We’re rewarding the question askers & reputations are being recalculated! Read more.

Hot answers tagged

11

I've done this same exercise with anti-virus engines on a number of occasions. Generally the steps I use are: Identify the CPU/Windows emulator. This is generally the hardest part. Look at filenames, and also grep the disassembly for large switch statements. Find the switches that have 200 or more cases and examine them individually. At least one of ...


9

If you're asking about PE files, and by "no dependencies" you mean "no statically imported DLLs", then yes. See \yoda\NoImports.exe in https://corkami.googlecode.com/files/BinaryCorpus_v2.zip as an example.


7

The assumption does not hold true, as it is possible to alter page protection flags after you've allocated memory. The usual mechanism for code injection on Windows is as follows: Call OpenProcess for the target process, to get a handle that has appropriate access privileges. Use VirtualAllocEx to allocate a buffer in the target process, with a set of ...


7

Injected code could represented by, but not limited to: Remotely created thread could be detected by several techniques: Periodically check if process threads were created by current process using NtQueryProcessInformation. For each thread check if it is running from the address space of the original executable and not from some orphaned memory page: ...


7

You need to use GetThreadSelectorEntry(). Pseudocode: GetThreadContext(hThread, &context); GetThreadSelectorEntry(hThread, context.SegFs, &selectorEntry); ReadProcessMemory(hProcess, (selectorEntry.BaseLow | (selectorEntry.HighWord.Bytes.BaseMid << 0x10) | (selectorEntry.HighWord.Bytes.BaseHi << 0x18)) + 0x2C, &pTLS, sizeof(pTLS), &...


6

If you are using OllyDbg 1.x, you could use the MSDN Help Plugin which simply looks up the requested API call on MSDN. It works for me on my Windows XP sp3 system with OllyDbg 1.x. Of course, this requires internet connectivity. Another incomplete option that may work is to obtain the Windows 7 SDK and be sure to install the "Documentation / Win32 and COM" ...


6

You've got some kind of XY-problem. The truth is: it's IDA who so to say "changes" the name of (something she thinks is) a function from absolutely nothing to sub_{address}. Why on earth would PE-file have non-exported symbols stored in it? Some kind of masochism? To give a candy to reversers? Thus, you have at least three ways of dealing with your problem:...


6

If you want to use a function in the application the bottom line is that you need to know where it's located. Without ASLR you can hardcode the address of the function into your DLL, and use a function pointer to call it. If you want to modify data from a function in a loaded library then you would need to hook that function, and call your own code for its ...


6

welcome to the Reverse Engineering SE! Unfortunately, your question isn't written very well. You shouldn't try to put two different questions into one, because that makes it more difficult to give a good answer. Also, both parts of your question should probably go better to stackoverflow, as both of them are more about software development than about ...


6

IsDebuggerPresent is found in most executables compiled with Visual C++ in the setup code that is executed before the main function. There are also legitimate use cases for SetWindowsHookExA, so you will often see them in clean executables.


5

One way that a process can detect the presence of injected threads is by the use of Thread Local Storage. When a thread is injected, the host's Thread Local Storage callbacks will be called unless the injector takes care to disable that. If the callbacks are called, then the host can query the start address of the new thread and determine if it is within ...


5

First, this article from Trustwave does an excellent job covering the topic thoroughly from a beginner's perspective (note: there are formatting errors throughout the article where it mashes two words together every two lines or so, but that aside, the content is good): https://www.trustwave.com/Resources/SpiderLabs-Blog/Basic-Packers--Easy-As-Pie/ Next, ...


5

I think I got it. GetWindowLongPtr(hWnd, -1) returns a pointer to a nested struct that is a part of the WND struct (that contains main information about a window.) There's really no official name for it, but judging by this function name in comctrl32: I'd define it as such: struct WF{ WF_STATE state; WF_STATE2 state2; DWORD ExStyles; //With ...


4

When printf() is called as an external function, the Windows loader needs to look up the address of the printf() function by-name at run-time so that the caller can find the printf() code. When printf() is called as an embedded library function, the compiler already knows the address of the printf() function at compile-time, and thus doesn't need to embed ...


