Hot answers tagged

25 votes
Accepted

Check if exe is 64-bit

Executable type is indicated by PE header, download documentation. The first word (two bytes) of PE header indicates target machine, here is a list of possible values: 0x0000 - The contents of this ...
user avatar
  • 789
25 votes
Accepted

What kind of code would produce this assemby with loads of jump statements?

This looks like the output of Visual C++ linker in incremental linking mode. In this mode, the linker adds a section with incremental linking thunks (ILTs) at the start of the code section (.text), ...
user avatar
  • 34.9k
18 votes
Accepted

How to investigate Windows 32/64bit (WOW64) transition

The technique of jumping to 64bit code from a 32bit WOW64-ed process is commonly called "Heaven's gate" when performed manually. This is usually done to use 64bit features (such as manipulating 64bit ...
user avatar
  • 11.4k
15 votes
Accepted

windows - Why is the imagebase default 0x400000?

why is the default imagebase value 0x400000? From Peering Inside the PE: A Tour of the Win32 Portable Executable File Format: In executables produced for Windows NT, the default image base is ...
user avatar
14 votes
Accepted

What are the Vectored Continue Handlers

Unfortunately MSDN and windows API documentation is really scarce here, and I had difficulties finding anything other than the minimal description in MSDN. It turns out the Vectored Continue Handlers ...
user avatar
  • 11.4k
13 votes

Struggling between syscall or sysenter ( Windows )

The Intel and AMD instruction sets are similar but not identical. There are many examples of that: FMA3/FMA4, AMD-V and VT-x (and their extensions), etc. The fast system call interface is yet ...
user avatar
  • 632
12 votes
Accepted

Where is ntdll.dll?

The code below will set EAX to the image base address of ntdll.dll: MOV EAX, DWORD PTR FS:[30] ; EAX = PEB MOV EAX, DWORD PTR DS:[EAX+0C] ; EAX = PEB->Ldr MOV EAX, DWORD PTR DS:[EAX+1C] ; EAX =...
user avatar
11 votes

\??\C:\ Question Marks in Paths

I have been searching for an answer to this question for a while and I know this question is years old but on the off chance someone else comes across this question I will leave my response here. ...
user avatar
10 votes

Can IDA Pro on Linux disassemble a Windows PE (or Mac OS X app)?

Current IDA versions (as of 6.5) are pretty much equivalent for all three platforms. You can disassemble all file formats on all three platforms. You can definitely analyze PE and Mach-O files on ...
user avatar
  • 34.9k
10 votes

How tools like PEiD find out the compiler and its version.

The signature database of many Compiler and Packer detectors, and sometimes even their source-code, is freely available and you can actually read the signatures in clear-text. Genrally, the ...
user avatar
  • 8,649
10 votes
Accepted

Do I have to learn computer architecture for underestanding or doing reverse engineering?

The question is too broad, but I'll try to answer and hope that it will help. It depends on what exactly do you mean by computer architecture and area you applying your reverse engineering skills to. ...
user avatar
  • 7,875
9 votes

How does sysenter instruction in windows 7 work?

Here is a perfect explanation how sysenter works: http://www.osronline.com/article.cfm?id=257 In essence: All native API calls from User Mode have a body that simply loads an index into EAX, executes ...
user avatar
  • 336
9 votes
Accepted

Do all drivers exist in Kernel mode?

Would this driver exist in user space, or in kernel space? Kernel space. Is it even possible for a non kernel mode driver to exist? You can write a user-mode driver using the User-Mode Driver ...
user avatar
9 votes
Accepted

How to switch to "Graph View" in IDA Pro while debugging with WinDbg inside a system DLL?

