(reposting my SO answer to a similar question)
In many cases it is possible to identify the compiler used to compile the code, and from that, the original language.
Most language implementations include some kind of runtime library to implement various high-level operations of the language. For example, C has the CRT which implements file I/O operations (...
It very much depends on what framework they use in order to do their windowing. It could be MFC, WPF, WinForms, WTL, QT, wxWidgets, pure Windows API. There's a lot of frameworks and they all handle the final routing of messages differently.
I'll answer the question for the cases that are either directly built on top of Windows API or where they're using the ...
Executable type is indicated by PE header, download documentation.
The first word (two bytes) of PE header indicates target machine, here is a list of possible values:
0x0000 - The contents of this field are assumed to be applicable to any machine type
0x01d3 - Matsushita AM33
0x8664 - x64
0x01c0 - ARM little endian
0x01c4 - ARMv7 (or higher) Thumb mode ...
This looks like the output of Visual C++ linker in incremental linking mode. In this mode, the linker adds a section with incremental linking thunks (ILTs) at the start of the code section (.text), each thunk being a relative jump (E9 xx xx xx xx) to a function.
All function calls in the binary are redirected to the corresponding ILT instead of pointing ...
The technique of jumping to 64bit code from a 32bit WOW64-ed process is commonly called "Heaven's gate" when performed manually. This is usually done to use 64bit features (such as manipulating 64bit processes by calling 64bit versions of windows APIs) or by malware to make debugging more difficult, which is coincidentally what you seem to be experiencing ;)....
.NET could be identified by import which you can see using dependency warker - check if there is an import of mscorlib.dll which is a core lib of .net framework.
C++ can be identified by
looking at the assembly - it uses this call convention.
PEid can show partial info about what compiler and run-time were used. In general it uses list of signature for ...
why is the default imagebase value 0x400000?
From http://msdn.microsoft.com/en-us/library/ms809762.aspx --
In executables produced for Windows NT, the default
image base is 0x10000. For DLLs, the default is 0x400000. In Windows
95, the address 0x10000 can't be used to load 32-bit EXEs because it
lies within a linear address region shared by all ...
I'm not sure if it's still around, but Themida used to have a kernel-mode driver component that facilitated some of the protection features. It could well be installed on your system and catching the debugger out.
My first suggestion would be to try Immunity Debugger. It's an Olly fork that is designed for offensive debugging and exploit development, but it ...
Unfortunately MSDN and windows API documentation is really scarce here, and I had difficulties finding anything other than the minimal description in MSDN.
It turns out the Vectored Continue Handlers are maintained in a Linked list very similar to the one used for Vectored Exception Handlers. They are so similar, that the function's prototypes are ...
The code below will set EAX to the image base address of ntdll.dll:
MOV EAX, DWORD PTR FS: ; EAX = PEB
MOV EAX, DWORD PTR DS:[EAX+0C] ; EAX = PEB->Ldr
MOV EAX, DWORD PTR DS:[EAX+1C] ; EAX = PEB->Ldr.InInitializationOrderModuleList.Flink
MOV EAX, DWORD PTR DS:[EAX+8] ; EAX = image base of ntdll (LDR_MODULE's BaseAddress)
Based on your ...
The Intel and AMD instruction sets are similar but not identical.
There are many examples of that: FMA3/FMA4, AMD-V and VT-x (and their extensions), etc.
The fast system call interface is yet another difference.
Intel supports SYSENTER in all modes1 - Legacy Mode (or, on the few 32-bit only Intel CPUs, simply Protected Mode), Long Mode and Compatibility ...
open calc.exe in ollydbg c:\ollydbg.exe calc.exe
press Ctrl + G and type GetMessageW
press F2 to set a breakpoint and press F9 until it breaks
when it is broken press ctrl+f9 to run until return
press shift+f4 to set a conditional log breakpoint
in the expression edit box type [esp+4]
in the decode value of expression select pointer to MSG structure (UNICODE)...
I have been searching for an answer to this question for a while and I know this question is years old but on the off chance someone else comes across this question I will leave my response here.
The above answer is referring to non-canonicalized device paths where as you are asking about \??\ not \\?\ there may only be a small difference in the question ...
Current IDA versions (as of 6.5) are pretty much equivalent for all three platforms. You can disassemble all file formats on all three platforms. You can definitely analyze PE and Mach-O files on Linux. Most debuggers are also available on all platforms.
