Raymond Chen (Microsoft) has a blog post discussing this in detail:
In short, it's a compile time addition applied in order to support run time hot patching, so the function can have the first two bytes overwritten with a JMP instruction to redirect execution to another piece of code.
(reposting my SO answer to a similar question)
In many cases it is possible to identify the compiler used to compile the code, and from that, the original language.
Most language implementations include some kind of runtime library to implement various high-level operations of the language. For example, C has the CRT which implements file I/O operations (...
the first 3 lines set an exception handler (an 'error catcher')
the int3 generates an exception
execution resumes at next
this trick is (ab)using Structured Exception Handling, a mechanism to define exception handlers, typically by compilers when try/catch blocks are used.
In 32bits versions of Windows, they can be set on the fly, ...
Sogeti's Origami framework comes with a GTK based GUI.
What is it?
origami is a Ruby framework designed to parse, analyze, and forge PDF
documents. This is NOT a PDF rendering library. It aims at providing a
scripting tool to generate and analyze malicious PDF files. As well,
it can be used to create on-the-fly customized PDFs, or to inject
You can use the Image File Execution Options registry key to specify a debugger which will be launched automatically when the executable starts.
You can also always do the ancient trick of patching an endless loop (EB FE) at the entry point or somewhere later. This would allow you to attach at you leisure, restore the patched bytes and resume the execution.
Note: I am assuming 32bit x86 on Windows, your question unfortunately doesn't state for certain. But since it's Windows and you don't explicitly mention x64 this was the sanest assumption I could make.
First off, try to search for the function names with a search engine. Don't just settle for a single search engine. Failing that, inspect whatever came in ...
VMWare can capture USB traffic between the device and the VM. A VMWare engineer even made an open-source tool for analyzing and visualizing USB logs - Virtual USB analyzer.
Alternatively, a tool for converting VMWare logs to .pcap for analyzing in Wireshark is available from Sogeti.
This looks like the output of Visual C++ linker in incremental linking mode. In this mode, the linker adds a section with incremental linking thunks (ILTs) at the start of the code section (.text), each thunk being a relative jump (E9 xx xx xx xx) to a function.
All function calls in the binary are redirected to the corresponding ILT instead of pointing ...
Executable type is indicated by PE header, download documentation.
The first word (two bytes) of PE header indicates target machine, here is a list of possible values:
0x0000 - The contents of this field are assumed to be applicable to any machine type
0x01d3 - Matsushita AM33
0x8664 - x64
0x01c0 - ARM little endian
0x01c4 - ARMv7 (or higher) Thumb mode ...
Check the dword at offset 0xE8 (32-bit) or 0xF8 (64-bit) in the PE header. If it's non-zero, it's the pointer to the CLR header. That's a managed file (you can't put random data there because direct .NET parsing support is built into XP and later, so the file won't load if the data aren't valid). The presence of mscoree.dll is not enough in itself, ...
signsrch by Luigi Auriemma has signatures for tables used in common compression libraries (zlib etc.).
It has been ported as plugins for ImmDbg and IDA.
He also has the offzip tool which tries to identify and unpack compressed streams inside a binary.
It very much depends on what framework they use in order to do their windowing. It could be MFC, WPF, WinForms, WTL, QT, wxWidgets, pure Windows API. There's a lot of frameworks and they all handle the final routing of messages differently.
I'll answer the question for the cases that are either directly built on top of Windows API or where they're using the ...
It's intended to jump to a specific location, 5 bytes before the mov instruction. From there, you have 5 bytes which are intended to be modified to a long jump to somewhere else in 32-bit memory space. Note that when hot-patching, that 5 bytes jump should be placed first, and then the mov can be replaced. Going the other way, you risk the replaced mov-jmp ...
You may capture the traffic with packet sniffer to capture all the communications of client\server application, or You may use reverse proxy to intercept and alter data in real time.
In simple words, network sniffers allow You to see data flow between client and server, analyse it and reverse the protocol communications
Reverse proxy intercept communication ...
Reversing: Secrets of Reverse Engineering, Eldad Eilam
IDA Pro Book, 2nd Edition, Chris Eagle (book's website)
Gray Hat Python, Justin Seitz
Windows Internals, 6th edition
Windows via C/C++ 5th Ed
Lena's Reversing 101 — the classic introduction for newbie reverser.
The Legend of Random — list of tutorials and texts to read on ...
