2

For analysing RPC I use mIDA: mIDA is a plugin for the IDA disassembler that can extract RPC interfaces from a binary file and recreate the associated IDL definition. mIDA is free and fully integrates with the latest version of IDA (5.2 or later). Note that mIDA doesn't work with most recent version (64 bit version) of IDA but requires 32 bit version (6.95 ...


1

There Are Lots of Documented Helper functions in dbghelp.h to fully parse the Pe file if you do not wish to use dbghelp.h almost all of these function has an Rtl Equivalent function in ntdll.dll Which You Can call Dynamically (LoadLibrary . GetProcAddres) For Example this Function ImageNtHeader Has an Equivalent RtlImageNtHeader in ntdll.dll which you can ...


1

In order to get the text section of the desired dll, first you need its base address (DOS Header in other words) which leads you to its PE Header (using the e_lfanew field of IMAGE_DOS_HEADER). At the PE Header (or in it's structured name IMAGE_NT_HEADERS) you'll find a field named FileHeader that contain information regarding the number of sections exist ...


1

What I found out until now is that according to the Intel manual, even though SMEP bit is 0, if any entry in the process of going through page tables have execute disable bit set, it won't execute. This is the case when allocating RWX memory from standard user (medium IL). I didn't figure out whether this is a problem of my testing environment or some kind ...


1

dg gs seems to be not supported on x64, as stated by the documentation, so you can not rely on it. If you want to see where gs points to, you can use !teb or rdmsr c0000102.


Only top voted, non community-wiki answers of a minimum length are eligible