A couple of features are available only in the Windows version:
WinDbg and Symbian debuggers
The signature database of many Compiler and Packer detectors, and sometimes even their source-code, is freely available and you can actually read the signatures in clear-text.
Genrally, the detector performs very naive checks to detect the compiler/linker/protector/etc which based on a preset mask of bytes. The mask is combined from a sequence of bytes ...
It's cl.exe that's inserting the jump thunk. It has some advantages, such as making it easier to redirect a function during runtime after load and makes it so that the loader only has to do a single relocation for that function. The other option would be to use an indirect call through an address. Neither is really optimal for performance due to the distance ...
Here is a perfect explanation how sysenter works: http://www.osronline.com/article.cfm?id=257
All native API calls from User Mode have a body that simply loads an index into EAX, executes SystemCallStub, and returns
SystemCallStub saves a pointer to the top of the User Mode stack into EDX and executes a SYSENTER instruction
SYSENTER disables ...
Would this driver exist in user space, or in kernel space?
Is it even possible for a non kernel mode driver to exist?
You can write a user-mode driver using the User-Mode Driver Framework, but that type of driver is effectively a user-mode service with access to some extra I/O functionality.
What we typically think of as a "driver" is a ...
I still think this will create a BSOD, what's more I think that this is deliberate. It makes perfect sense to assume that this is deliberate once piecing all the puzzle pieces together. The source incompatibility will inevitably force that the developer notices the change of type for KeNumberProcessors from PCCHAR to CCHAR. The likeliest error is: error ...
If they were all to external targets then it would be the stubs for external functions when dynamically loading dlls.
This way you can limit the amount of pages that need updating when a new dll get loaded. Which lets the calling code be position independent with regards to the call target. Calls to external function are sent to that page and forwarded to ...
courtsey Hotpatching and the Rise of
Third-Party Patches presentation at BlackHat USA 2006 by
What Is Hotpatching?
Hotpatching is a method for modifying the behavior of an
application by modifying its binary code at runtime. It is a
common technique with many uses:
debugging (software breakpoints)
So assuming like you said, you have the linear address of your device object, use the windbg extension !object 0xlinearaddress. Based on your windows build, it will display the linear address of the object header. Which in memory exists right below the object.
Use windbg to parse the OBJECT_HEADER structure for you. Starting with Windows 7 you are going to ...
Open Exports view in IDA (Views-->Open subviews-->Exports).
You'll see there one function name.
It is the real main function of the program (which is possibly not your main function, but your main function will be called somehow from it).
Actually you can not find main function by name because this information does not exist in the executable: the computer ...
The assumption does not hold true, as it is possible to alter page protection flags after you've allocated memory.
The usual mechanism for code injection on Windows is as follows:
Call OpenProcess for the target process, to get a handle that has appropriate access privileges.
Use VirtualAllocEx to allocate a buffer in the target process, with a set of ...
Injected code could represented by, but not limited to:
Remotely created thread could be detected by several techniques:
Periodically check if process threads were created by current process using NtQueryProcessInformation.
For each thread check if it is running from the address space of the original executable and not from some orphaned memory page:
As far as the screenshot depicts, I can say that you are on the right track. You have correctly, overwritten the Pointer to NextSEH and SE Handler.
Exception Registration Record Structure
typedef struct _EXCEPTION_REGISTRATION_RECORD
struct _EXCEPTION_REGISTRATION_RECORD *Next;
if you want to search references for intermodular functions (calls to dll libraries) , go to : searche for -> All intermodular calls.
if you want to search for all readable labels (including that every human readable function) go to : searche for -> Name in all modules , or current module.
Windows didn't do that; the MSVC compiler did that.
The content at __imp__printf is not the function's code; it's a pointer the function's code. Since it's a pointer (which is data, not code), it makes sense for the pointer value to be in a data segment, not in a code segment. More specifically, this pointer value is set at run-time by the loader, so the ...
IDA can only display functions in graph mode, so in order to see that code as a graph, you must:
Find the start of the function
Search for a prologue, such as push ebp, mov ebp, esp1, and find the start of the function. If it gets hard, you can always load debug symbols2 and find the start like that.
1: Actually, most Microsoft DLLs are compiled with the ...