chentiangemalc
  • Member for 8 years, 7 months
  • Last seen this week
Is Null in Windows equal to zero?
6 votes

When looking at Windows API calls or disassembly of C/C++ code, NULL Is always 0, in Visual Studio this is defined in vcruntime.h #ifndef NULL #ifdef __cplusplus #define NULL 0 #else ...

View answer
x64dbg or alternative: Run to selection while storing all ran opcodes
Accepted answer
5 votes

On Windows Travel Debugging (TTD) is a perfect use case for this scenario. To use TTD, you need to run the debugger elevated. Install WinDbg Preview from Windows 10 store using an account that has ...

View answer
Stack-pointer analysis failed
Accepted answer
5 votes

When I assembled the code, the offending instruction was: 0x6c 40 ff d1 call rcx You will need to use Change Stack Pointer command in IDA to fix this in disassembly. As ...

View answer
Is it possible to download program database (PDB) files of Microsoft Windows binaries without installing any software?
4 votes

You can use PDB downloader which doesn’t require any installation https://docs.microsoft.com/en-us/archive/blogs/webtopics/pdb-downloader. Or you could use its source below to see how you could ...

View answer
Obfuscated VBE malware script analysis
4 votes

This script is mostly obfuscated through renaming of variables and function names. I recommend using a tool such as Visual Studio Code Where you can right click the variable or function and select ...

View answer
Is there a tool to reverse engineer UWP apps, similar to dnSpy for .NET?
3 votes

UWP is a container/platform, different reversing techniques are needed depending on the executable content. .NET UWP apps can be compiled to CLR, then you can use standard .NET decompilation ...

View answer
strtok called on char pointer at 0
Accepted answer
3 votes

This would be typical to see in use of strtok function. Example code from here #include <string.h> #include <stdio.h> int main() { char str[80] = "This is - www.tutorialspoint.com - ...

View answer
Why does this hooking function work and never cause a "backwards" jump?
2 votes

From the Intel 64 and IA-32 Architecture manual: Jump instruction — The JMP (jump) instruction unconditionally transfers program control to a destination instruction. The transfer is one-way; that is,...

View answer
IDA decompiler syntax: for function int __usercall sub_45BD46@ <eax>(char a1@<bl>, int a2@<esi>, int a3)
2 votes

Yes. If you have Hex Rays decompiler you can mouse over the decompiled version and will show RET is EAX. Generally in most x86 calling conventions return values are in eax. However need to be aware ...

View answer
Does Microsoft's C++ compiler add functions?
2 votes

The generated machine code is going to vary by compiler, and even within the same compiler depending on compiler optimization settings. Sometimes optimizations will "inline" functions, ...

View answer
Finding Code Reference String in MS-DOS 16-bit Executable with IDA Pro
2 votes

I found the code accessing the string using SoftICE for MS-DOS. To use I did the following: Add SoftICE driver as first entry in CONFIG.SYS DEVICE=C:\SICE\S-ICE.EXE /SYM 50 Launch program and Alt+...

View answer
Reverse old win32 app to find encryption vulnerability
2 votes

To work this out you need to understand how resources are loaded via Windows APIs. A number of APIs in kernel32.dll are commonly used such as: A number of APIs in Kernel32.dll are used for example: ...

View answer
Catch connection string between exe and mdb
2 votes

You can find the connection string with an API Monitor tool or Debugger. However first you will need to know are you looking at .NET based executable (i.e. has it loaded clr.dll or mscorlib.dll) and ...

View answer
Attach one debugger to a DotNet application, and a second one to a loaded DLL
Accepted answer
2 votes

The best way to debug this in my opinion is to use WinDbg from Windows SDK or WinDbg Preview from Windows Store. In Windows it is not possible to attach two debuggers to the same process. WinDbg ...

View answer
IDA Pro ignores condition in breakpoint
2 votes

You need to change the Actions from "Trace" to "Break" When the condition is true the action will execute.

View answer
reversing bytcode - trying to work decompiling expression
Accepted answer
2 votes

Thanks to response from Jongware who correctly identified this as reverse polish notation, which needed to be converted to "infix" Tested on some samples Original: 1) A=B * C+D-E/F 2) A=B * C+D/E-...

View answer
How do I find where in the code a particular Windows Resource is used?
1 votes

You can use conditional breakpoints with WinDbg using syntax similar to below, adjusting as necessary depending on specific APIs used. 32-bit Application (x86) bp /w "poi(@esp+8) == 2820" ...

View answer
what is metaData of assemblies and what is used for
1 votes

Type typical use of meta data in .NET assemblies is documented here Metadata describes every type and member defined in your code in a language-neutral manner. Metadata stores the following ...

View answer
Can't figure out a crash in IDA "The memory could not be read -> 00000710 (exc.code c0000005, tid 20612)"
1 votes

It is crashing because [EAX+28h] does not refer to a valid readable memory location. EAX = 6E8h + 28h = 710h which is not referencing a valid location. EAX is retrieved from memory location ...

View answer
Change manifest file using ResourceHacker CLI
1 votes

Your commands to correct replace the manifest are correct. The likely problem is you are corrupting the .res file; note this is a compiled binary format, you cannot just modify it in a simple text ...

View answer
Where to get started with reverse engineering a usb video device on Windows?
1 votes

First I would find the h/w device ID from device manager. i.e. USB\VID_045E&PID_0766. In some cases you can find existing open source drivers for closely matching device IDs and make them work ...

View answer
Calling MessageBoxW x64 confused about pointer
1 votes

First make sure you are using correct calling convention, in 64-bit Windows most APIs expect parameters via registers not push. An example of calling convention for 64-bit Windows: lea r9d, uType ...

View answer
I have a 16GB memory dump from Belkasoft RAM Capture, what free tools can I use to analyze it?
1 votes

Tools the can be used to analyze these files include Belkasoft Evidence Cente can extract remnants of conversations and communications occurring in social networks, chat rooms, multi-player online ...

View answer
Debug with IDA Pro right click option
Accepted answer
1 votes

Create a text file with content below and save as .REG file. Open .REG file to import into registry. Change the IDA cmd line as appropriate for your system. For more details refer to Microsoft's ...

View answer
VMware Tools list of all installed files with it
1 votes

First step in understanding installer is identifying what product the installer was created with, then look is there any known extract command lines. Tools such as Universal Extractor 2 can also help ...

View answer
Is there a way to confirm and decompress files that I suspect are compressed with a very early format of PKZIP?
1 votes

I would first confirm the file format. Without the entire file this is difficult. Recommend you run the application through a signature based identification program to identify matches. For example ...

View answer
Identify ldfld reference in .NET when parsing GetILAsByteArray
1 votes

This can be resolved using ResolveField method, fixed example. Note this example still has limitation in that it is failing to resolve fields where I need to specify genericTypeArguments and ...

View answer
please explain the difference between the two types of follow
Accepted answer
0 votes

"Constant" in this case does not refer to the common programming term "a value that should not be altered by the program during normal execution" In this scenario "constant&...

View answer
Windows 10 v.1803 boot failure after trying to install network kernel debugging with WinDbg Preview
0 votes

You need to use the correct ethernet cable. If you are connecting target directly to your debugger host you need to use a cross over cable, not a regular ethernet cable. Alternately if you don't have ...

View answer
How to know what does the function do?
0 votes

If you are building your own code to understand the assembly, I suggest you use your compilers options to output an assembly listing. For example: Microsoft Visual C++ Listing using /FA option GCC ...

View answer