New answers tagged

1 vote
Accepted

Understanding disassembly information from Visual Studio's dumpbin and GNU's objdump

Let's break it down. The first and most obvious difference is Intel syntax (dumpbin) vs. AT&T syntax (objdump) for the output you give. That's be the part of your question: Also why is the ...
user avatar
  • 10.5k
1 vote
Accepted

How to load a PDB file into x64dbg?

You can use symload/loadsym command. In the x64dbg console type: symload pdbconsoleapplication1,symbols\pdbconsoleapplication1.pdb,[0/1] With the last argument, you can control if the validation of ...
user avatar
0 votes

Frida hook multiple processes

This is called child-gating and frida has a very good example Here is a demo with a simple application. A simple C program with a fork and we try to hook puts for both child and parent. (test3) [frida-...
user avatar
  • 2,335
1 vote
Accepted

What are these Device Object Characteristics / Flags in Windows 10 ntoskrnl!IopParseDevice

Hmm, not sure which WDK you were using, but at least the Windows Kits\10\Include\10.0.22000.0\km\ntifs.h and Windows Kits\10\Include\10.0.22000.0\km\ntddk.h of the newest (non-preview/beta) WDK list: #...
user avatar
  • 10.5k
0 votes

IDA show xrefs in .pdata and nothing else

These functions look like exception handlers and are probably “called” by the processor when an exception or a fault happens. You need to inspect system registers to determine the cause of the ...
user avatar
  • 34.6k
0 votes

Advice about first steps on reversing windows kernel

Note that if you're actually interested in the heap manager, it's part of the runtime and has nothing to do with kernel functionality, for instance: HeapAlloc() from kernel32.dll forwards to ...
user avatar

Top 50 recent answers are included