31 votes
Accepted

How to reverse engineer a Windows 10 UWP app?

I have thought carefully before adding this as "Another Answer" rather than editing my existing answer that I posted above this morning. I feel that this answer deserves another post of its own as it'...
user avatar
  • 1,026
21 votes

How to reverse engineer a Windows 10 UWP app?

As promised, I am back to post a more specific answer to the question that was asked by the OP. Decided to write this as a separate answer as I believe that this content stands out on its own and ...
user avatar
  • 1,026
9 votes

How to reverse engineer a Windows 10 UWP app?

"I'd like to see details on how to hook and step into the function that processes a button click event in a UWP app." I would suggest using the EventHook Library which is intended to hook global ...
user avatar
  • 1,026
8 votes
Accepted

What are the .cpp files in IDA disassembly

I commented and then I've read malikcjm answer So this is basically an extension of malikcjm's answer. Suppose you have a code like this and load the compiled exe into ida #include <stdio.h>...
user avatar
  • 15k
7 votes

Debug a windows service entry without windbg

I'll post my own answer here so I can find this again in the future. Using CFF Explorer open the service binary. Find the AddressOfEntryPoint in the Optional Header. Find the .text entry in Section ...
user avatar
  • 422
5 votes

How to reverse engineer a Windows 10 UWP app?

I searched in the System32 folder inside every file named SystemSettting*.* for the word Shutdown. I used Total Commander as it can search with multiple encodings such as ASCII and Unicode: Then ...
user avatar
  • 2,968
4 votes
Accepted

ntoskrnl checksum mismatch

You don't disable that kind of integrity check, you simply set the checksum. The one that's relevant in this particular case is the respective field in the IMAGE_OPTIONAL_HEADER, that is ...
user avatar
  • 10.5k
4 votes
Accepted

Get interface definition of undocumented COM objects

Now, this can't be a full-fledged answer from A to Z, unfortunately. But for COM there are only a few steps that are really specific to COM. The project you linked clearly has reverse-engineered the ...
user avatar
  • 10.5k
4 votes

.00cfg section in the PE file

Windows loader does not care about section names, so the name does not really matter, but usually this section contains the pointer to the indirect call guard check (___guard_check_icall_fptr). The ...
user avatar
  • 34.9k
3 votes

How are __argc and __wargv globals exported from a 64-bit PE file compiled with Visual Studio?

These two symbols aren't exported in the usual way (i.e. via the export table). Instead, they are public symbols inside the run-time library itself. The startup code that runs before _main() ...
user avatar
  • 4,511
3 votes

How can I enumerate and hook into a Windows 10 RPC interface?

For analysing RPC I use mIDA: mIDA is a plugin for the IDA disassembler that can extract RPC interfaces from a binary file and recreate the associated IDL definition. mIDA is free and fully integrates ...
user avatar
  • 2,968
3 votes

Is there a tool to reverse engineer UWP apps, similar to dnSpy for .NET?

UWP is a container/platform, different reversing techniques are needed depending on the executable content. .NET UWP apps can be compiled to CLR, then you can use standard .NET decompilation ...
user avatar
3 votes

Get interface definition of undocumented COM objects

well the answers out there are good this is just an addition to show how you could arrive using windbg in command line dbh is an utility in windbg installation that can load any binary and provide a ...
user avatar
  • 15k
2 votes

How can I receive DbgPrint messages in windbg on windows 10

The simple way to turn on the debug information is to modify the mask directly in WinDBG with this command : kd> ed nt!Kd_Default_Mask 8 The console will become massively verbose...
user avatar
  • 21
2 votes

Run PE File - (Executable) From Memory

I have managed to debug and find your problems, but it's really is out of scope since your "bytes" of a "64 bit " program does not have "IMAGE_NT_SIGNATURE" (PE00) but rather has "IMAGE_DOS_SIGNATURE" ...
user avatar
  • 141
2 votes

