Hot answers tagged

5

I think I got it. GetWindowLongPtr(hWnd, -1) returns a pointer to a nested struct that is a part of the WND struct (that contains main information about a window.) There's really no official name for it, but judging by this function name in comctrl32: I'd define it as such: struct WF{ WF_STATE state; WF_STATE2 state2; DWORD ExStyles; //With ...


5

Is there any way to detect from the driver that this process is protected ? Disclaimer: This following procedure depends on undocmented data structure which is extracted from PDB symbol of combase.dll file. As usual this may not work in future Windows OS version. This is the sample C code to detect protected process. The program accepts a valid process ID ...


4

Now, this can't be a full-fledged answer from A to Z, unfortunately. But for COM there are only a few steps that are really specific to COM. The project you linked clearly has reverse-engineered the interfaces (elvint.h). What this means first and foremost is that the names of the interfaces needn't necessarily match what Microsoft called them (in your case ...


4

It seems the correct term is Critical System Service. There are API from userland but I can't find anything for the kernel. So I took a quick look into the RstrtMgr.dll and it seems the list is actually hardcoded... For the processes: system32\csrss.exe system32\smss.exe system32\lsass.exe system32\wininit.exe system32\logonui.exe system32\services.exe ...


4

I find it really disturbing that in an official university class there are no proper safety guidelines and procedures for students before dealing with actual malware. This is super risky and should be dealt with accordingly. However, here are a few steps to make your task safer and easier: Building a malware lab: You can follow the full procedure here by ...


3

ASLR does not peer inside executable it is a system wide exploit mitigation technique basically and simply put it assigns a random base address on every load of every executable that is if you run say calc.exe five times you may see calc.exe load at five different addresses C:\>cdb -c "lm m calc;q" calc | grep "calc.*deferred 00dd0000 00e90000 ...


3

You may consider reading Practical Malware Analysis Book which describes in depth malware analysis process and techniques and contains in depth answers to your questions. Chapter 3 briefly describes tools you may use to monitor changes made by malware.


3

prototype of DispatchMessage() is LRESULT DispatchMessage( const MSG *lpMsg ); it takes only a pointer to struct MSG which has a hwnd as its first typedef struct tagMSG { HWND hwnd; UINT message; WPARAM wParam; LPARAM lParam; DWORD time; POINT pt; DWORD lPrivate; } MSG, *PMSG, *NPMSG, *LPMSG; this hwnd is validated and the ...


3

well the answers out there are good this is just an addition to show how you could arrive using windbg in command line dbh is an utility in windbg installation that can load any binary and provide a lot of static information using it and the command line version of windbg cdb.exe you can get the methods in two commands (notice the method names are ...


3

Those functions are exported from ntdll.dll file. To link with those functions, add #pragma comment (lib, "ntdll.lib") in the source file. Or in Visual Studio, first check the active Configuration and Platform. Then add the library in Project > Properties > Linker > Input > Additional Dependencies. For example, like this %(AdditionalDependencies); ntdll.lib. ...


2

This is just an extension of @0xC0000022L's answer. For this question, I will explain ICMLuaUtil COM interface below because IFileOperation COM interface is in shell32.dll, too big ;) You mentioned the wrong CLSID. Here I provide a list of them: GUID CLSID_CmstpLua = {3E5FC7F9-9A51-4367-9063-A120244FBEC7} GUID IID_ICmstpLua = {6EF07F29-F9B8-4DA4-B59E-...


2

You can use Ida's Appcall functionality: Appcall is a mechanism to call functions inside the debugged program from the debugger or your script as if it were a built-in function. Such a mechanism can be used for debugging, fuzzing and testing applications. Appcall mechanism highly depends on the type information of the function to be called. For ...


2

I think this is the reason why there are some WinAPIs that also existing in kernelbase.dll. "As an example of functionality that we moved to low-level binaries, kernelbase.dll gets functionality from kernel32.dll and advapi32.dll. This means that the existing binary now forwards calls down to the new binary rather than handling them directly; the ...


2

If you do not need all of the current program's state (for example the state of the stack, register values, or open handles), then you can try dumping to a new executable and setting the EntryPoint to the current EIP. OllyDumpEx (https://low-priority.appspot.com/ollydumpex/) is commonly used for this purpose for malware analysis. Despite its name, it is a ...


2

In long mode, segmentation is not really used and all segment registers have base of 0. fs and gs are exceptions that were added to address thread-specific data. Their real base addresses are stored in MSRs (model specific registers) instead of the descriptor table. The MSRs are only accessible in kernel mode, but you can get the value of GS indirectly via ...


