19

I have thought carefully before adding this as "Another Answer" rather than editing my existing answer that I posted above this morning. I feel that this answer deserves another post of its own as it's not just a simple continuation of the material posted in my answer above. I have spent over 2 hours on this post to avoid just cutting and pasting content ...


14

As promised, I am back to post a more specific answer to the question that was asked by the OP. Decided to write this as a separate answer as I believe that this content stands out on its own and would not properly fit in with either of the two answers that I posted above. Addressing his first issue : In this case though, the whole settings is a ...


8

I commented and then I've read malikcjm answer So this is basically an extension of malikcjm's answer. Suppose you have a code like this and load the compiled exe into ida #include <stdio.h> void main (void){ printf("%s\n" ,__FILE__); } You will get the cpp file reference these __FILE__, __LINE__ etc are predefined macros that are defined in ...


7

"I'd like to see details on how to hook and step into the function that processes a button click event in a UWP app." I would suggest using the EventHook Library which is intended to hook global windows user events.This is available as a Nuget Package. The Project Repo (named as Windows User Action Hook) is available on Github and my fork can be ...


4

I'll post my own answer here so I can find this again in the future. Using CFF Explorer open the service binary. Find the AddressOfEntryPoint in the Optional Header. Find the .text entry in Section Headers. Calculate raw_offset = raw_address - virtual_address + AddressOfEntryPoint. Within the built-in hex editor, navigate to raw_address. Change the two ...


4

Now, this can't be a full-fledged answer from A to Z, unfortunately. But for COM there are only a few steps that are really specific to COM. The project you linked clearly has reverse-engineered the interfaces (elvint.h). What this means first and foremost is that the names of the interfaces needn't necessarily match what Microsoft called them (in your case ...


4

You don't disable that kind of integrity check, you simply set the checksum. The one that's relevant in this particular case is the respective field in the IMAGE_OPTIONAL_HEADER, that is IMAGE_OPTIONAL_HEADER::CheckSum. That said, you will likely run into additional issues once you resolved this one. I am not sure if the kernel itself is subject to Early ...


3

well the answers out there are good this is just an addition to show how you could arrive using windbg in command line dbh is an utility in windbg installation that can load any binary and provide a lot of static information using it and the command line version of windbg cdb.exe you can get the methods in two commands (notice the method names are ...


3

I searched in the System32 folder inside every file named SystemSettting*.* for the word Shutdown. I used Total Commander as it can search with multiple encodings such as ASCII and Unicode: Then builtin viewer showed a reference to InitiateSystemShutdownExW: . From MSDN: InitiateSystemShutdownEx function Initiates a shutdown and optional restart of the ...


2

I have managed to debug and find your problems, but it's really is out of scope since your "bytes" of a "64 bit " program does not have "IMAGE_NT_SIGNATURE" (PE00) but rather has "IMAGE_DOS_SIGNATURE" (MZ). https://i.imgur.com/vPn8EIK.png If I were you, I would first find/prepare proper code for running it as SHELL CODE ( by the way, you know that exploits/...


2

There are no *.cpp files in disassembly. It looks like automatically generated string file file path. It's sometimes used for logging. It can be generated if somewhere in the source code __FILE__ preprocessor directive was used.


2

The simple way to turn on the debug information is to modify the mask directly in WinDBG with this command : kd> ed nt!Kd_Default_Mask 8 The console will become massively verbose...


2

Windows loader does not care about section names, so the name does not really matter, but usually this section contains the pointer to the indirect call guard check (___guard_check_icall_fptr). The pointer to it is stored in the GuardCFCheckFunctionPointer field of the load configuration directory. I guess in the newer files it may contain some additional ...


2

The most useful reference I've seen about this section is in this Adobe source comment: // // Allocate xyz in the .00cfg so that it is implicitly merged into the // import section of the binary (which is read-only). // Indirect calls using this pointer do not have the guard check function, // and so will not fail the CFG check. // The code appears to add ...


2

These two symbols aren't exported in the usual way (i.e. via the export table). Instead, they are public symbols inside the run-time library itself. The startup code that runs before _main() performs the command-line resolution, assigning parameters into the __wargv array, and storing the count in __argc. The relative addresses are fixed for the file, but ...


2

This is just an extension of @0xC0000022L's answer. For this question, I will explain ICMLuaUtil COM interface below because IFileOperation COM interface is in shell32.dll, too big ;) You mentioned the wrong CLSID. Here I provide a list of them: GUID CLSID_CmstpLua = {3E5FC7F9-9A51-4367-9063-A120244FBEC7} GUID IID_ICmstpLua = {6EF07F29-F9B8-4DA4-B59E-...


2

For analysing RPC I use mIDA: mIDA is a plugin for the IDA disassembler that can extract RPC interfaces from a binary file and recreate the associated IDL definition. mIDA is free and fully integrates with the latest version of IDA (5.2 or later). Note that mIDA doesn't work with most recent version (64 bit version) of IDA but requires 32 bit version (6.95 ...


1

There Are Lots of Documented Helper functions in dbghelp.h to fully parse the Pe file if you do not wish to use dbghelp.h almost all of these function has an Rtl Equivalent function in ntdll.dll Which You Can call Dynamically (LoadLibrary . GetProcAddres) For Example this Function ImageNtHeader Has an Equivalent RtlImageNtHeader in ntdll.dll which you can ...


1

In order to get the text section of the desired dll, first you need its base address (DOS Header in other words) which leads you to its PE Header (using the e_lfanew field of IMAGE_DOS_HEADER). At the PE Header (or in it's structured name IMAGE_NT_HEADERS) you'll find a field named FileHeader that contain information regarding the number of sections exist ...


1

What I found out until now is that according to the Intel manual, even though SMEP bit is 0, if any entry in the process of going through page tables have execute disable bit set, it won't execute. This is the case when allocating RWX memory from standard user (medium IL). I didn't figure out whether this is a problem of my testing environment or some kind ...


1

Windows applications do not work in isolation. They have to share the processor with all the other processes, services, drivers and so on. There may be a myriad reasons why a specific API call is slow, and it's quite unlikely the API itself is a problem. Especially with I/O, there are all the caches, drivers, and hardware itself (i.e. HDD/SSD) to consider. ...


1

This is just a string in the binary file that, for some reason represents the file name and in this case a cpp file. Maybe this binary for some reason needs to access it on the system, or checks if they exists and does some work if so (or if not). They are not hidden and unfortunately not available.


1

As per Reading and Filtering Debugging Messages: On the target computer, you can access the component filter mask in the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Debug Print Filter. Using a registry editor, create or open this key. Under this key, create a value with the name of the desired component, in ...


1

The canonical example (IMHO) was written in C by Joachim Bauch in his MemoryModule project. There is an Object-Pascal port (both Lazarus and Delphi) called BTMemoryModule.


1

So, you've initialized several bytes: unsigned char rawData[37376] = { 0x4D, 0x5A, 0x90, 0x00, 0x03, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00}; But then, you're accessing DOSHeader->e_lfanew which is not initialized in rawData. Most likely data DOSHeader->e_lfanew contains some trash like 0xCCCCCCCC or 0xDDDDDDDD, so NtHeader points to some memory ...


Only top voted, non community-wiki answers of a minimum length are eligible