Questions tagged [windows-10]
The windows-10 tag has no summary.
42 questions
0 votes
1 answer
91 views
How to manual copy mp4 file?
I have tried using some popular editors like: sublime text, notepad++ to open mp4 file and after copy content of it. After copy, I added the mp4 extension to the newly copied file. As a result, the ...
- 333
0 votes
0 answers
71 views
Reversing SYSTEM Process
I'm doing some vulnerability research against a Windows server application that serves some update files that clients can download. Using TcpView/netstat, I can see that there is an open port ...
- 3
0 votes
0 answers
86 views
Why is Windows 10 still blocking me from running malware?
I am analyzing some malware on Windows 10. I installed FLARE VM, disabled tamper protection and disabled the virus scanner in the registry. However when I attempt to run a malware, Windows is still ...
- 131
5 votes
1 answer
414 views
Why is function in kernel32.dll jumping into a api-ms-win-core stub
I was trying to look into the implementation of GetVersion function in kernel32.dll. I was surprised to see that the GetVersion thunk is issuing a jump to API-MS-WIN-CORE-SYSINFO-L1-1-0.DLL::...
- 205
-1 votes
1 answer
220 views
My IDA have 2 different address for same code How to change it
I am a novice for use ida pro and I do not know I change some settings that are maked left analyse address wrong.How I fix it?Thanks
- 1
1 vote
0 answers
106 views
How to reverse an import function?
I'm reversing windows .sys file and an import function RtlLookupEntryHashTable appears in my target functions. I want to know the pseudocode of it. How to achieve this? .text:00000001C00218C2 ...
- 313
2 votes
1 answer
179 views
Getting "Flow analysis was incomplete, some code may be missing" on WinDbg
I wanted to perform static analysis on the Win32 function CreateFileW, so I loaded kernel32.dll using WinDbg and perform the command uf kernel32!CreateFileW. But I am seeing the following output ...
- 205
3 votes
0 answers
262 views
Why can't I view certain USER32.dll API calls in the disassembly?
I'm trying to understand and patch the GUI in Microsoft Edge. When I look at the disassembly in 2 different debuggers (x64dbg and cutter), the API calls responsible for much of the GUI functionality ...
- 31
2 votes
1 answer
462 views
Windows UI freezes except the debugger itself when a breakpoint is hit in every debuggers I tried on a particular application
I'm trying to "trace" (just setting breakpoint, step in, step over to know how certain things work) an application. But if the application enters suspended state by using breakpoint, every ...
4 votes
1 answer
1k views
Is it possible to fake being joined to a domain in Windows 10?
I'm dealing with a malware sample from a pentest that will only execute properly if the system is a member of the target organization's Windows Active Directory domain. Rather than standing up my own ...
- 151
3 votes
2 answers
1k views
Is there a way to decompress a Fody-Costura generated exe in c#?
There is a program that is possibly a RAT, and I would like to view the source code. After opening the .exe in dnSpy, I was able to tell that it was compressed with Fody-Costura. (https://github.com/...
- 35
0 votes
0 answers
1k views
Ghidra unable to find the JDK
Unzipped the ghidra application. When I run the .bat file I get the following message LaunchSupport expected 2 to 4 arguments but got 1 LaunchSupport expected 2 to 4 arguments but got 1 LaunchSupport ...
1 vote
0 answers
89 views
Finding which binary (library, driver, etc) caused an event log
I found some events in the Windows Event Log, and I was wondering which binary caused them. The event I am curious about is Event ID 27 from Hyper-V Hyper-V launch failed; the Hyper-V boot loader was ...
- 89
-1 votes
1 answer
2k views
A Process does not list on x64dbg attach list
I'm learning RE with x64dbg on Windows10. It does not list a process in the running process list that I want to attach. The Process is running 32-bit crackme application for learning. It was created ...
- 141
2 votes
0 answers
155 views
Figuring out Win10 ShellMenuHost/StartMenuHost cache data relation for Tiles
I have a weird bug that causes this crap: There are plenty of dumb "solutions" a-la "turn it off and on" but none of them work and/or relevant, the shell apps simply refuse to ...
- 141