Hot answers tagged

42

(reposting my SO answer to a similar question) In many cases it is possible to identify the compiler used to compile the code, and from that, the original language. Most language implementations include some kind of runtime library to implement various high-level operations of the language. For example, C has the CRT which implements file I/O operations (...


27

VMWare can capture USB traffic between the device and the VM. A VMWare engineer even made an open-source tool for analyzing and visualizing USB logs - Virtual USB analyzer. Web site Tutorial Alternatively, a tool for converting VMWare logs to .pcap for analyzing in Wireshark is available from Sogeti.


25

It very much depends on what framework they use in order to do their windowing. It could be MFC, WPF, WinForms, WTL, QT, wxWidgets, pure Windows API. There's a lot of frameworks and they all handle the final routing of messages differently. I'll answer the question for the cases that are either directly built on top of Windows API or where they're using the ...


25

Executable type is indicated by PE header, download documentation. The first word (two bytes) of PE header indicates target machine, here is a list of possible values: 0x0000 - The contents of this field are assumed to be applicable to any machine type 0x01d3 - Matsushita AM33 0x8664 - x64 0x01c0 - ARM little endian 0x01c4 - ARMv7 (or higher) Thumb mode ...


25

This looks like the output of Visual C++ linker in incremental linking mode. In this mode, the linker adds a section with incremental linking thunks (ILTs) at the start of the code section (.text), each thunk being a relative jump (E9 xx xx xx xx) to a function. All function calls in the binary are redirected to the corresponding ILT instead of pointing ...


20

The traditional way to determine the function pointed to by [edi+1Ch] is as follows: Find the Interface Definition Language (IDL) file for the given interface. In your case, the interface is IShellWindows. According to the documentation for IShellWindows, its interface is defined in IDL file Exdisp.idl. That IDL file is included in the Windows SDK (...


18

Matt Cutts wrote a series of blog posts outlining the general approach of reverse-engineering a USB device and getting it working with linux, and explaining how he did this for a USB controlled toy missile launcher. You may find them a useful starting point. http://www.mattcutts.com/blog/reverse-engineering-a-windows-usb-driver/ http://www.mattcutts.com/...


17

The technique of jumping to 64bit code from a 32bit WOW64-ed process is commonly called "Heaven's gate" when performed manually. This is usually done to use 64bit features (such as manipulating 64bit processes by calling 64bit versions of windows APIs) or by malware to make debugging more difficult, which is coincidentally what you seem to be experiencing ;)....


16

.NET could be identified by import which you can see using dependency warker - check if there is an import of mscorlib.dll which is a core lib of .net framework. C++ can be identified by looking at the assembly - it uses this call convention. PEid can show partial info about what compiler and run-time were used. In general it uses list of signature for ...


15

why is the default imagebase value 0x400000? From http://msdn.microsoft.com/en-us/library/ms809762.aspx -- In executables produced for Windows NT, the default image base is 0x10000. For DLLs, the default is 0x400000. In Windows 95, the address 0x10000 can't be used to load 32-bit EXEs because it lies within a linear address region shared by all ...


14

I'm not sure if it's still around, but Themida used to have a kernel-mode driver component that facilitated some of the protection features. It could well be installed on your system and catching the debugger out. My first suggestion would be to try Immunity Debugger. It's an Olly fork that is designed for offensive debugging and exploit development, but it ...


13

Unfortunately MSDN and windows API documentation is really scarce here, and I had difficulties finding anything other than the minimal description in MSDN. It turns out the Vectored Continue Handlers are maintained in a Linked list very similar to the one used for Vectored Exception Handlers. They are so similar, that the function's prototypes are ...


12

The code below will set EAX to the image base address of ntdll.dll: MOV EAX, DWORD PTR FS:[30] ; EAX = PEB MOV EAX, DWORD PTR DS:[EAX+0C] ; EAX = PEB->Ldr MOV EAX, DWORD PTR DS:[EAX+1C] ; EAX = PEB->Ldr.InInitializationOrderModuleList.Flink MOV EAX, DWORD PTR DS:[EAX+8] ; EAX = image base of ntdll (LDR_MODULE's BaseAddress) Based on your ...


12

The Intel and AMD instruction sets are similar but not identical. There are many examples of that: FMA3/FMA4, AMD-V and VT-x (and their extensions), etc. The fast system call interface is yet another difference. Intel supports SYSENTER in all modes1 - Legacy Mode (or, on the few 32-bit only Intel CPUs, simply Protected Mode), Long Mode and Compatibility ...


