Questions tagged [windows]
Windows refers to the Microsoft Windows series of operating systems.
752
questions
0
votes
0
answers
16
views
Crash afrer dll modification
i am trying to remove messageboxa function, but after modifing and injecting game got crash. How to fix it? Thanks
- 1
0
votes
0
answers
20
views
windbg shows different instruction at address when you set the breakpoints in 2 different breaks but not the same break (nvd3d9wrapx thunk in user32)
In the first example I only set a breakpoint on user32!CreateWindowExW
In the second example, I set 2 breakpoints at the same time on user32!CreateWindowExW and notepad!WinMain
In the 3rd example I ...
- 205
1
vote
1
answer
42
views
Why is JMP ESP required in buffer overflow?
I was reading this article by Hackers Grimoire on Windows buffer overflow attacks.
The article made sense, except for the part where the author searched for a DLL (.dll) file which contained a JMP ESP ...
- 113
1
vote
1
answer
70
views
How do I unpack a file protected by MPRESS?
I have a file that is protected by MPRESS packer and I want to know how to unpack it on Windows. Is there a specific program for that or something else? I am new to this so every help is appreciated.
- 11
1
vote
0
answers
33
views
How do I read/edit a .xuk file extension?
I am trying to reverse engineer a license key for some software, the company that made it went out of business. In doing so, if you didn't already have the key their $50,000 machines become ...
- 11
0
votes
1
answer
73
views
Function pointer and symbols in Ghidra
I am using Ghidra and I see that when it uses function pointers it never shows the paraments that are being sent to the function(In IDA pro, it always show the parameters). How can I fix that it will ...
- 1
0
votes
1
answer
24
views
ida jumping to address I can't see in driver
When I open this driver in IDA i can't seem to see the instructions that this jmp at 0x1400DC46D jumps to.
I've tried to undefine bytes and re-analyze the function but it then ends up will garbage. ...
- 11
1
vote
1
answer
52
views
Mov instruction from a pointed location at the beginning of a program
I am trying to learn how to read assembly code. So far I have understood the basic instructions. Now I am trying to see if I can understand a dissassembly from a linked executable. So this is an ...
- 123
1
vote
1
answer
29
views
Calling a function with a variable number of args from a proxy DLL
The program I'm messing with has builtin logging. Using a proxy DLL, I managed to activate it by calling the right functions from the real DLL. However, I got stuck at using the actual logging ...
- 149
1
vote
1
answer
68
views
Understanding disassembly information from Visual Studio's dumpbin and GNU's objdump
I usually write my code on Windows, and there are two different types of development environments, each providing their own tools to view the assembly code of an object file(*.obj) or executable (*....
- 123
1
vote
0
answers
29
views
How to convert addresses shown by IDA when statically analyzing a DLL to real addresses in runtime
In a DLL I am trying to reverse there often is a reference to something I believe to be a fixed pointer (like a global var) which looks like dword_10038534. The references I am talking about look like ...
- 11
0
votes
0
answers
14
views
How are system page map entries belonging to process's updated?
Every process has its own PML4 table, and the first 9 bits of the 48-bit virtual address describe the index of a PML4 entry. The first bit of the PML4 index is clear for user code and set for kernel ...
1
vote
1
answer
155
views
How to load a PDB file into x64dbg?
I want to see symbols in the disassembly wherever possible, and I have a PDB file for the .exe I'm debugging, but I can't find a way to load the PDB file from disk. Is it even possible?
- 127
0
votes
1
answer
242
views
Frida hook multiple processes
There was such a situation. I run the frida hook on the process like this:
frida -f '..\hack2\hackme.exe' -l .\start.js
In the script itself I do this
var moduleData = Process.getModuleByName("...
- 13
1
vote
1
answer
32
views
What are these Device Object Characteristics / Flags in Windows 10 ntoskrnl!IopParseDevice
In Windows 10 looking at ntoskrnl!IopParseDevice I'm trying to work out the name / purpose of the flags in this check, which seem to be testing for values in a DEVICE_OBJECT Characteristics property ...
- 1,111
0
votes
2
answers
43
views
IDA show xrefs in .pdata and nothing else
I'm debugging the Windows ARM64 version's EFI (bootaa64.efi).
Using QEMU and GDB I was able to find that bootaa64.efi was stuck in one of the two functions BlKernelSp0SystemErrorHandler and ...
- 155
2
votes
0
answers
21
views
Why does OllyDbg label data segment as read only?
