Skip to main content
7 votes
Accepted

Finding AddressOfEntryPoint for a 64-bit process

Generally you are doing almost all correct, there are however two simple mistakes. First and probably most important is here DWORD_PTR pebOffset = (DWORD_PTR)pbi.PebBaseAddress + 10; The offset to ...
morsisko's user avatar
  • 696
6 votes

IDA python, list all imported functions

This code snippet was copied from https://github.com/idapython/src/blob/master/examples/core/list_imports.py """ summary: enumerate file imports description: Using the API to ...
w s's user avatar
  • 8,508
6 votes
Accepted

Can benign applications have such APIs?

IsDebuggerPresent is found in most executables compiled with Visual C++ in the setup code that is executed before the main function. There are also legitimate use cases for SetWindowsHookExA, so you ...
ekse's user avatar
  • 2,208
6 votes
Accepted

How to disassemble an entire function in Windbg?

uf foo!blah unassemble full function
blabb's user avatar
  • 16.4k
5 votes
Accepted

Information about packers

First, this article from Trustwave does an excellent job covering the topic thoroughly from a beginner's perspective (note: there are formatting errors throughout the article where it mashes two words ...
dsasmblr's user avatar
  • 2,234
5 votes

GetWindowLongPtr with undocumented nIndex of -1

I think I got it. GetWindowLongPtr(hWnd, -1) returns a pointer to a nested struct that is a part of the WND struct (that contains main information about a window.) There's really no official name for ...
c00000fd's user avatar
  • 1,711
4 votes
Accepted

CreateProcess - First thread routine - where is the memory allocated for the thread?

Disclaimer: The implementation of these APIs is likely to change between versions of Windows. I will be referencing 32-bit Windows XP SP3 in my answer. Your results may vary. How thread creation ...
user1354557's user avatar
  • 1,234
4 votes

What is the difference between kernelBase.dll and Kernel32.dll

I think this is the reason why there are some WinAPIs that also existing in kernelbase.dll. "As an example of functionality that we moved to low-level binaries, kernelbase.dll gets functionality ...
ismael_akez's user avatar
4 votes
Accepted

Why does this function calls offset move when I restart windows

This may be due to Address Space Layout Randomization aka ASLR (e.g. see this overview by Symantec) System modules' load addresses are randomized on each boot and executable images' are randomized ...
blabb's user avatar
  • 16.4k
4 votes

How to analyze a child process created by malware by process hollowing mechanism using immunity debugger?

using ollgdbgv2's debug child processes feature Instead of using Immunity Debugger (which is a forked from OllyDbg1.10), you might want to consider using OllyDbg2.0. One of the new features in ollydbg ...
NirIzr's user avatar
  • 11.8k
4 votes
Accepted

Missing Symbols RtlGetFrame, RtlPushFrame, RtlPopFrame

Those functions are exported from ntdll.dll file. To link with those functions, add #pragma comment (lib, "ntdll.lib") in the source file. Or in Visual Studio, first check the active Configuration and ...
Biswapriyo's user avatar
  • 1,569
3 votes

Winapi ReadFile monitor

Why not use existing tools to do the job? If you're just trying to monitor which files get accessed I would suggest to use Process Monitor: Process Monitor is an advanced monitoring tool for Windows ...
Remko's user avatar
  • 3,273
3 votes

How to see ReadFile results with ProcMon

TLDR; you can't. ProcMon does not record the data which has been read, it only records the API call arguments and return value (such as success or error code). If you want to see the data as well, a ...
Igor Skochinsky's user avatar
  • 36.8k
3 votes

Extracting strings from binary files (.exe)

If all you're trying to do is replicate what the SysInternals project does, the strings2 project you linked does that and should suit your purposes. The x86/x64 thing is only for a special extraction ...
hairlessbear's user avatar
3 votes
Accepted

Is there any way to watch a block of memory of the current process for change?

VirtualProtect locks whole page and Raises an Exception on access and removes the PAGE_GUARD Memory Protection. In the Exception Handler you watch for a your small block If except->ExceptionRecord-&...
blabb's user avatar
  • 16.4k
2 votes

CreateProcess - First thread routine - where is the memory allocated for the thread?

