now: DesktopEarth. It got its last update in 2015 and the author's website is offline now, but it's been running fine on ...
- 141
4
votes
3
answers
496
views
Help disassembling a simple 16-bit NE function
I am currently attempting to reverse engineer a simple function from within a 16-Bit Windows 3.1 (NE) DLL, which from what I can tell is used to display a message box when required.
I would assume ...
- 165
4
votes
2
answers
4k
views
Real PE32(+) entry point - is it documented anywhere?
Microsoft documentation gives WinMain() as the entry point for a Windows program, but unlike DllMain() it seems to be a pure fiction arranged by the compiler-provided startup code.
I've looked at the ...
- 2,010
4
votes
2
answers
2k
views
How does Ollydbg obtain the memory map (alt+m)? [closed]
I've been looking for any Windows functions to view or dump memory, or the process to do this manually. I can not find info on this anywhere online.
How would I get a dump of a process's memory like ...
- 193
4
votes
2
answers
366
views
Edit Windows protected systemfiles in VMWARE?
How can I edit Windows protected system internal files in VMWARE?
On a normal PC, I can simply reboot the PC and use a different Operating System to prevent the 'access denied' error... But how do I ...
- 41
4
votes
2
answers
1k
views
How to show KUSER_SHARED_DATA members in decompiled C code?
Here is a sample C code which prints Windows version directly from address
of KUSER_SHARED_DATA. Tested in Windows 10 only. The raw memory address
differ in Windows version but that's not the point.
#...
- 1,569
4
votes
1
answer
2k
views
How can I modify binary image resource data?
I've been hacking and modding software for years, and have learned a lot, but there are still a few things that vex me - this is one such case.
I have noticed that some PEs contain an RCData section ...
- 193
4
votes
2
answers
1k
views
What is this hidden stack used by syscalls on Windows?
I've noticed there is a memory region in user mode on Windows 7 x64 WOW64 that changes during syscalls. It is located quite low in the address space and has the characteristics of a stack, i.e. it ...
- 153
4
votes
2
answers
1k
views
CreateProcess - First thread routine - where is the memory allocated for the thread?
When calling CreateProcess internally it will call (obviously ZwCreateProcessEx and then) ZwCreateThread with a CreateSuspended set to True, then i assume final initialization is taking place. ...
- 668
4
votes
3
answers
2k
views
Are there exports with neither ordinal nor name or am I not understanding the PE documentation?
I don't understand one thing in the export data directory of PE files.
The documentation says that there is a set count of exports (let's name it ExportCount, first row of following table) and another ...
- 1,083
4
votes
1
answer
99
views
registers set by function
How can I figure out which general-purpose registers are modified by a function call. I am programming a Win32 Assembly program that calls IsDebuggerPresent(). According to MSDN, it will return a ...
- 113
4
votes
3
answers
6k
views
How to find the starting address of text section of a DLL inside a process? (64 bit)
There was a question about this a year ago, but the answer doesn't explain how to do it in C/C++:
How to find start of .text section?
I'm not talking about module start address, which we can get ...
- 232
4
votes
2
answers
11k
views
How to edit and modify a class with ILSpy + Reflexil
In the Maxsea.SmartDesktop.dll, I want to edit and modify class b1g.
There is this in :
if (isCrackedResult != null && isCrackedResult.IsCracked)
and I want to modify for this :
if (...
- 41
4
votes
1
answer
127
views
Windows 11: Interact with IDA pro when running in session 0
I am trying to debug a windows service, so I set IDA as the debugger of that service.
But since services are running in session 0, I can't interact with IDA. Also in the latest windows version (e.g. ...
- 53
4
votes
1
answer
582
views
ntoskrnl checksum mismatch
I had hex-edited windows kernel file c:\windows\system32\ntoskrnl.exe to fix some assembly bytes in the way i need it.
System wont boot because of STATUS_IMAGE_CHECKSUM_MISMATCH error (0xC0000221; ...
- 143
4
votes
1
answer
2k
views
If we have IMAGE_IMPORT_DESCRIPTOR, Is the IAT redundant?
Since each IMAGE_IMPORT_DESCRIPTOR already points to a RVA for the resolved virtual addresses the IAT seems to be redundant. Why is this data directory included? If I overwrite the RVA/size for the ...
- 111
4
votes
2
answers
565
views
How to break on a clipboard operation in cmd.exe with IDA / WinDbg?
My goal is to see what's going on "under the hood" in the Windows command prompt when a user pastes text into it. So I loaded cmd.exe into IDA Pro that is set up in conjunction with the WinDbg ...
- 1,659
4
votes
2
answers
3k
views
Reversing a Windows service
I am trying to reverse engineer a malware that open a windows service dynamically in OllyDbg.
When the malware calls StartServiceCtrDispatcherW, I receive an error:
How I can continue to analyze ...
- 43
4
votes
1
answer
137
views
Replacing a function in a 1995 Windows 32-bit binary using Frida causes crash
I am working with a 1995 Windows 32-bit binary compiled with Watcom, which uses the Watcom calling convention. I am trying to replace a simple string length calculation function in the binary using ...
- 191