Timeline for How to analyze dumped process?
Current License: CC BY-SA 4.0
6 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jul 23, 2021 at 11:36 | vote | accept | ManJaro | ||
| Jul 23, 2021 at 11:36 | comment | added | ManJaro | Thanks a lot!!!! finally it works .... I just change the EP to point directly to malicious code and IDA analyzes it successfully .... | |
| Jul 23, 2021 at 10:34 | comment | added | Guillaume | To dump it in x64dbg: Right click on the memory map segment that contains your dump, and 'save to file' | |
| Jul 23, 2021 at 10:33 | comment | added | Guillaume | Take a look at the first paragraph of my answer. You basically are at the fourth dot, right before/after the ResumeThread call. You just have to dump this process on disk to obtain a copy of the injected process. It either one of those method: you copy the injected content when it is about to be written in memory (WriteMemory call) to a new file, or you dump the memory space of the injected process (before the ResumeThread call). You then fix the alignment if it needs to, and you'll be able to load it in IDA as a regular file. | |
| Jul 23, 2021 at 10:24 | comment | added | ManJaro |
Thanks for your reply. I'm trying to reverse Andromeda V2.6 (MD5: 9ea65c7a034e2fab37cf414de18aea1e ). I got svchost.exe injected process and successfully got the entrypoint of new thread (injected code I mean). My point is How to load this thread into ida to analyze it statically
|
|
| Jul 23, 2021 at 9:33 | history | answered | Guillaume | CC BY-SA 4.0 |