7
votes
Accepted
Finding AddressOfEntryPoint for a 64-bit process
Generally you are doing almost all correct, there are however two simple mistakes.
First and probably most important is here
DWORD_PTR pebOffset = (DWORD_PTR)pbi.PebBaseAddress + 10;
The offset to ...
- 696
6
votes
Accepted
Can benign applications have such APIs?
IsDebuggerPresent is found in most executables compiled with Visual C++ in the setup code that is executed before the main function. There are also legitimate use cases for SetWindowsHookExA, so you ...
- 2,208
6
votes
Accepted
5
votes
Accepted
Information about packers
First, this article from Trustwave does an excellent job covering the topic thoroughly from a beginner's perspective (note: there are formatting errors throughout the article where it mashes two words ...
- 2,234
5
votes
IDA python, list all imported functions
This code snippet was copied from
https://github.com/idapython/src/blob/master/examples/ex_imports.py
# -----------------------------------------------------------------------
# This is an example ...
- 8,408
5
votes
GetWindowLongPtr with undocumented nIndex of -1
I think I got it. GetWindowLongPtr(hWnd, -1) returns a pointer to a nested struct that is a part of the WND struct (that contains main information about a window.) There's really no official name for ...
- 1,639
4
votes
Accepted
CreateProcess - First thread routine - where is the memory allocated for the thread?
Disclaimer: The implementation of these APIs is likely to change between versions of Windows. I will be referencing 32-bit Windows XP SP3 in my answer. Your results may vary.
How thread creation ...
- 1,234
4
votes
Accepted
Why does this function calls offset move when I restart windows
This may be due to Address Space Layout Randomization
aka ASLR (e.g. see this overview by Symantec)
System modules' load addresses are randomized on each boot and
executable images' are randomized ...
- 16.3k
4
votes
How to analyze a child process created by malware by process hollowing mechanism using immunity debugger?
using ollgdbgv2's debug child processes feature
Instead of using Immunity Debugger (which is a forked from OllyDbg1.10), you might want to consider using OllyDbg2.0.
One of the new features in ollydbg ...
- 11.7k
4
votes
What is the difference between kernelBase.dll and Kernel32.dll
I think this is the reason why there are some WinAPIs that also existing in kernelbase.dll.
"As an example of functionality that we moved to low-level binaries, kernelbase.dll gets functionality ...
- 417
4
votes
Accepted
Missing Symbols RtlGetFrame, RtlPushFrame, RtlPopFrame
Those functions are exported from ntdll.dll file. To link with those functions, add #pragma comment (lib, "ntdll.lib") in the source file. Or in Visual Studio, first check the active Configuration and ...
- 1,559
3
votes
Winapi ReadFile monitor
Why not use existing tools to do the job?
If you're just trying to monitor which files get accessed I would suggest to use Process Monitor: Process Monitor is an advanced monitoring tool for Windows ...
- 3,208
3
votes
How to see ReadFile results with ProcMon
TLDR; you can't.
ProcMon does not record the data which has been read, it only records the API call arguments and return value (such as success or error code). If you want to see the data as well, a ...
- 36.4k
3
votes
Extracting strings from binary files (.exe)
If all you're trying to do is replicate what the SysInternals project does, the strings2 project you linked does that and should suit your purposes. The x86/x64 thing is only for a special extraction ...
- 915
3
votes
Accepted
Is there any way to watch a block of memory of the current process for change?
VirtualProtect locks whole page and Raises an Exception on access and removes the PAGE_GUARD Memory Protection.
In the Exception Handler you watch for a your small block
If except->ExceptionRecord-&...
- 16.3k
2
votes
Anti-debugging techniques - Preventing me from setting a memory and hardware breakpoint. How can I bypass that?
Some possibilities (out of many):
1.
The program may call SetThreadContext, or ZwContinue which sets all registers using a new CONTEXT.
If the DRx registers are reset then your hardware breakpoints ...
- 892
2
votes
CreateProcess - First thread routine - where is the memory allocated for the thread?
Ok so ZwCreateThread has it in the context structure (PCONTEXT + 0xB0)
The api calls to receive the address are like this:
CreateSection(..SectionInformation..) - Probably to create to initial ...
- 668
2
votes
MSDetour not detouring SHGetKnownFolderPath
DetourFunction() is from an older version of Detours. Probably best to upgrade to the latest version of the library. (The equivalent function is now DetourAttach().)
If you're using DetourFunction(...
- 20.7k
2
votes
Dumping Memory to Raw File
you can craft a powershell script in case of emergency (no python no internet only base machine cant install anything whatever )
the code below is rubbish hack you may need to declare proper ...
- 16.3k
2
votes
In Memory DLL Injection
Aphex has demo's written in Delphi with a few code injection examples. Should compile with Delphi 2007...maybe even with Delphi 7.
Remote Procedure Injection
InjectLibrary
InjectLibraryEx
...
- 7,542
2
votes
Accepted
Missing kernel32.dll in import table
If you are not using any APIs from kernel32 it will not be added to the import table, simple as that. You were misinformed about kernel32 being required for all applications. It is even possible to ...
- 1,652
2
votes
Accepted
CreateTimerQueueTimer arguments differs from WinAPI
Yep, I think I've seen a similar case before. It happens very rarely, but because you can do some stunts at the C preprocessor level as well as at the linker level, this happens to work.
In this case ...
- 10.9k
2
votes
In the context of the Windows API, what extra information do the debugging symbols provide that the export table doesnt provide?
without symbols most of the calls would be like call dword ptr ds :[12345678] or call 45678976 or jmp 86753535 etc
with symbols it would be like call dword ptr ds:[exitprocess]
call foo32!...
- 16.3k
2
votes
In the context of the Windows API, what extra information do the debugging symbols provide that the export table doesnt provide?
Most available public symbol files provide only global function and variable names (both exported and non-exported ones). A small minority (e.g. ntdll, kernel32, ntoskrnl) also include various system ...
- 36.4k
2
votes
funcion calls extern function without body
.idata section is similar to ELF's .got and contains pointers to external function, although IDA internally pretends that they're functions. They're normally grouped by a DLL/library from each they're ...
- 36.4k
2
votes
Are win32api calls differentiable from real actions?
If a game wants it can easily distinguish between simulated and real mouse clicks. For example, a game can install low-level mouse hook (it will not require admin privileges) and look at ...
- 183
1
vote
How to debug slow Windows API calls?
Windows applications do not work in isolation. They have to share the processor with all the other processes, services, drivers and so on. There may be a myriad reasons why a specific API call is slow,...
- 36.4k
1
vote
Accepted
Magic number in resource loading routine
This seems to be an optimized wchar_t string copy. The compiler took advantage of the fact that there is a fixed offset between source and destination. Ignoring the lea check, the assembly could be ...
- 36.4k
1
vote
What is \Sessions\1\BaseNamedObjects\NamedBuffer?
About this line:
00000034 Mutant 2. 001F0001
A mutant is the kernel name for a mutex.
The name mutant has a colorful history. Early in Windows NT's
development, Dave Cutler ...
- 33
Only top scored, non community-wiki answers of a minimum length are eligible