25
votes
Accepted
What kind of code would produce this assemby with loads of jump statements?
This looks like the output of Visual C++ linker in incremental linking mode. In this mode, the linker adds a section with incremental linking thunks (ILTs) at the start of the code section (.text), ...
- 36.9k
18
votes
Accepted
How to investigate Windows 32/64bit (WOW64) transition
The technique of jumping to 64bit code from a 32bit WOW64-ed process is commonly called "Heaven's gate" when performed manually. This is usually done to use 64bit features (such as manipulating 64bit ...
- 11.8k
17
votes
Accepted
What are the Vectored Continue Handlers
Unfortunately MSDN and windows API documentation is really scarce here, and I had difficulties finding anything other than the minimal description in MSDN.
It turns out the Vectored Continue Handlers ...
- 11.8k
16
votes
Struggling between syscall or sysenter ( Windows )
The Intel and AMD instruction sets are similar but not identical.
There are many examples of that: FMA3/FMA4, AMD-V and VT-x (and their extensions), etc.
The fast system call interface is yet ...
- 682
14
votes
\??\C:\ Question Marks in Paths
I have been searching for an answer to this question for a while and I know this question is years old but on the off chance someone else comes across this question I will leave my response here.
...
- 141
11
votes
Accepted
How to switch to "Graph View" in IDA Pro while debugging with WinDbg inside a system DLL?
IDA can only display functions in graph mode, so in order to see that code as a graph, you must:
Find the start of the function
Search for a prologue, such as push ebp, mov ebp, esp1, and find the ...
- 468
11
votes
Accepted
Where ES/GS/FS are pointing to?
On x86 32bit windows the FS segment register points to a structure called the Thread Information Block or the TIB for short. This structure is created by the kernel on thread creation and is used to ...
- 11.8k
10
votes
How tools like PEiD find out the compiler and its version.
The signature database of many Compiler and Packer detectors, and sometimes even their source-code, is freely available and you can actually read the signatures in clear-text.
Genrally, the ...
- 9,019
10
votes
How does the Windows Native API communicate with the kernel?
ntdll.dll is not privileged in any sense and can't do anything that your user mode library can't. So no, it doesn't have "permission" do directly call kernel-mode code and it doesn't do that.
What it ...
- 682
10
votes
Trying to understand this construct in Dbgv.sys driver for DbgView tool
I still think this will create a BSOD, what's more I think that this is deliberate. It makes perfect sense to assume that this is deliberate once piecing all the puzzle pieces together. The source ...
- 10.9k
10
votes
What is the difference between IDA and OllyDbg?
To put it very simply, there are two primary methods of analysis:
Static Analysis: Analyzing an executable while it's not running.
Dynamic Analysis: Analyzing an executable while it's running.
IDA ...
- 2,254
9
votes
Accepted
Batch disassembling DLL and EXE files?
If you have any version of Visual Studio or Visual Studio Build Tools installed, you have a powerful command line tool called dumpbin, which includes a disassembler option, available to you.
dumpbin /...
- 311
9
votes
Accepted
What are the difference syscall and int 0x2E instructions?
7FFE0308h is a pointer inside the KUSER_SHARED_DATA struct.
The pre-set address for access from kernel mode is defined symbolically in WDM.H as KI_USER_SHARED_DATA. It helps when debugging to ...
- 694
9
votes
What kind of code would produce this assemby with loads of jump statements?
If they were all to external targets then it would be the stubs for external functions when dynamically loading dlls.
This way you can limit the amount of pages that need updating when a new dll get ...
- 617
9
votes
Why does PE ImageBase address change in memory?
This is just a preferred address. Windows can load the binary at almost any address and rebase it to this new location.
ImageBase: The preferred address of the first byte of image when loaded into ...
- 4,952
9
votes
Accepted
Do I have to learn computer architecture for underestanding or doing reverse engineering?
The question is too broad, but I'll try to answer and hope that it will help.
It depends on what exactly do you mean by computer architecture and area you applying your reverse engineering skills to.
...
- 8,538
8
votes
Accepted
Is there any way to get my own image base without calling any WinAPI functions, such as GetModuleHandle?
I can think of a couple of ways of doing that
Scanning memory from EIP
You could easily get the EIP of your own code without calling any APIs. There are a few ways to achieve that using inline ...
- 11.8k
8
votes
Why cant we find ransomware keys?
You really need to read up on public-key cryptography, methinks.
The scheme - if properly (i.e. securely) implemented - could work somewhat like this:
generate a public/private key pair on the ...
- 10.9k
8
votes
Do I have to learn computer architecture for underestanding or doing reverse engineering?
A solid understanding of the fundamentals of computer architecture is very useful for a Reverse Engineer.
That said - it depends on your target. If you are reverse engineering a Java application or a ...
- 213
7
votes
Accepted
What is this hidden stack used by syscalls on Windows?
This doesn't happen during the system call. It happens in user-mode.
WOW64 processes have two user-mode stacks - a 32-bit stack, which is the one you normally use, and a 64-bit stack. The WOW64 ntdll ...
- 682
7
votes
Accepted
What could be the purpose of XORing esp with a global variable? (stack canary protection)
Yes, this is an implementation of what's often called "Stack Canaries", a method of stack Buffer Overflow Protection. That example you're describing is specifically the method used by Visual Studio, ...
- 11.8k
7
votes
How to do Global DLL injection
TLDR: No, no and no.
You have several questions hiding there in your post:
Is is possible to inject a DLL into each and every process?
If it is possible, can the following methods do that:
...
- 682
7
votes
Accepted
How to decompile an exe file?
I have been wondering, if every program is based on machine code, can we not decompile a program until it hits machine code and make it up to real programming languages?
This question is based on a ...
- 7,236
7
votes
Tracing function calls in x64dbg
It is possible using Trace->Trace into... option. After opening the executable, select this option and specify the message you want to log (in Log text field); for example {a:cip} {i:cip}, which ...
- 3,419
7
votes
Why doesn't this retn instruction return from the function?
The address of sub_1313cba4 is moved to PC/IP but not directly, as this cannot be done. It is done by pushing the address to the stack and relying on the fact that retn will get what's on the top of ...
- 4,952
7
votes
What is the difference between IDA and OllyDbg?
OllyDbg is a debugger for Windows x32 and x64 and its only focus is dynamic analysis, although it can be also used for non deep static analysis.
IDA is the de-facto tool for doing static analysis and ...
- 4,643
7
votes
How do I import function signatures to Ghidra?
"File" -> "Parse C Source..." ... then parse the ddraw.h
But warning it doesn't work as smooth as expected. I could only get small headers to parse correctly.
A good video about it: https://www....
- 71
7
votes
Is it possible to download program database (PDB) files of Microsoft Windows binaries without installing any software?
You can use PDB downloader which doesn’t require any installation https://docs.microsoft.com/en-us/archive/blogs/webtopics/pdb-downloader. Or you could use its source below to see how you could ...
- 1,267
6
votes
Accepted
Is there any websites to get malware files using YARA rules?
An additional source of such samples, which I don't know why nobody listed, is virustotal.com. It lets you execute what they call "ruleset" and "retrohunt" searches which are basically running yara ...
- 11.8k
6
votes
Accepted
How can I modify binary image resource data?
Firstly, we need to understand what is RCDATA resource. This is how it described in MSDN:
RCDATA defines a raw data resource for an application. Raw data resources
permit the inclusion of binary ...
- 9,019
Only top scored, non community-wiki answers of a minimum length are eligible