Process Dumping and Ida

Question

Up until now I've been performing static analysis using Ida and run time analysis using OllyDBG.

I've identified a function in Olly which I would like to start documenting further in Ida, however I can't seem to find the function in Ida, and the executable doesn't appear to be packed or obfuscated.

What could cause this? (besides user error :p)

I've heard of dumping a process to memory, then performing static analysis on that dump file - would this make sense in the current context?

What differences would there be compared to just looking at the executable?

Does the software used to dump the process effect it's structure - are there different types of process dumps?

How would I actually go about opening the dump file in Ida?

Answer 1

If your binary is allocating a new memory page & writing code on it, that's something you won't see on the static binary. Performing a full dump of the process from memory and loading this new binary into IDA will indeed show you those new parts. The data has to come from somewhere though (ressource, compressed, encrypted, another file, Internet, etc).

As you mentioning that the binary appears to be neither packed nor obfuscated, be sure to check you're not just into one of the loaded DLL of your binary (reversing one of the imported DLL might not be what you're willing to do?).