11

open calc.exe in ollydbg c:\ollydbg.exe calc.exe press Ctrl + G and type GetMessageW press F2 to set a breakpoint and press F9 until it breaks when it is broken press ctrl+f9 to run until return press shift+f4 to set a conditional log breakpoint in the expression edit box type [esp+4] in the decode value of expression select pointer to MSG structure (UNICODE)...


11

Marco Pontello's TrID software can usually identify what was used to compile a file.


11

I have been searching for an answer to this question for a while and I know this question is years old but on the off chance someone else comes across this question I will leave my response here. The above answer is referring to non-canonicalized device paths where as you are asking about \??\ not \\?\ there may only be a small difference in the question ...


10

Current IDA versions (as of 6.5) are pretty much equivalent for all three platforms. You can disassemble all file formats on all three platforms. You can definitely analyze PE and Mach-O files on Linux. Most debuggers are also available on all platforms. A couple of features are available only in the Windows version: WinDbg and Symbian debuggers WinCE ...


9

One thing you need to keep in mind is that code in your process and the code in the target process reside in different address spaces. So any address in your program is not necessary valid in the target process and vice versa. This means the code that you inject cannot make any assumptions about addresses of functions or variables. Even your inject function'...


9

It's cl.exe that's inserting the jump thunk. It has some advantages, such as making it easier to redirect a function during runtime after load and makes it so that the loader only has to do a single relocation for that function. The other option would be to use an indirect call through an address. Neither is really optimal for performance due to the distance ...


9

Here is a perfect explanation how sysenter works: http://www.osronline.com/article.cfm?id=257 In essence: All native API calls from User Mode have a body that simply loads an index into EAX, executes SystemCallStub, and returns SystemCallStub saves a pointer to the top of the User Mode stack into EDX and executes a SYSENTER instruction SYSENTER disables ...


9

Would this driver exist in user space, or in kernel space? Kernel space. Is it even possible for a non kernel mode driver to exist? You can write a user-mode driver using the User-Mode Driver Framework, but that type of driver is effectively a user-mode service with access to some extra I/O functionality. What we typically think of as a "driver" is a ...


9

The signature database of many Compiler and Packer detectors, and sometimes even their source-code, is freely available and you can actually read the signatures in clear-text. Genrally, the detector performs very naive checks to detect the compiler/linker/protector/etc which based on a preset mask of bytes. The mask is combined from a sequence of bytes ...


9

I still think this will create a BSOD, what's more I think that this is deliberate. It makes perfect sense to assume that this is deliberate once piecing all the puzzle pieces together. The source incompatibility will inevitably force that the developer notices the change of type for KeNumberProcessors from PCCHAR to CCHAR. The likeliest error is: error ...


9

If they were all to external targets then it would be the stubs for external functions when dynamically loading dlls. This way you can limit the amount of pages that need updating when a new dll get loaded. Which lets the calling code be position independent with regards to the call target. Calls to external function are sent to that page and forwarded to ...


8

An alternative to patching the DriverInit function with an INT3 is to put a breakpoint in the IopLoadDriver function which is responsible for calling DriverInit. On Windows XP SP3, the breakpoint should be added at IopLoadDriver+0x66a which is call dword ptr [edi+2Ch] (0x2C is _DRIVER_OBJECT.DriverInit). Find IopLoadDriver with x nt!IopLoadDriver Add a ...


8

courtsey Hotpatching and the Rise of Third-Party Patches presentation at BlackHat USA 2006 by Alexander Sotirov What Is Hotpatching? Hotpatching is a method for modifying the behavior of an application by modifying its binary code at runtime. It is a common technique with many uses: • debugging (software breakpoints) • runtime instrumentation • hooking ...


8

TL;DR you can call anything, locating the right part of code is the hard part. export table If you mean 'just as Windows does', then you mean the functions of the DLL that are available to the others, ie the exported ones? in this case, you need to parse the export table - check pefile for a readable and reliable implementation. locating any function IDA If ...


8

So assuming like you said, you have the linear address of your device object, use the windbg extension !object 0xlinearaddress. Based on your windows build, it will display the linear address of the object header. Which in memory exists right below the object. Use windbg to parse the OBJECT_HEADER structure for you. Starting with Windows 7 you are going to ...


8

Open Exports view in IDA (Views-->Open subviews-->Exports). You'll see there one function name. It is the real main function of the program (which is possibly not your main function, but your main function will be called somehow from it). Actually you can not find main function by name because this information does not exist in the executable: the computer ...


Only top voted, non community-wiki answers of a minimum length are eligible