I'm working on this problem: Challenge 53
When compiling with cl c53.c /Fac53.asm /MD in VS2019 X86 Development Console and loading the .exe into OllyDbg, I found OllyDbg labels all segments of c53 as ...
0
votes
0
answers
19
views
How to initiate usb connection as usb display
I'm trying to essentially make an hdmi dummy plug to trick the computer into thinking there is a second monitor. I am planning on doing it by having a raspberry pi pico act as a usb monitor. (much ...
- 1
1
vote
1
answer
66
views
Why is Visual Studio compiling my EXE file with an entry point that is not in the file?
So I am trying to open my test app EXE file in ollydbg to study the assembly, the stack, registers and all that stuff for educational purposes and it gives me this message saying that the entry point ...
- 11
0
votes
0
answers
19
views
How to download previous releases that were published on Windows Store?
Often it's useful when Reverse Engineering to compare releases to one another.
Windows Store has previously been unpopular, but is getting increasing use.
Utilities like https://github.com/microsoft/...
- 101
1
vote
1
answer
102
views
Instructions to compare two strings
I made a list of which instructions compare two strings in disassembly so that when I get to intermodular calls in x64dbg, I can simply type this instructions to see if there is a comparison have been ...
1
vote
0
answers
48
views
Reverse engineering unknown data file
I have a set of datafiles that I want to reverse engineer which are used by a software that controls my heating system. I want to extract the commands to then use these commands in my home automation ...
- 11
0
votes
0
answers
24
views
Phoenix Exploit Education, Powershell script not working the error: '-netdev:user: invalid option','vmlinuz-4.9.0-8-amd64': No such file or directory
I tried these 2 scripts to set up phoenix from Exploit-Education but faced the below errors could not find any other script online one was from
https://blog.lamarranet.com/index.php/exploit-education-...
1
vote
1
answer
55
views
funcion calls extern function without body
I wanted to look at how does the Windows API get the size of a file, so I opened kernel32.dll in a disassembler. I searched for GetFileSizeEx, and it seems to call a stub(?), but the disassembler ...
- 25
0
votes
0
answers
130
views
How to identify if an .exe packed by VMProtect has virtualization enabled?
I am interested in reverse engineering a few parts of an .exe application (windows 32-bit executable) that downloads some documents from a server and decrypts them locally in memory.
Using PE EXE ...
0
votes
1
answer
89
views
Understanding the meaning of EBP + 0xffff98b4
I'm currently reverse-engineering an old game from 2003 to extend its functionality. I have now found what I am looking for and since it was written in C++ I'm trying to re-create the used classes. I ...
- 3
0
votes
0
answers
58
views
How can i reconstruct a full PE from a memory injected PE that only has IAT + sections content?
I have a injected PE (kernel mode rootkit to be exact) that only has the IAT table, which basically only stores the addresses of some kernel functions in an array which is referenced inside its code, ...
- 320
-1
votes
1
answer
232
views
Windows reverse engineered?
Have read in some Discord channel, that Windows was reverse engineered. Does anybody here have knowledge about such reverse engineered Windows version? If it really exists, where can it be downloaded?
- 121
1
vote
1
answer
87
views
Windows UI freezes except the debugger itself when a breakpoint is hit in every debuggers I tried on a particular application
I'm trying to "trace" (just setting breakpoint, step in, step over to know how certain things work) an application. But if the application enters suspended state by using breakpoint, every ...
0
votes
1
answer
44
views
One class with different sizes
After looking at some basic examples of how C++ classes are compiled by MSVC, I tried to apply the knowledge to a DLL I'm working on. While searching for a class to start with, I came across
...
- 149
0
votes
1
answer
303
views
How do I get all sections in a PE file using C++?
So I am wondering how can I get all sections and their info from a dumped PE file on the disk, using C++.
I have the entire PE loaded on a buffer, the NT headers, and hopefully the DOS headers.
I need ...
- 28
0
votes
0
answers
31
views
How to redirect connections by an exe file to a specific external ip address
I have an exe program that connects randomly to one of the 4 addresses 188.39.21.82...83...84...85 out of which only 82 works
Currently I blocked the remaining addresses using Windows 10 Firewall ...
- 101
1
vote
1
answer
61
views
Unknown usage of dwLength and SsHandle members in PEB_LDR_DATA
I've been implementing some Windows internals code and when I have tried to document this structure I have not been able to do so because of those two members. I can't find anything about them.
This ...
