Hot answers tagged

4

It works As Expected and Documented Running a plain .thread resets context to CurrentThread as documented Quote From Documentation Thread The address of the thread. If this is omitted or zero, the thread context is reset to the current thread. You Cannot Set @rip to Arbitrary Values


3

Try enabling break on module load: sxe ld rootkitDriverName See also https://reverseengineering.stackexchange.com/a/2638/60


3

can you clarify if the error you are getting is related to message that says this may be caused by another thread holding the LoaderLock ? if that is the case then it means you allocate memory etc just after windbg/cdb broke on System Breakpoint if you are doing .dvalloc when you are on System Breakpoint then HttpRequestA might cause the block go to the ...


2

as i commented in latest windows type index has been randomised it is a xor of the index with nt!obHeaderCookie and the second byte of OBJECT_HEADER Address see below 0: kd> ?? (char *)@$proc->ImageFileName char * 0xffffa083`398ab4d0 "conhost.exe" 0: kd> ?? ((nt!_object_header *) @@masm( @$proc - @@c++(#FIELD_OFFSET(nt!_OBJECT_HEADER , ...


1

the rva does not seem to point to _tagSTACKFRAME64 the size appears to be different 0x108 versus 0x4d0 is there a specific reason to use dbghelp ? outputstacktrace from dbgeng is not acceptable? have you looked at the com interfaces of DIA_SDK for an alternative checked an arbitrary dump for sizeof(_tagStackFrame) versus size in dump using code below #...


1

Use the following from idapython: import ida_dbg ida_dbg.edit_manual_regions()


1

Here is how to do it: dx @$cursession.Processes.Where(p => p.Environment.EnvironmentBlock.ProcessParameters->CommandLine->ToDisplayString().Contains("chrome")) If you have other way, please share.


1

maybe try : C:\Program Files (x86)\Windows Kits\10\Debuggers\x86


1

I am not sure what you are asking (never used sticky notes and don't have it installed ) but if you want to run sticky notes from command line you can do something like this the command below will run calculator instead of the wildcard calc use stick C:\>powershell -c "(get-startapps -name *calc*).Appid Microsoft.WindowsCalculator_8wekyb3d8bbwe!App ...


1

The earliest break is sxe ibp break on kd communication if you want to break earlier than that you need to lookup boot debugging you can use ctrl+alt+d for a debug spew of kdcom kdnet packets sent to and fro


1

Are You Providing all the three overrides this command is for looking at locals of a different frame this command will work better or correct with an application having its private pdb here is a simulated range error look how esp,ebp,eip changes in register display 0:000> r eax=00000000 ebx=00000000 ecx=001af7dc edx=779a70f4 esi=fffffffe edi=00000000 eip=...


1

During my analysis I use Floss!, it is an excellent tool and super simple to use, on several occasions I can find the strings I am looking for, you used PEID to check for packers please use a more up-to-date tool like DIE (Detect it Easy), if it is an .EXE file consider analyzing with a professional and updated debbuger like x96DBG(x64dbg/x32dbg), I believe ...


Only top voted, non community-wiki answers of a minimum length are eligible