Questions tagged [windows]
Windows refers to the Microsoft Windows series of operating systems.
702
questions
1
vote
0answers
24 views
Reversing Logitech G933 Battery Charge Values
I have a Logitech G933 headset. I replaced the stock battery with a larger capacity. The headset now lasts many hours longer than it was originally designed, and the software is configured to give ...
1
vote
1answer
44 views
How to get thread start address in Windows?
I'm writing thread finder in module. My goal is find all threads in process and find threads currently working address locations. Like image on below. I do this goal with NtQueryInformationThread API.
...
1
vote
1answer
60 views
Identifying/debugging code parts responsible for features in Windows
New to the area, i am trying to identify the code responsible for example for the search functionality in Windows when you start typing in the start menu.
What are some generic ways of identifying the ...
1
vote
1answer
48 views
Why is process object is shown as desktop object in nt!_object_type
I try to extract the object type of notepad.exe in windbg but the nt!_object_type is showing it as Desktop object instead of Process object.
Any idea why is it so?
4: kd> !process 0 0 notepad.exe
...
0
votes
0answers
107 views
Windows time travel debugging performance bottleneck
First of all I wan to be clear, that this question is not about the collection performance, but indexing performance.
What is the performance bottleneck of the indexing step?
Some context:
Action in ...
2
votes
1answer
34 views
Why some process has empty nt!_object_type
I try to extra the nt!_object_type of notepad.exe process. But seems like it's empty. Is it some process has no object type?
Correction for my screenshot above for using the EPROCESS address to ...
1
vote
1answer
80 views
Run ntoskrnl.exe with qemu
We can run linux and similar unix kernels uing qemu -kernel parameter. Is there any way to do the same with NT kernel? I could not find a way to test even reactos kernelwith qemu.
Also can .efi files ...
0
votes
1answer
24 views
Can't add tracing in IDA, showing it in gray
I added read/write trace to a program. I was able to record the trace with IDA for the first time.
When I run it again, it didn't work.
I tried to do what I did on the first time, adding the read/...
1
vote
1answer
53 views
How to load modules symbols to IDA while debugging a process
I am debugging a program that I compiled.
This program calls SetWindowTextW.
When I am debugging it with IDA I can step into this function, but it doesn't recognize anything there:
If I will load ...
1
vote
0answers
17 views
On Windows, when is a PTE a VAD prototype PTE (with address 0xFFFFFFFF0000) instead of a prototype-pointer PTE?
I have reviewed several sources on this PTE type, including Windows internals and the following:
http://blog.rekall-forensic.com/2014/10/windows-virtual-address-translation-and.html https://thalium....
1
vote
0answers
16 views
Whats the difference between a MiNotMapped PFN entry with all 1s, and a MiNonCached PFN entry with all 0s and a 0 PteAddress?
On host (UEFI legacy mode):
lkd> !pfn 0xf0
PFN 000000F0 at address FFFFFA8000002D00
flink FFFFFFFFFFFFFFFF blink / share count FFFFFFFFFFFFFFFF pteaddress FFFFFFFFFFFFFFFF
...
2
votes
0answers
49 views
How to disassemble win32 function RegSetValueExW?
I have opened up advapi32.dll in IDA and found out that RegSetValueExW is just a jump to RegSetValueExW_0. And RegSetValueExW_0 seems to be an extern.
How do I actually disassemble RegSetValueExW_0?
3
votes
1answer
68 views
Unable to attach into mysterious PID
I have a suspicious process. I found it by ProcessHacker's network tab.
ProcessHacker display the process as Unknown.
The process listening into a constant port number that's also not found by ...
2
votes
1answer
92 views
Extracting strings from binary files (.exe)
This question has been asked quite a lot especially on stackoverflow, but the solutions/replies are not clear or extensive.
What I`m looking for is to build what Strings does from Sysinternals. My ...
2
votes
1answer
75 views
How to find sleep() in ollydbg or IDA or ghidra
I have a program which converts videos from a proprietary format into mp4.
The conversion is very slow and CPU utilization is less than 1%.
I'm able to speed up the conversion process via Cheat Engine'...
1
vote
1answer
55 views
Disassembly call function offset from RIP
I am writing a program where I map an .exe PE file in memory and I "dissect" it.
