0

I have two reports of static and dynamic malware analysis. There are some APIs of MSVCRT's dll in my static report, which are missing in the dynamic report. (such as _p_commode, _setusermatherr, etc.)

  • I don't know exactly if there are equivalent APIs in the dynamic report or not? Why are they missing in the dynamic report?
  • What is the relationship between the Windows API and the C run time library?
  • The Visual C/C++ runtime is implemented mostly based on the Windows API. You need to ask your dynamic and static reporting programs to know why symbols are missing. – Dr. Koutheir Attouchi Jul 26 '16 at 19:17
  • Dear blabb, Static analysis considers all paths in code,and dynamic analysis should execute at least one of them – Shirin Jul 27 '16 at 11:26
  • _p_commode is a variable, not an "API". presumably your dynamic report only includes functions. In any case, this question is almost impossible to answer without seeing the reports and knowing how they were produced. – Igor Skochinsky Jul 28 '16 at 18:01
3

To answer the main question, some C functions call WinAPI functions. Some don't.

There are things that you have to call WinAPI function for. (e.g. exit()) There are things that you have convenient WinAPI for, but can implement as pure C, so it depends on the library.

Not the answer you're looking for? Browse other questions tagged or ask your own question.