IDA can only display functions in graph mode, so in order to see that code as a graph, you must: Find the start of the function Search for a prologue, such as push ebp, mov ebp, esp1, and find the ...
user avatar
  • 438
9 votes

How does the Windows Native API communicate with the kernel?

ntdll.dll is not privileged in any sense and can't do anything that your user mode library can't. So no, it doesn't have "permission" do directly call kernel-mode code and it doesn't do that. What it ...
user avatar
  • 632
9 votes

Trying to understand this construct in Dbgv.sys driver for DbgView tool

I still think this will create a BSOD, what's more I think that this is deliberate. It makes perfect sense to assume that this is deliberate once piecing all the puzzle pieces together. The source ...
user avatar
  • 10.5k
9 votes

What kind of code would produce this assemby with loads of jump statements?

If they were all to external targets then it would be the stubs for external functions when dynamically loading dlls. This way you can limit the amount of pages that need updating when a new dll get ...
user avatar
9 votes

Why does PE ImageBase address change in memory?

This is just a preferred address. Windows can load the binary at almost any address and rebase it to this new location. ImageBase: The preferred address of the first byte of image when loaded into ...
user avatar
9 votes

Do I have to learn computer architecture for underestanding or doing reverse engineering?

A solid understanding of the fundamentals of computer architecture is very useful for a Reverse Engineer. That said - it depends on your target. If you are reverse engineering a Java application or a ...
user avatar
  • 201
8 votes

What is the purpose of 'mov edi, edi'?

courtsey Hotpatching and the Rise of Third-Party Patches presentation at BlackHat USA 2006 by Alexander Sotirov What Is Hotpatching? Hotpatching is a method for modifying the behavior of an ...
user avatar
  • 391
8 votes
Accepted

How should I reach my shellcode?

As far as the screenshot depicts, I can say that you are on the right track. You have correctly, overwritten the Pointer to NextSEH and SE Handler. Some explanation: Exception Registration Record ...
user avatar
  • 595
8 votes

Finding address from function name

Ollydbg if you want to search references for intermodular functions (calls to dll libraries) , go to : searche for -> All intermodular calls. if you want to search for all readable labels (including ...
user avatar
  • 304
8 votes
Accepted

Why does windows put standard functions base address in Data Segment?

Windows didn't do that; the MSVC compiler did that. The content at __imp__printf is not the function's code; it's a pointer the function's code. Since it's a pointer (which is data, not code), it ...
user avatar
8 votes
Accepted

Batch disassembling DLL and EXE files?

If you have any version of Visual Studio or Visual Studio Build Tools installed, you have a powerful command line tool called dumpbin, which includes a disassembler option, available to you. dumpbin /...
user avatar
  • 301
8 votes
Accepted

Is there any way to get my own image base without calling any WinAPI functions, such as GetModuleHandle?

I can think of a couple of ways of doing that Scanning memory from EIP You could easily get the EIP of your own code without calling any APIs. There are a few ways to achieve that using inline ...
user avatar
  • 11.4k
8 votes

Why cant we find ransomware keys?

You really need to read up on public-key cryptography, methinks. The scheme - if properly (i.e. securely) implemented - could work somewhat like this: generate a public/private key pair on the ...
user avatar
  • 10.5k
7 votes
Accepted

How does the OS distinguish between executable types

The COM Descriptor Data Directory (DD 14) is used to lookup the COR20 structure. This is how you can tell the difference between a managed executable and a native executable. See this question for ...
user avatar
  • 1,561
7 votes

Check if exe is 64-bit

It's easier to check Optional Header magic number. For a valid exe, only two values are possible: 0x10B => PE32 => 32 bit 0x20B => PE32+ => 64 bit
user avatar
  • 221
7 votes
Accepted

Reverse Engineering of data structures in games

Side Note: WoW, or any comparable MMORPG, is probably a bad target for your research, because many of those feature various anti-hack, anti-cheat or anti-botting techniques, which will probably detect ...
user avatar
7 votes

Is not valid win32 application. Why?

There are many PE/header dumpers out there but as far as I know none is suitable for vetting an image; their goal is usually the extraction and display of information, not validation. The best ...
user avatar
  • 1,960

Only top scored, non community-wiki answers of a minimum length are eligible