Ok so ZwCreateThread has it in the context structure (PCONTEXT + 0xB0) The api calls to receive the address are like this: CreateSection(..SectionInformation..) - Probably to create to initial ...
0xAK's user avatar
  • 668
2 votes

Anti-debugging techniques - Preventing me from setting a memory and hardware breakpoint. How can I bypass that?

Some possibilities (out of many): 1. The program may call SetThreadContext, or ZwContinue which sets all registers using a new CONTEXT. If the DRx registers are reset then your hardware breakpoints ...
Yotamz's user avatar
  • 1,272
2 votes

MSDetour not detouring SHGetKnownFolderPath

DetourFunction() is from an older version of Detours. Probably best to upgrade to the latest version of the library. (The equivalent function is now DetourAttach().) If you're using DetourFunction(...
Jason Geffner's user avatar
2 votes

Dumping Memory to Raw File

you can craft a powershell script in case of emergency (no python no internet only base machine cant install anything whatever ) the code below is rubbish hack you may need to declare proper ...
blabb's user avatar
  • 16.4k
2 votes

In Memory DLL Injection

Aphex has demo's written in Delphi with a few code injection examples. Should compile with Delphi 2007...maybe even with Delphi 7. Remote Procedure Injection InjectLibrary InjectLibraryEx ...
Mick's user avatar
  • 7,582
2 votes
Accepted

Missing kernel32.dll in import table

If you are not using any APIs from kernel32 it will not be added to the import table, simple as that. You were misinformed about kernel32 being required for all applications. It is even possible to ...
mrexodia's user avatar
  • 1,672
2 votes
Accepted

CreateTimerQueueTimer arguments differs from WinAPI

Yep, I think I've seen a similar case before. It happens very rarely, but because you can do some stunts at the C preprocessor level as well as at the linker level, this happens to work. In this case ...
0xC0000022L's user avatar
  • 10.9k
2 votes

In the context of the Windows API, what extra information do the debugging symbols provide that the export table doesnt provide?

without symbols most of the calls would be like call dword ptr ds :[12345678] or call 45678976 or jmp 86753535 etc with symbols it would be like call dword ptr ds:[exitprocess] call foo32!...
blabb's user avatar
  • 16.4k
2 votes

In the context of the Windows API, what extra information do the debugging symbols provide that the export table doesnt provide?

Most available public symbol files provide only global function and variable names (both exported and non-exported ones). A small minority (e.g. ntdll, kernel32, ntoskrnl) also include various system ...
Igor Skochinsky's user avatar
  • 36.8k
2 votes

funcion calls extern function without body

.idata section is similar to ELF's .got and contains pointers to external function, although IDA internally pretends that they're functions. They're normally grouped by a DLL/library from each they're ...
Igor Skochinsky's user avatar
  • 36.8k
2 votes

Are win32api calls differentiable from real actions?

If a game wants it can easily distinguish between simulated and real mouse clicks. For example, a game can install low-level mouse hook (it will not require admin privileges) and look at ...
ESkri's user avatar
  • 185
2 votes

How can I set up a conditional breakpoint for the CreateFileW function for when a specific file/path is read in x64dbg?

You can use expression functions to achieve what you want, specifically the streq/strstr functions. To break when a specific file is accessed: streq(utf16(arg.get(0)), "C:\my\file\bla.txt") ...
mrexodia's user avatar
  • 1,672
1 vote

How to debug slow Windows API calls?

Windows applications do not work in isolation. They have to share the processor with all the other processes, services, drivers and so on. There may be a myriad reasons why a specific API call is slow,...
Igor Skochinsky's user avatar
  • 36.8k
1 vote
Accepted

Magic number in resource loading routine

This seems to be an optimized wchar_t string copy. The compiler took advantage of the fact that there is a fixed offset between source and destination. Ignoring the lea check, the assembly could be ...
Igor Skochinsky's user avatar
  • 36.8k

Only top scored, non community-wiki answers of a minimum length are eligible