Hot answers tagged

7 votes
Accepted

Finding AddressOfEntryPoint for a 64-bit process

Generally you are doing almost all correct, there are however two simple mistakes. First and probably most important is here DWORD_PTR pebOffset = (DWORD_PTR)pbi.PebBaseAddress + 10; The offset to ...
user avatar
  • 686
6 votes
Accepted

GUI represention in assembly level and another question

welcome to the Reverse Engineering SE! Unfortunately, your question isn't written very well. You shouldn't try to put two different questions into one, because that makes it more difficult to give a ...
user avatar
6 votes
Accepted

DLL Injection search for procedures/variables

If you want to use a function in the application the bottom line is that you need to know where it's located. Without ASLR you can hardcode the address of the function into your DLL, and use a ...
user avatar
  • 211
6 votes
Accepted

Can benign applications have such APIs?

IsDebuggerPresent is found in most executables compiled with Visual C++ in the setup code that is executed before the main function. There are also legitimate use cases for SetWindowsHookExA, so you ...
user avatar
  • 2,158
5 votes
Accepted

Information about packers

First, this article from Trustwave does an excellent job covering the topic thoroughly from a beginner's perspective (note: there are formatting errors throughout the article where it mashes two words ...
user avatar
  • 2,144
5 votes

GetWindowLongPtr with undocumented nIndex of -1

I think I got it. GetWindowLongPtr(hWnd, -1) returns a pointer to a nested struct that is a part of the WND struct (that contains main information about a window.) There's really no official name for ...
user avatar
  • 1,275
4 votes
Accepted

CreateProcess - First thread routine - where is the memory allocated for the thread?

Disclaimer: The implementation of these APIs is likely to change between versions of Windows. I will be referencing 32-bit Windows XP SP3 in my answer. Your results may vary. How thread creation ...
user avatar
  • 1,194
4 votes

How to analyze a child process created by malware by process hollowing mechanism using immunity debugger?

using ollgdbgv2's debug child processes feature Instead of using Immunity Debugger (which is a forked from OllyDbg1.10), you might want to consider using OllyDbg2.0. One of the new features in ollydbg ...
user avatar
  • 11.3k
4 votes

IDA python, list all imported functions

This code snippet was copied from https://github.com/idapython/src/blob/master/examples/ex_imports.py # ----------------------------------------------------------------------- # This is an example ...
user avatar
  • 7,710
4 votes
Accepted

Why does this function calls offset move when I restart windows

This may be due to Address Space Layout Randomization aka ASLR (e.g. see this overview by Symantec) System modules' load addresses are randomized on each boot and executable images' are randomized ...
user avatar
  • 14.8k
4 votes

What is the difference between kernelBase.dll and Kernel32.dll

I think this is the reason why there are some WinAPIs that also existing in kernelbase.dll. "As an example of functionality that we moved to low-level binaries, kernelbase.dll gets functionality ...
user avatar
4 votes
Accepted

Missing Symbols RtlGetFrame, RtlPushFrame, RtlPopFrame

Those functions are exported from ntdll.dll file. To link with those functions, add #pragma comment (lib, "ntdll.lib") in the source file. Or in Visual Studio, first check the active Configuration and ...
user avatar
  • 1,439
3 votes

Winapi ReadFile monitor

Why not use existing tools to do the job? If you're just trying to monitor which files get accessed I would suggest to use Process Monitor: Process Monitor is an advanced monitoring tool for Windows ...
user avatar
  • 2,908
3 votes
Accepted

Is there a tool to see kernel space mapping of a Windows exe?

Please only ask one question per post. This answer is in response to your first of two questions. Is there a tool to see kernel-space mapping Yes, you can use LiveKd to examine the contents of ...
user avatar
3 votes
Accepted

Why do i get into endless loop in winapi when i am debugging?

Look closely at the code you're looping within: it uses the FS register in several places. Now, googling for "windows FS register" tells you that this holds the segment of the TIB for Thread ...
user avatar
3 votes

How to see ReadFile results with ProcMon

TLDR; you can't. ProcMon does not record the data which has been read, it only records the API call arguments and return value (such as success or error code). If you want to see the data as well, a ...
user avatar
  • 34.6k
3 votes
Accepted

Is there any way to watch a block of memory of the current process for change?

VirtualProtect locks whole page and Raises an Exception on access and removes the PAGE_GUARD Memory Protection. In the Exception Handler you watch for a your small block If except->ExceptionRecord-&...
user avatar
  • 14.8k
2 votes

How to debug a self-debugging process?

Use ProcessHacker to pause the parent process and then try to Stop deattach debugger from Processhacker
user avatar
  • 21
2 votes

Anti-debugging techniques - Preventing me from setting a memory and hardware breakpoint. How can I bypass that?

Some possibilities (out of many): 1. The program may call SetThreadContext, or ZwContinue which sets all registers using a new CONTEXT. If the DRx registers are reset then your hardware breakpoints ...
user avatar
  • 822
2 votes

finding a RC4 Encryption function in obfuscated assembly code with no symbols

Is there any static opcode usage or number in the assembly of an RC4 encryption? Opcode: Search the disassembly for xor <x>, <y> where <x> != <y>. Number: Search for 0x100 ...
user avatar
2 votes

Command Injection in Windows ShellExecuteA()?

It depends on the lpFile argument. If lpFile is a command-line interpreter (such as cmd.exe or powershell.exe) or a program that can accept code as a command line argument (such as perl.exe or ruby....
user avatar
2 votes

Is there a tool to see kernel space mapping of a Windows exe?

if you have windbg installed open a command prompt and execute C:>cdb -c "!address;.attach -k;g;!address;.detach;q" calc 0:000> cdb: Reading initial command '!address;.attach -k;g;!address;....
user avatar
  • 14.8k
2 votes

How to compare no-case sensitive strings IDC

In the breakpoint settings for the given breakpoint, press the ... button, select Python as the scripting langauge, and use the following script body: GetString(DbgDword(esp + 0x4), -1, ASCSTR_C)....
user avatar
2 votes

MSDetour not detouring SHGetKnownFolderPath

DetourFunction() is from an older version of Detours. Probably best to upgrade to the latest version of the library. (The equivalent function is now DetourAttach().) If you're using DetourFunction(...
user avatar
2 votes

CreateProcess - First thread routine - where is the memory allocated for the thread?

Ok so ZwCreateThread has it in the context structure (PCONTEXT + 0xB0) The api calls to receive the address are like this: CreateSection(..SectionInformation..) - Probably to create to initial ...
user avatar
  • 638
2 votes

Dumping Memory to Raw File

you can craft a powershell script in case of emergency (no python no internet only base machine cant install anything whatever ) the code below is rubbish hack you may need to declare proper ...
user avatar
  • 14.8k
2 votes

In Memory DLL Injection

Aphex has demo's written in Delphi with a few code injection examples. Should compile with Delphi 2007...maybe even with Delphi 7. Remote Procedure Injection InjectLibrary InjectLibraryEx ...
user avatar
  • 7,322
2 votes
Accepted

Missing kernel32.dll in import table

If you are not using any APIs from kernel32 it will not be added to the import table, simple as that. You were misinformed about kernel32 being required for all applications. It is even possible to ...
user avatar
  • 1,602
2 votes
Accepted

CreateTimerQueueTimer arguments differs from WinAPI

Yep, I think I've seen a similar case before. It happens very rarely, but because you can do some stunts at the C preprocessor level as well as at the linker level, this happens to work. In this case ...
user avatar
  • 10.5k

Only top scored, non community-wiki answers of a minimum length are eligible