I am disassembling the .text section of the target executable, using the distorm disassembler.
CALL ...
0
votes
2answers
59 views
Import header files in IDA to get the struct definitions?
I am reversing a program that has a lot of internal structs in it.
The problem is that there are a lot of structs, so i can't import them manually using local types->insert.
Lets say i have some ...
0
votes
1answer
25 views
Find out version of statically linked MFC from an exe
I have an exe with symbols stripped that I am trying to reverse engineer. I know the library is linked with MFC but I don't know which version. (Therefore, I can't use something like FLIRT signatures ...
0
votes
0answers
55 views
Can I reverse engineer original file names?
I'm new to IT and I turned my external hard-drive into a windows boot disc. I managed to recover files with testdisc & photorec_win. The downside is I got more than I bargened for and I have twice ...
1
vote
1answer
63 views
Merging a large number of segments in IDA Pro
I'm working with a memory dump of a protected win32 program. Something causing me a lot of pain is the program being split into roughly 3,000 contiguous small segments (i.e. instead of just .text and ....
0
votes
0answers
73 views
WMI Spoofing by Fastprox.dll Hooking
I m trying to spoof WMI output by hooking the fastprox.dll. Here is the code I m working on:
typedef HRESULT(__stdcall* tGetFunc)(IWbemClassObject*, LPCWSTR, LONG, VARIANT*, CIMTYPE*, long*);
static ...
0
votes
1answer
49 views
How much of the kernel does remote kernel debugging allow you to debug?
This is a theoretical question because I've never set up remote kernel debugging before -- but I will do at some point, which should hopefully answer some of the experimental questions I have.
What ...
0
votes
0answers
36 views
new to malware analysis and disassembly. dotpeek has been helpful. is this unreadable code due to SuppressIldasmAttribute?
just getting into rev engineering malware. i want to get to source on my own. i could use run.any or VT but that's no fun. any reason why this is unreadable the way it is? is it due to the module ...
0
votes
0answers
22 views
Set standard input/output to a process using NtCreateProcessEx
In the official Windows API function CreateProcessA is possible set or change the standar input and output of the process vía LPSTARTUPINFO structure.
How can do this using the undocumented function ...
0
votes
1answer
76 views
Why a single “nop” crashed the game?
I hope answer to my question is not game/app specific and can be answered in communities like this.
So, I tried to use some internal functions of a game, like pick a target. No malicious intentions, ...
1
vote
1answer
54 views
does mov DWORD PTR 32[rsp], 5 means mov DWORD PTR [rsp+32], 5?
I am learning about windows x64 calling convention, where the first four arguments are passed to registers and left arguments are passed through the stack. To see it, I checked the assembly of the ...
1
vote
1answer
36 views
Switch between debuggers while paused on a breakpoint
Is it possible to switch between debuggers and preserve where you are paused? Often times I find myself wanting to use a feature from a different debugger while paused in a specific context as each of ...
0
votes
2answers
63 views
kd live local debugging !pte and db don't work (only shows context of the debugger for all contexts), but !vtop works
Says the PDPT and PDs of the process are at the same physcial frames (pfns) in both processes.
The first process is winword.exe and the second process is calc.exe
The virtual address in the first case ...
0
votes
0answers
30 views
How to apply complete type information from PDB for multiple images in one IDA database?
IDA is capable of loading multiple images/DLLs into the same database. In this scenario, ntdll.dll and kernel.dll have been loaded additionally to the main target .exe-file into the database. On top ...
0
votes
0answers
50 views
Reversing Windows binary to find where the error is with Ollydbg
I've some experience with gdb and debugging in Linux environment (I'm studying computer science at University and I'm able to handle bof in Linux).
The problem now is on a Windows program. I start it ...
0
votes
0answers
67 views
SSL pinning and bypass
I'm currently investigating one very suspicious app on my system (Windows 10 x64 bit). I wanted to try and understand outgoing https traffic it utilizes by trying to MITM it using Fiddler but as I ...
0
votes
1answer
50 views
PE Self Injection Not Working
I'm working on different PE Injection technique. I want inject PE file into virtual memory of current executable. After that, I want execute injected PE file, I wrote inject code but my method is not ...
0
votes
0answers
23 views
Smart Battery Issues, a RE Quest?
