What does it mean to define a thread as modal? For some reason I this isn't specified in the docs. I have checked the docs for ComponentDispatcher.PushModal() and all it says it that the current thread will be set to modal. It provides no insight of what it means to actually set a thread to be modal. What does it mean for a thread to be modal in terms of execution and message loops?
I'm not sure if anybody else has noticed this, but when I decompiling .NET binaries and look into a function in DNSPY and set a breakpoint on a function and then step one instruction once the breakpoint is hit. Instead of returning me to the executable data of the function, it returns me to some internal function. This doesn't just happen with one function, this happens to multiple. How does this happen?
Here is the signature of the function
[SecurityCritical]
[SuppressUnmanagedCodeSecurity]
[DllImport("user32.dll", CharSet = CharSet.Auto)]
public static extern IntPtr DispatchMessage([In] ref MSG msg);
Here is the location of where it is being called
[SecurityCritical]
private void TranslateAndDispatchMessage(ref MSG msg)
{
if (!ComponentDispatcher.RaiseThreadMessage(ref msg))
{
UnsafeNativeMethods.TranslateMessage(ref msg);
UnsafeNativeMethods.DispatchMessage(ref msg);
}
}
I set breakpoint on UnsafeNativeMethods.DispatchMessage(ref msg); and then step into the function once the breakpoint is hit. It takes me to a function called SubClassWndProc which is weird because I would've assumed that it would take me to DispatchMessage. Why?
EDIT: Extra information
I'm not sure if anybody else has noticed this, but when I decompiling .NET binaries and look into a function in DNSPY and set a breakpoint on the return instruction and then step one instruction once the breakpoint is hit. Instead of returning me to where the function was called, it returns me to some internal function. This doesn't just happen with one function, this happens to multiple. How does this happen?
I'm not sure if this stretched the rule of unrelated topics on this subreddit but I think this should be appropriate as it is related to debugging and that is a core part of programming. If this has broken the rules you are welcome to downvote me.
I have been using dnspy to reverse engineer .NET binaries quite often now and I often need information which is accessible with windows API calls. I know it is possible to use some WIN API calls outside of the process and get information but some API calls have to actually be directly executed in the process. I am wondering if dnspy has any built in feature for running windows API functions in the current thread which I am debugging. Many thanks.
I want the source code of popular dll files on windows like user32.dll kernelbase.dll etc etc without having to use a decompiler. Decompiling isn't exactly the cleanest option so I am wondering if microsoft openly discloses source code for their dll files.
I have been using dnspy to reverse engineer .NET binaries quite often now and I often need information which is accessible with windows API calls. I know it is possible to use some WIN API calls outside of the process and get information but some API calls have to actually be directly executed in the process. I am wondering if dnspy has any built in feature for running windows API functions in the current thread which I am debugging. Many thanks.
What does it mean for a URI to have a semicolon in the middle of it. I am looking at a URI which tries to access a certain PATH on my system. The path is the following: "/FreemakeVideoConverter;component/app.xaml". I am wondering what the semicolon does in the middle of the path. I have found little to no information about this online
I've noticed when I'm decompiling in ghidra I see a lot of THUNK functions. I've noticed that most of these functions just return 0. What are the point of these functions. Are they actually inserted by the compiler, if so why are they inserted if some of them just return 0?
I've noticed whenever any thread reaches a certain breakpoints all other threads get suspended. Is there any way to disable this behavior. Thank you in advance.
Whenever I check ffmpeg's hall of shame all I see is "Shame page will be offline until entries are updated.". This has been happening for a few weeks at this point so when will the hall of shame be back up?
I want to hear how you guys use AI. How much do you think I should rely on AI for reverse engineering and what should I not do to hinder my learning? What type of questions should I ask it? What are some things that I shouldn't get the AI to do and always to myself? I am wondering how some experienced folks in reverse engineering use AI.
I am looking for a static analysis tool which I can use to statically analyze and debug at the same time. I'm tired of having to have two applications open at the same time and having to match addresses with ASLR and even when I disable ASLR for programs they don't run properly because some will raise errors if run without ASLR so I am wondering if anyone knows any good static analysis tools along with a debugger?
I've noticed some of the binaries which I am decompiling are using classes and objects under the hood which are being wiped out once they are compiled. I am wondering whether learning OOP and what happens once you compile binaries with objects with methods and constructors will be beneficial?
I've noticed that it can vary a lot finding main depending on the format of the binary and even if I am reverse engineering a binary format which I have worked with quite a bit sometimes I run into these weird entries where I can't find main logic. Any tips and why is there so much variation?
I am reverse engineering this software and am trying to find the main logic. I thought it would be easier to just run it through a debugger and then view what memory address it is at and then jump to it in ghidra. What I noticed is that it is in some DLL file. I want to find out how I can see the decompilation of this DLL file in ghidra. I remember being able to decompile a DLL by finding out that a certain function used a dll and then associating that dll with ghidra. Not sure where to find the specific DLL that I want though.
EDIT: I noticed that people were finding this post confusing to read so I changed it to hopefully make it easier
I have started to reverse engineer PE binaries in windows after moving away from ELF binaries and have wondered What is a handle in windows? I have googled the question and found it is an index that points to a certain element in the handle table. And the handle table points to a datastructure. How does that data structure link with the actual object that the handle points to? Please correct me if my understand is incorrect.
I want a cheap device which I can practice reading spi flash memory and using ghidra to reverse engineer binaries that live on the firmware. I am wondering if anyone knows of any cheap devices which I can use to reverse engineer and learn. This is going to be my first device which I have actually reverse engineered. I have reverse engineered some openwrt firmware with ghidra but not that much, so I want something that is beginner level.
I've always loved low level stuff since I started computer science and have been wondering most of the vulnerabilities which I have seen on reddit are web vulnerabilties and nothing that is actually flawed locally on your machine. This has raised some self doubt because it is lowering my confidence of low level bug bounty hunting since no one is doing it. I am wondering is this even viable. I truly love doing low level reverse engineering and binary analysis and really want to get into the bug bounty field but just don't know if it is going to work out.