What are the .cpp files in IDA disassembly

There are no *.cpp files in disassembly. It looks like automatically generated string file file path. It's sometimes used for logging. It can be generated if somewhere in the source code __FILE__ ...
user avatar
  • 184
2 votes

Get interface definition of undocumented COM objects

This is just an extension of @0xC0000022L's answer. For this question, I will explain ICMLuaUtil COM interface below because IFileOperation COM interface is in shell32.dll, too big ;) You mentioned ...
user avatar
  • 1,469
2 votes

.00cfg section in the PE file

The most useful reference I've seen about this section is in this Adobe source comment: // // Allocate xyz in the .00cfg so that it is implicitly merged into the // import section of the binary (...
user avatar
2 votes

Reverse engineer Listen to this device on Windows - Reverse engineer Windows when there's no API

AFAIK, knowing what registry keys are used is not always enough, because the registry is just a place to store things like preferences. Setting a registry value may not have any immediate effect on a ...
user avatar
2 votes
Accepted

A Process does not list on x64dbg attach list

x64dbg comes in two versions, 32 and 64 bits. You need to run the 32-bit version of x64dbg to detect a 32-bit application.
user avatar
1 vote
Accepted

Returning to usermode shellcode from windows kernel (Win10)

What I found out until now is that according to the Intel manual, even though SMEP bit is 0, if any entry in the process of going through page tables have execute disable bit set, it won't execute. ...
user avatar
1 vote

Is there a tool to reverse engineer UWP apps, similar to dnSpy for .NET?

UWP apps are mostly native code unlike .NET apps which use CLR bytecode. Native code is much harder to analyze and decompile.
user avatar
  • 34.9k
1 vote
Accepted

How to find the starting address of text section of a DLL inside a process? (64 bit)

There Are Lots of Documented Helper functions in dbghelp.h to fully parse the Pe file if you do not wish to use dbghelp.h almost all of these function has an Rtl Equivalent function in ntdll.dll ...
user avatar
  • 15k
1 vote

How to find the starting address of text section of a DLL inside a process? (64 bit)

In order to get the text section of the desired dll, first you need its base address (DOS Header in other words) which leads you to its PE Header (using the e_lfanew field of IMAGE_DOS_HEADER). At ...
user avatar
  • 121
1 vote
Accepted

Why address 7FFE0308 always gets compared in 64bit applications before making a syscall in Ntdll?

During Kernel Initialization ntKiSystemCallSelector is Initialized from LOADER_PARAMETER_BLOCK 0: kd> dt nt!_LOADER_PARAMETER_BLOCK Extension->VsmConfigured +0x0f0 Extension ...
user avatar
  • 15k
1 vote
Accepted

How can I enumerate and hook into a Windows 10 RPC interface?

What I found that fits my requirements is a free open source tool called RpcView, which can enumerate endpoints and interfaces from a selected process, list its corresponding procedures with their ...
user avatar
1 vote

How to debug slow Windows API calls?

Windows applications do not work in isolation. They have to share the processor with all the other processes, services, drivers and so on. There may be a myriad reasons why a specific API call is slow,...
user avatar
  • 34.9k
1 vote

Windbg: How to directly view GS:[0x60]

dg gs seems to be not supported on x64, as stated by the documentation, so you can not rely on it. If you want to see where gs points to, you can use !teb or rdmsr c0000102.
user avatar
1 vote

What are the .cpp files in IDA disassembly

This is just a string in the binary file that, for some reason represents the file name and in this case a cpp file. Maybe this binary for some reason needs to access it on the system, or checks if ...
user avatar
1 vote

Run PE File - (Executable) From Memory

For anyone who sees this in the future. The problem was indeed the 64 vs 32 bit issue that the asker thought. The mistake is in this line NtHeader = PIMAGE_NT_HEADERS(DWORD(Image) + DOSHeader->...
user avatar
  • 31

Only top scored, non community-wiki answers of a minimum length are eligible