The traditional way to determine the function pointed to by [edi+1Ch] is as follows:
Find the Interface Definition Language (IDL) file for the given interface. In your case, the interface is IShellWindows. According to the documentation for IShellWindows, its interface is defined in IDL file Exdisp.idl. That IDL file is included in the Windows SDK (...
The technique of jumping to 64bit code from a 32bit WOW64-ed process is commonly called "Heaven's gate" when performed manually. This is usually done to use 64bit features (such as manipulating 64bit processes by calling 64bit versions of windows APIs) or by malware to make debugging more difficult, which is coincidentally what you seem to be experiencing ;)....
I kind of like your answer about changing the subsystem, especially if you're not a fan of kernel debugging. I'm a big fan of Windbg, though. The way I do this is:
Hook up my kernel debugger to a VM
Change the first byte of the driver's entry point to be an INT3 (0xCC).
Fix-up the PE checksum (I'm a fan of letting pefile do this work for me).
Load the ...
From my "Ultimate" Anti-Debugging reference (see pferrie.host22.com):
The interrupt 0x2D is a special case. When it is executed, Windows uses the current EIP register value as the exception address, and then it increments by one the EIP register value. However, Windows also examines the value in the EAX register to determine how to adjust the exception ...
Matt Cutts wrote a series of blog posts outlining the general approach of reverse-engineering a USB device and getting it working with linux, and explaining how he did this for a USB controlled toy missile launcher. You may find them a useful starting point.
.NET could be identified by import which you can see using dependency warker - check if there is an import of mscorlib.dll which is a core lib of .net framework.
C++ can be identified by
looking at the assembly - it uses this call convention.
PEid can show partial info about what compiler and run-time were used. In general it uses list of signature for ...
There is such a list here:
If you use IDA, consider enabling the COM Helper plugin. When you create an instance of a GUID structure, it checks the list loaded from cfg/clsid.cfg and, if a match found, renames the location automatically and tries to import "<Classname>Vtbl" structure from the loaded type ...
An elegant and simple solution would be to sign your executable and verify the signature on startup (any change will invalidate the signature). Even if someone patches your signature check, the signature will still be invalid which makes clear that the exe is not the same one you delivered.
My other thoughts would be to use an exe packer or to take a ...
The Windows kernel, unlike Linux or OS X, does not use consistent syscall numbering across versions. The numbers can change even after a servicepack release. For example, the NtReadFile syscall was 0x0086 on Windows NT 4 but on Windows 7 it's 0x0111 (see here for the full list).
That's why all proper programs use the kernel32.dll (or ntdll.dll) to perform ...
why is the default imagebase value 0x400000?
From http://msdn.microsoft.com/en-us/library/ms809762.aspx --
In executables produced for Windows NT, the default
image base is 0x10000. For DLLs, the default is 0x400000. In Windows
95, the address 0x10000 can't be used to load 32-bit EXEs because it
lies within a linear address region shared by all ...
Let me start by telling you that what you want would be impossible, because of how well-known DLLs work. You can attempt something similar with tools like PEBundle or dllpackager, but that will usually (I'd say certainly) fail with the well-known DLLs (such as system DLLs as well as even the MSVC runtime DLLs in their different incarnations). See this and ...
I'm not sure if it's still around, but Themida used to have a kernel-mode driver component that facilitated some of the protection features. It could well be installed on your system and catching the debugger out.
My first suggestion would be to try Immunity Debugger. It's an Olly fork that is designed for offensive debugging and exploit development, but it ...
Peter Ferrie's “Ultimate” Anti-Debugging Reference (PDF, 147 pages) contains many anti-debugs, whether they're hardware or API based...
Walied Assar's blog shows his researches, which are focused on finding new anti-debugs.
other (maybe redundant) resources:
Nicolas Fallière's Windows Anti-Debug reference
OpenRCE's Anti Reverse Engineering Techniques ...
This seemed like a fun project for a Sunday afternoon, so I had a go at it. To get straight to the point, here's the call stack for a function in SQL server that parses and then executes the query (addresses and offsets taken from SQL Server 2008 R2 running on Windows 7 SP1 32-bit):
The code below will set EAX to the image base address of ntdll.dll:
MOV EAX, DWORD PTR FS: ; EAX = PEB
MOV EAX, DWORD PTR DS:[EAX+0C] ; EAX = PEB->Ldr
MOV EAX, DWORD PTR DS:[EAX+1C] ; EAX = PEB->Ldr.InInitializationOrderModuleList.Flink
MOV EAX, DWORD PTR DS:[EAX+8] ; EAX = image base of ntdll (LDR_MODULE's BaseAddress)
Based on your ...