Questions tagged [windows]
Windows refers to the Microsoft Windows series of operating systems.
612
questions
1
vote
0answers
18 views
Pe 32 Add Export function Segment by Extending with dll or Patching pe
I need to add new function inside pe32 module.dll Export Table , in dynamic way if possible ( via extending with dll ) or by patching pe32 module.dll
What can u suggest to solve this ?
2
votes
1answer
35 views
How to debugging activeX with Ida
When I enter to some site it ask me to install ActivX to my Internet Explorer browser so this site will work well. I installed that,and that site works well.
How can I see this ActiveX code(where ...
0
votes
1answer
40 views
Why does an executable still run despite changes to checksum, or changes to data section without new checksum?
I have a "Hello World" console app compiled with Flat Assembler. The size of the executable is 2048 bytes and the checksum is 0x3797.
Questions:
Does it matter if I make changes to the data section ...
0
votes
0answers
64 views
How to bypass SSL certificate pinning on Windows 10
When reverse engineering a big application, it can be very useful to be able to see the network traffic it generates.
Because of this, many applications use HTTPS to communicate with their servers. ...
4
votes
1answer
66 views
what routine in ntdll.dll is responsible of dispatching DllMain function of loaded dll?
I'm trying to debug a dll file using Ida disassembler and Windbg.
I'm debugging rundll32.exe and passing the target dll (debugee) as an argument.
I'm able to have a breakpoint on each Dll load & ...
1
vote
1answer
34 views
What is the difference between mapped and private memory segments in xdbg? and what is a reserved segment?
So in xdbg in the memory map, i can see that some segments are mapped and some are private, at first i thought maybe mapped means it has a corresponding file on disk and its the mapped version of that,...
2
votes
1answer
46 views
Get return address from syscall
I'm debugging some 32-bit process using windbg kernel debugger. This process calls some syscalls, so I set few breakpoints at kernel functions like nt!NtQuerySystemInformation. So after breakpoint hit,...
0
votes
0answers
26 views
x64dbg call function from current thread
While debugging an executable with x64dbg, I want to make a function call (while the executable is stopped on a breakpoint), what I want to do is the same as the following gdb line:
p (void*)freopen("...
2
votes
3answers
83 views
How does an application identify a DLL file
Sorry if this is a basic question, as I'm very new at this.
I'm trying to get an .exe to load a dummy .dll. I've created an example .dll project in VC++ 2019, added the functions listed in the .exe's ...
1
vote
1answer
33 views
advapi32.dll changes name of function during forwarding of exports
Im trying myself at writing a manual mapper, for injection of DLLs into other processes.
Ive come to the point, where I've written a simple "Hello World" dll, that im trying to inject into another ...
0
votes
0answers
31 views
How can I reassemble a DDS header with the information I have?
I have 2 files which I know for certainty to be as follows:
File 1: Includes all of the DDS image data
File 2: Includes some data from the header. The data it includes is the width and the height (...
1
vote
1answer
31 views
What is the mdisp field in RTTI for throw used for?
First of here is the article from which I'm looking up the fields.
I was trying out different combinations to see how they affect the RTTI for a C++ throw. It seems that having a virtual base class ...
1
vote
1answer
29 views
Can I make a DDS image from headerless DDS data?
I have some files which I've decrypted that I believe are DDS images. These files do not have a DDS header, however the data looks similar to what I've seen in other DDS images. I believe to a great ...
3
votes
2answers
112 views
Windows - syscalls being called in a strange way?
I've been reading about the way syscalls are called in windows.
The general theme in all the articles I read is:
64bit- called inside ntdll
32bit- from ntdll jumping to KiFastSystemcall
but when I ...
2
votes
1answer
36 views
Where do mouse/keyboard GUI inputs get queued or stored?
Where do mouse-clicks in a program's GUI window/menus (Windows OS) get stored in memory? Is there some sort of input/GUI "queue" similar to Windows messages queuing?
I'm wondering if it'd be possible ...
3
votes
1answer
59 views
CreateToolhelp32Snapshot() access denied (while running as admin or even NT AUTHORITY\SYSTEM)
I've come across a troublesome process which refuses to allow CreateToolhelp32Snapshot().
I also noticed that in sysinternals process explorer it shows "Access Denied" for other things too, such as ...