- 13
0
votes
0
answers
70
views
Reverse engineering Samsung Quick share UWP app
I want to make the Samsung Quick Share app work on my PC which is not from Samsung. So which DLL file would I have to reverse engineer to bypass that restriction, and how to get full access to UWP ...
0
votes
0
answers
136
views
How to debug a .NET windows service: "Cannot start service from the command line or a debugger"
I have a .NET windows service which I can stop and run through Process Hacker.
I can also view it's code with dnSPY.
I tried to debug it without a success by trying to attach to the process.
I wanted ...
- 461
0
votes
2
answers
165
views
Why windbg skips syscall on kernel mode?
I have a VM running windows with notepad open, I did list the modules with lm:
start end module name
00007ffc`60fb0000 00007ffc`60fe2000 vertdll (deferred) ...
- 49
2
votes
1
answer
410
views
How to propagate re-typed variables to functions signatures automatically?
In the Ghidra decompiler, after applying a type to a function parameter, the compiler uses that type information to provide better decompilation within the function. When that parameter is used in a ...
- 195
0
votes
0
answers
88
views
Immunity Debugger not running on Windows 10
I'm experiencing some issues with Immunity Debugger where when I'm ready to run the program, I'll push the "play/start" button and nothing will happen.
I've gone through the process already ...
- 1
0
votes
0
answers
72
views
How are programs like 'StartAllBack' and 'T-Clock' developed?
There are many programs like StartAllBack and its predecessor StartIsBack which somehow modifies different aspects of Windows Shell (explorer.exe).
How are these hook points discovered in the first ...
0
votes
0
answers
136
views
Remote debugging with Binary Ninja on Windows possible?
Quick background -- I cannot start the .exe from a debugger; I need to attach after the fact. Binary Ninja's debugging plugin only allows attaching to a remote debug server and not a process. The ...
- 101
0
votes
2
answers
274
views
Why are certain functions from kernel32.dll always imported?
I've been noticing this for a while. Functions like IsDebuggerPresent and GetModuleHandle are always present in a binary's import directory structure. I assume is the Window's dynamic linker, but ...
- 69
4
votes
1
answer
132
views
Is it possible to fake being joined to a domain in Windows 10?
I'm dealing with a malware sample from a pentest that will only execute properly if the system is a member of the target organization's Windows Active Directory domain.
Rather than standing up my own ...
- 141
0
votes
1
answer
781
views
How to unpack Armadillo protected software using x64dbg?
I am planning to reverse-engineer a Windows executable that has been protected with Armadillo.
When I put the executable through Detect It Easy, the results show that the executable was protected with ...
0
votes
1
answer
187
views
Windows User Identification / HWID Limiting
I've been playing a game that has an HWID limit and a bunch of other limitations, such as:
a) Cannot be ran in a VM
b) Cannot be ran using Sandboxie and other Sandbox environments
c) Limits 3 ...
- 1
0
votes
1
answer
141
views
How do I interpret this double offset?
While looking at that old game I've found a class CStr that is used in an unusual (to me) manner. Most of the times a member of CStr is used, it's done as follows. In both cases, this is a CStr *.
...
- 149
0
votes
0
answers
50
views
How to extract an AutoIT script when tools fail to extract it?
Lets say you have a Autoit malware (windows executable, autoit v3), and you want to extract the script from it. But tools such as exe2aut fail to extract it.
What would you do? is there any place in ...
- 320
0
votes
2
answers
269
views
How to prevent File Modification in C++
so i want to protect my software against reverse-engineering and i want to add checksum verification to prevent patching the binary but the problem that if i added a checksum verification the binary ...
2
votes
1
answer
367
views
Change manifest file using ResourceHacker CLI
I want to automate some manifest file changes (change requestedExecutionLevel level to requireAdministator from asInvoker) so I have to use ResourceHacker CLI.
I have managed to extract the resources ...
- 21
1
vote
2
answers
37
views
Cant Save .exe using reflixil and Red Gate Reflector 10.3
First off all im pretty new to Reverse Engineering.
Im Stuck on Saving my Project.
When i want to save the Assembly as .exe file Reflexil says cant save, the specified Method is not supported.
I tried ...
- 11
1
vote
0
answers
32
views
Send file or non-printable character in Immunity Debugger arguments
I am a beginner in Reverse Engineering.
I am on Windows and using Immunity Debugger.
I would like to send my payload on the .exe file.
The payload contains non-printable characters.
How I can launch ...
- 141