2

gs is kernel mode only you can see the data in windbg if you are in a kd session 0: kd> ? @@c++(@$pcr->GdtBase) Evaluate expression: -8781100130384 = fffff803`7da55fb0 0: kd> dq gs:[0] l1 002b:00000000`00000000 fffff803`7da55fb0 __readgsword() is an intrinsic it must have some magic :) 1: kd> rdmsr c0000101 msr[c0000101] = ffffe601`555ea000 ...


2

when you are in kd session lm displays both kernelmode modules and user mode modules use lm u to display only usermode modules this will be consistent with the !vad display kernel mode modules aren't associated with a single process and as such they are not a part of processes virtual address descriptor table obviously you can get the pte for any ...


2

For analysing RPC I use mIDA: mIDA is a plugin for the IDA disassembler that can extract RPC interfaces from a binary file and recreate the associated IDL definition. mIDA is free and fully integrates with the latest version of IDA (5.2 or later). Note that mIDA doesn't work with most recent version (64 bit version) of IDA but requires 32 bit version (6.95 ...


2

"File" -> "Parse C Source..." ... then parse the ddraw.h But warning it doesn't work as smooth as expected. I could only get small headers to parse correctly. A good video about it: https://www.youtube.com/watch?v=u15-r5Erfnw Maybe you could ask that guy on Github to include the ddraw.h into his data type collection: https://github.com/0x6d696368/ghidra-...


2

This technique is equivalent to the Structured Exception Handler for Windows. The application registers an exception handler, then forces an exception to occur, thereby transferring control to the exception handler. However, when a debugger is present, it will generally intercept the exception to allow user interaction. If your debugger allows you to pass ...


2

We cannot deduce it from the fragment of code you have provided (unless we are @Igor Skochinsky of course). However, we can notice a few things: ppMalloc contains the address of dynamically allocated array of function pointers the function called by call [bx+0Ch] takes three arguments passed by stack: 0, 34h (offset?) and a pointer to the address of that ...


2

My guess is that ppMalloc is a pointer to an instance of the IMalloc COM interface (e.g. it was initialized by a call to CoGetMalloc), which means the the first pointer in it (loaded by the les instruction) is the VTable which has the following methods. First three are inherited from IUnknown, the parent of all COM objects: +00 QueryInterface +04 AddRef ...


2

without any supporting context the -c will be treated as 0xc and it will be subtracted from the address resolved by win32k!impPsIsThreadTerminating+0xe4 be aware the 0xe4 is will be properly relevant most of the times only if you have an unoptimized build. because after optimization functions can and will be divided into chunks by the compiler ...


2

Pretty much, they will all eventually read the PEPROCESS object directory. Maybe not, depends on what you're trying to hide from. If it's just some basic usermode process iteration then you're probably fine. There's quite a few ways to iterate the process object directory though, such as ZwGetNextProcess. Your best bet would probably be ObRegisterCallbacks ...


2

When does the PE loader fill in the IAT? The IAT is updated at load time by the PE Loader [1], this is called Load-time dynamic linking, as opposed to Run-time dynamic linking, where LoadLibrary/GetProcAddress are necessary. Hooking an API not included in Import Address Table There are several ways to do that actually, and Export Address Table hooking is ...


2

Look for the writes to the qword_18009FBD0 to see where it's initialized. Apparently it's a part of an array called __encodedKERNEL32Functions where various pointers to kernel32 functions are stored after being XORed with __security_cookie. You can rename the pointer to the kernel32 function's name to better see what is happening: ;(from ...


2

There are many steps to patch an executable, but here is I think the easiest one. The highlighted one is the EntryPoint, you can patch the highlighted one and redirect it to your control, in my sample, I added a new executable section but remember, you have to return the control to the original program, or else it will not run properly. Original Section ...


1

The steps i take when analyzing malware sample are: check file in cff explorer. (entrypoint section, weird section names, overlay size etc) open sample in Detect It Easy to see if its packed or not, and if so which packer is used. unpack it. Analyze unpacked sample in IDA to see what I'm dealing with. Of course, you have to make a snapshot of your system ...


1

Yes, you can actually debug remotely using 2 Virtual Machines as long as they have network connection. Just copy the server file in the dbgsrv folder from IDA directory and choose what type of architecture you will debug. Just make sure you have to change the permission of the file to executable using chmod +x


1

I think your approach of looking up the callstack is generally sound, but might be too time consuming. As you have no doubt experienced, without debugging information it can be challenging even to piece together what the different frames are, before trying to determine if any of those functions are relevant. The crucial function deciding whether to call ...


Only top voted, non community-wiki answers of a minimum length are eligible