0
votes
0answers
34 views
fuzzing GDI/BITMAP kernel vulnerabilities
i was wondering about gdi/bitmap vulnerabilities in windows kernel(preferably windowds 10).
i saw several exploits and papers regarding this subject, and while it all seem really interesting, i did ...
2
votes
2answers
68 views
Modern methods of fuzzing/locating heap bugs and potential vulnerabilites
really glad I found this great learning resource.
I was wondering, is there any way to fuzz or automate heap vulnerability assesment? I know a lot of practical frameworks for stack based fuzzing in ...
2
votes
1answer
83 views
I can't set a hardware breakpoint on RIP + N-byte after calling NtContinue()
#include <Windows.h>
int handle_exception (EXCEPTION_POINTERS *exception_pointers) {
exception_pointers->ContextRecord->Rip += 4;
return EXCEPTION_CONTINUE_EXECUTION;
}
int main (...
2
votes
1answer
370 views
Reverse engineer Listen to this device on Windows - Reverse engineer Windows when there's no API
I'm writing an Autohotkey script to toggle Listen to this device for my microphone, without interacting with a GUI.
I thought it would be a simple registry key being modified so I used RegShot to ...
1
vote
1answer
98 views
Hiding a file in a Windows operating system
I am trying to understand how to hide a file in windows as a way to learn about win api and malware analysis.
What I am trying to do is to make a file "disappear" via some kind of manipulation. But I ...
0
votes
3answers
78 views
What is the best way to change the call-graph of a PE file without changing its real behavior and without packing it?
What i want to do is take a PE file, extract its call-graph, and then inject a junk function in it, so for example by injecting a junk function inside of it, and changing a call instruction's opcode ...
0
votes
0answers
34 views
How can I debug code execution on a Native->Unity/Mono/C# Application
I'm reverse engineering a Windows application which has a main executable that appears to run some boilerplate/stub code before calling UnityMain and also using Mono. This means that if I use an ...
0
votes
3answers
121 views
How To Identify Which Process Is Being Written To With WriteProcessMemory?
Basically, I cannot find which process is being written to when WriteProcessMemory is being called.
Currently I'm Setting Breakpoints on WriteProcessMemory and OpenProcess. However, the process handle ...
2
votes
1answer
97 views
Anti-debug clearing hardware breakpoints
An application I am debugging somehow manages to clear my hardware breakpoints. I am using TitanHide and x64dbg.
I am observing the following behaviour:
When placing the first hw breakpoint, it is ...
0
votes
0answers
78 views
Reverse Engineering a Keygen
I have a keygen for some programs from a manufacturer. But not for all.
I suspect that the manufacturer uses very similar algorithms. Is there an easy way to find out the algorithms of the different ...
1
vote
2answers
76 views
NOPed encrypt/decrypt functions in a Path of Exile client and now it crashes without message. Next step?
I am reversing an old Path of Exile client with the purpose of building an emulator. I managed to reach the character select screen in a newer, 64-bit client but I am struggling to make the same ...
1
vote
0answers
39 views
Possible to inject a new menu into a program's menu bar?
Is it be possible to inject a new menu/menu item into a program's menu bar?
As an example, in Notepad's (Windows) "Help" menu, would it be possible to add a new entry to that menu like "Open ...
1
vote
1answer
99 views
Adding a static variable to Windows DLL
I'm trying to patch a function in a Windows x86 DLL, however it turned out that I need a static variable to store some state that wasn't correctly preserved by the original executable across calls.
I ...
-1
votes
1answer
153 views
Why cant we find ransomware keys?
From my understanding most ransomware has a secret key used for encryption in a server which it contacts to send over the key and use it for encryption
But I am wondering, couldn't someone easily ...
0
votes
0answers
34 views
Questions about process hollowing
When it's time to write the malicious image inside the hollowed process, apparently the goal is to allocate memory exactly at the image base address of the hollowed process. Why? Why not allocate ...
1
vote
1answer
60 views
Executable code in the same location differs in memory and on disk
I'm trying to inject code to change the byte value of a CMP in an executable from 0 to 2 at runtime, in order to effectively no-op a boolean comparison as part of an effort to insert my own behavior. ...
3
votes
1answer
116 views
Reverse old win32 app to find encryption vulnerability
I’m trying to reverse engineer an old win32 application used on SCADA and ICS (Industrial Control Systems). This app has a silly encryption function to protect the user password to prevent ...