4

As far as I know IDA doesn't dump structure layouts as part of generated assembly listings. It does however know about all the structures that you mention. Go to the structures window, press "Insert" and name the new structure CONTEXT, EXCEPTION_RECORD or RTL_CRITICAL_SECTION and IDA will show the layout in the structures window. You can then open the "...


4

I'd recommend installing the Windows SDK documentation and the Driver Development Kit if you don't have them already. It might seem like overkill but it's extremely helpful to have both of these documentation kits locally. A word of caution when installing the Windows SDK documentation. Microsoft removed dexplore.exe (viewer) in the Windows 7 2010 SDK ...


4

Is this something You looking for? Win32api and x86 Opcodes


4

Disclaimer: The implementation of these APIs is likely to change between versions of Windows. I will be referencing 32-bit Windows XP SP3 in my answer. Your results may vary. How thread creation works There are three structures that must be initialized before calling NtCreateThread: INITIAL_TEB: Contains pointers to the stack region CONTEXT: Contains ...


4

This code snippet was copied from https://github.com/idapython/src/blob/master/examples/ex_imports.py # ----------------------------------------------------------------------- # This is an example illustrating how to enumerate imports # (c) Hex-Rays # import idaapi def imp_cb(ea, name, ord): if not name: print "%08x: ord#%d" % (ea, ord) ...


4

This may be due to Address Space Layout Randomization aka ASLR (e.g. see this overview by Symantec) System modules' load addresses are randomized on each boot and executable images' are randomized on each execution in OS > Vista you can check that with some simple code like this :\>cat aslr.cpp #include <windows.h> #include <stdio.h> ...


3

Please only ask one question per post. This answer is in response to your first of two questions. Is there a tool to see kernel-space mapping Yes, you can use LiveKd to examine the contents of kernel space. For example, I can see the loaded modules and their addresses in kernel-space with the command lmvk: kd> lmvk start end module name ...


3

Look closely at the code you're looping within: it uses the FS register in several places. Now, googling for "windows FS register" tells you that this holds the segment of the TIB for Thread Information Block. And the first entry in that block, at byte offset 0, has the address of the current SEH, Structured Exception Handler. Your code above is writing to ...


3

That should really say "the identifier of the process that is hosting the thread", since that's what it is. The snapshot that is created by the Toolhelp APIs is system-wide, so in order to understand where a thread lives, you need its process ID. That would be meaningless if it said process A, if process A created a remote thread in process B and then ...


3

This seems like a security ex question instead of one about reverse engineering. Therefore I'd keep my answer short. This should not be possible. Simply as malware would abuse this, what you could do if you want this is find a 0day in kernel space and get SYSTEM privileges. Back in 2010 there was someone from China who has posted a method on the code ...


3

This isn't a very portable trick, but kernel32.dll is always loaded at the same address when the executable is launched, that means LoadLibraryA and GetProcAddress are always at the same address. You could hard-code those offsets and go from there.


3

TLDR; you can't. ProcMon does not record the data which has been read, it only records the API call arguments and return value (such as success or error code). If you want to see the data as well, a debugger or another tool like API Monitor may be more suitable.


3

Those functions are exported from ntdll.dll file. To link with those functions, add #pragma comment (lib, "ntdll.lib") in the source file. Or in Visual Studio, first check the active Configuration and Platform. Then add the library in Project > Properties > Linker > Input > Additional Dependencies. For example, like this %(AdditionalDependencies); ntdll.lib. ...


2

Yes. Find the address of kernel32 using anyone of the known tricks (PEB or any other way) Implement a simple export section parser and find the address of LoadLibrary and GetProcAddress. Use those to load any other API you want.


2

Yes, a program that has no dependencies is possible. To imports APi, it needs first to locate kernel32 (via stack+MZ scanning, or PEB) then locate exports (via exports parsing or hard-coded values).


2

The reason for targeting the RWX pages is that the injected code most often carries data in the same region as the code, and requires that the data are writable. Thus the W flag is needed. The X flag is required to support DEP, in case the process opted in, or if the system enforces it for everyone. The R flag is entirely optional when requesting the page....


Only top voted, non community-wiki answers of a minimum length are eligible