0

I wish to set a breakpoint on a call to a specific windows API function, e.g.- RegQueryValueExA()

It is resolved at runtime in unknown stage of malware execution, and I wish to initiate manual debugging after this API is called.

Is there an easy way other from detecting the moment it is resolved? I have some other lazy-ass solutions but I guess that there's a proper approach to this issue.

  • There are a few ways for an application to fetch this API. One is obviously in the import table, and Windows does the job for you. The other is with GetProcAddress in which case you need to know the number of arguments and types beforehand and finally, this is the most interesting of them all. Using fs:[0x30] to get the address of the PEB and accessing it's Ldr member which is structure of type PEB_LDR_DATA which contains lists to all loaded modules, and then you can manually parse the module in question and checking the exports by name and fetching the address of the function. – farmdve Jan 23 '16 at 12:50
  • It might also be possible to read the registry using syscalls in which case you need the lower level functions. – farmdve Jan 23 '16 at 12:55
0

It sounds like you're asking two questions here:

  1. How to have your debugger break when RegQueryValueExA() is called?
  2. How to have your debugger break when the address for RegQueryValueExA is resolved?

For #1, you can just set a breakpoint on the first instruction of advapi32!RegQueryValueExA. Consult your debugger's documentation for how to set breakpoints.

For #2, you'd need to do the following:

  1. Find the index of RegQueryValueExA in the AddressOfNames array from advapi32.dll's IMAGE_EXPORT_DIRECTORY.
  2. Set a hardware-read breakpoint on the corresponding index in the AddressOfFunctions array from advapi32.dll's IMAGE_EXPORT_DIRECTORY.
  3. When the hardware breakpoint gets hit, examine the callstack to see if the address of RegQueryValueExA was being resolved by code in your target module. If not, wait until the breakpoint is hit again and check again. Otherwise, you've found the code in your target module that resolves RegQueryValueExA.
  • for #2, for which the malware is loading advapi32.dll dynamically, he'll have to break on the return from LoadLibrary first, in order to get the base address. – peter ferrie Jan 23 '16 at 16:29
  • @peterferrie: Correct. Or he could configure his debugger to break on new DLLs getting loaded. – Jason Geffner Jan 23 '16 at 19:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.