1
vote
0answers
38 views
How does this wannacry sample work?
I downloaded wannacry sample here: https://github.com/fadyosman/WannaCrySample/releases. Don't forget to enter password for archive.
I figured out how most of the binary works, except the very last ...
1
vote
0answers
30 views
Find High Entropy VA (64-bit ALSR) Incompatibility in Disassembly
Have a 64-bit plugin DLL (no source code) and the host application in an update changed its DLL characteristic to include "high-entropy 64-bit address space layout randomization (ASLR)" When this is ...
1
vote
0answers
36 views
Memory modified at jump far
Observing a trace of Wow64 switching on Windows 7, the following situation makes me confused
...
0x77491dbe 64 ff 15 c0 00 00 00 call fs:[0xc0] ; syswow64\ntdll.dll
0x74632320 ea 1e 27 63 ...
0
votes
0answers
270 views
Decompile a win32 application written using C++ with .exe and .pdb
I'm aware of IDA Pro, but it doesn't generate a compilable code.
I don't want exact original source code or comments, I just want a recompilable code generation.
The exe is not packed and does not ...
0
votes
0answers
26 views
Symbol Information on wcscpy_s in WinDbg - Why references across so many DLLs?
I am using Time Travel Debugging feature of WinDbg to log string output with position of trace to help me more easily isolate sections of codes I want to analyse, using command like below:
bp ...
0
votes
0answers
35 views
How good is Cryptochecker (CC) by Aleph for binary analysis compared to the modern alternatives
I've been using the tool called CC by Aleph for ages now. To my own surprise, having found this tool on some forum, the tools remains largely undiscovered even by the cryptography/reverse engineering ...
0
votes
2answers
131 views
How to compare two different executions of the same file?
When i start the program by just double clicking the .exe, it has a certain behavior. This behavior differs when i start the program from running the launcher provided. I’d like to figure out how to ...
0
votes
0answers
31 views
Capturing traffic of an integrated laptop keyboard
I'm trying to capture the traffic between my laptop's integrated keyboard and its controlling software on Windows. I'll analyze the traffic to write a driver for Linux to control keyboard backlight. I ...
1
vote
1answer
43 views
How to track/debug/manipulate Windows processes in a VM?
I am trying to make some deep-level windows debuggig/tracing, utilizing virtualization.
Considering that if a Windows runs in a virtual machine, theoretically I have total power over it - I could ...
1
vote
1answer
82 views
How did Kaspersky replicate UAC overlay on Windows XP [closed]
How did Kaspersky replicate UAC overlay on Windows XP? Here is the screenshot to what I relate to,
Upon encountering the overlay,
If you click outside the "attention" Window, system will beep and ...
0
votes
2answers
146 views
Is it possible to use a program's GUI abilities without the GUI?
Is it possible to use/call programs' GUI abilities directly without using the GUI (programmatically, not by keyboarding)?
For example, a program with abilities nested too deeply in cascading submenus:...
1
vote
0answers
36 views
Why can I inherit handles from WSASocketA and not from socket?
I'm trying to write some custom shellcode to obtain a shell from a program.
Looking at the program intermodular calls, I found a call to socket(), and my initial plan was to use that to create a new ...
1
vote
1answer
271 views
Where can you find the name of a driver causing a kernel mode crash?
I am in an interesting situation. I have very limited Windows kernel experience, so I just don't know what data structure to look for in order to find what I need to know.
There is a driver that is ...
0
votes
1answer
72 views
Can a program's memory be dumped and then reinserted?
Is it possible to dump a running program's memory (Windows OS), and then later "reinsert" that memory when the program is run again?
0
votes
0answers
105 views
Reversing a Windows service - Debug with x64dbg
For a school project I need to hook the function of the Windows spooler that is used to create a printing job with the path of the document to be printed.
For that I setup a function trampoline (this ...
1
vote
0answers
42 views
Finding PEM passphrase that may be in an executable?
I'm trying to capture the TLSv1.2 traffic of an application. In the applications directory is the file cacert.pem that I assume holds the cert for decrypting the TLS traffic. I tried to load it into ...
1
vote
2answers
124 views
Call function by ebp
When I looking at exe file with Ida I see
call dword ptr [ebp -70p]
What is that? Why this function calling by ebp and not call sub_0xabcd
How can I know which function is that to enter to this ...
