0

I wish to set a breakpoint on a call to a specific windows API function, e.g.- RegQueryValueExA()

It is resolved at runtime in unknown stage of malware execution, and I wish to initiate manual debugging after this API is called.

Is there an easy way other from detecting the moment it is resolved? I have some other lazy-ass solutions but I guess that there's a proper approach to this issue.

Improve this question
2
  • There are a few ways for an application to fetch this API. One is obviously in the import table, and Windows does the job for you. The other is with GetProcAddress in which case you need to know the number of arguments and types beforehand and finally, this is the most interesting of them all. Using fs:[0x30] to get the address of the PEB and accessing it's Ldr member which is structure of type PEB_LDR_DATA which contains lists to all loaded modules, and then you can manually parse the module in question and checking the exports by name and fetching the address of the function.
    – farmdve
    Jan 23, 2016 at 12:50
  • It might also be possible to read the registry using syscalls in which case you need the lower level functions.
    – farmdve
    Jan 23, 2016 at 12:55

1 Answer 1

Reset to default
0

It sounds like you're asking two questions here:

  1. How to have your debugger break when RegQueryValueExA() is called?
  2. How to have your debugger break when the address for RegQueryValueExA is resolved?

For #1, you can just set a breakpoint on the first instruction of advapi32!RegQueryValueExA. Consult your debugger's documentation for how to set breakpoints.

For #2, you'd need to do the following:

  1. Find the index of RegQueryValueExA in the AddressOfNames array from advapi32.dll's IMAGE_EXPORT_DIRECTORY.
  2. Set a hardware-read breakpoint on the corresponding index in the AddressOfFunctions array from advapi32.dll's IMAGE_EXPORT_DIRECTORY.
  3. When the hardware breakpoint gets hit, examine the callstack to see if the address of RegQueryValueExA was being resolved by code in your target module. If not, wait until the breakpoint is hit again and check again. Otherwise, you've found the code in your target module that resolves RegQueryValueExA.
Improve this answer
2
  • for #2, for which the malware is loading advapi32.dll dynamically, he'll have to break on the return from LoadLibrary first, in order to get the base address.
    – peter ferrie
    Jan 23, 2016 at 16:29
  • @peterferrie: Correct. Or he could configure his debugger to break on new DLLs getting loaded.
    – Jason Geffner
    Jan 23, 2016 at 19:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.