TL;DR: Perhaps this doesn't sound like a RE post at first, but it's kind of moving in that direction. Essentially, I replaced the battery in my Surface laptop with 2x different new batteries, and they ...
0
votes
0answers
24 views
Thread keeps generating page fault
So i was recently trying to exploit a kernel mode driver (HEVD) and I encountered a problem which doesn't make sense to me.
After i jumped to my shellcode (which resides in usermode), the thread keeps ...
0
votes
0answers
33 views
Fuzzing Third Party Windows Drivers
I want to contribute to vendors while learning how to be a security researcher, and I was wondering: How can I fuzz third party windows drivers? (For instance, those that come with cpu/gpu and similar ...
0
votes
2answers
192 views
CaptureBAT equivalent on Windows 10?
Hello RE community on stack !
I am a beginner, so please pardon any commonplace errors
I am looking to run CaptureBAT on a Windows 10 VM, to capture network activity of different kinds of Malwares
I ...
0
votes
0answers
49 views
Patching a program in IDA
I've opened a simple Hello World program in IDA (Pro 7.5) like that:
global _main
extern _printf
section .text
_main:
push message
call _printf
add esp, 4
push ...
1
vote
1answer
134 views
Arrays assembly
I'm reversing my C array's programs where I'm storing numbers in arrays like this...
int marks[5];
marks[0] = 1;
marks[1] = 3;
marks[2] = 2;
marks[3] = 7;
marks[4] = 9;
so the compiler showing me the ...
1
vote
1answer
56 views
Where are the .NET IL bytes stored in an .NET executable?
When i compile a c# code, it compiles into a .NET executable, that only imports _CorExeMain from mscoree.dll, now my questions are :
Is _CorExeMain the interpreter that fetches ILs and executes their ...
0
votes
0answers
33 views
Renesas Chip reverse engineer mcu
I need to access MCU (the MCU is the Renesas R5H30211) – goal is to reset a register value to 24 as card counts down to 0 for each cycle – I want to reset the card.
Can anyone help with this, I do ...
0
votes
0answers
62 views
How to Find Password/ Bypass Password in a Switch Statement using IDA
I'm new to reverse engineering, wondering how access or bypass the password contained in the switch statement ?
File Link
1
vote
0answers
20 views
Program closes when running Charles proxy
I came across an program that closes itself when I run Charles proxy and if I'm running charles before the progran it won't run. Anyone know what type of security if this and can it be reversed?
...
0
votes
0answers
87 views
Confusion about if statement in disassembly
I recently got into reverse engineering applications for fun. Can someone please help me with this if statement.
140005914 75 38 JNZ LAB_14000594e
140005916 48 8b 4 MOV ...
0
votes
1answer
70 views
idb file and IDA
I've just received from a friend a *.idb file concerning the pe file i'd like to disassemble in IDA. What the file is and how can i load/use it with the exe linked with it in IDA?
0
votes
0answers
39 views
IDA adding a new code
Is it possible to add a new assembler code lines in IDA to a opened, disassembled pe file?
For e.g. having such disassembled code in IDA:
global _main
extern _printf
section .text
_main:...
0
votes
2answers
51 views
Pe file code starting address
When i load an exe in the IDA the assembled code always starts at 00401000 address. Does it mean that in pe files the code always starts at that specific address?
0
votes
1answer
59 views
Disassembling Hello World program in IDA
I've de-compiled in IDA 7.0 (freeware version) such a simple c program (compiled in the Microsoft Visual Studio Community 2019):
#include <stdio.h>
#include <string.h >
char* sayHello(...
1
vote
1answer
243 views
How to find encrypted strings in an executable?
I am trying to reverse engineer an executable.
I am using Process explorer to dump all strings present in the exe image, and from the process's RAM when it is running.
The two dumps return a ...
1
vote
1answer
49 views
far jump do not point to instruction?
My title is kind of ambiguous and not sure if it is true, Hence the question mark at the end.
Basically, I was trying to trace windows printf in NASM to identify "what is the last call/function ...
1
vote
1answer
63 views
.dll file pull source from compiled study?
Forgive me I’m new, and not a programmer but I am needing to see if this is possible.
I have a study in my trading platform I had built a long time ago, lost the original, but have the compiled .dll ...
