0

I have two reports of static and dynamic malware analysis. There are some APIs of MSVCRT's dll in my static report, which are missing in the dynamic report. (such as _p_commode, _setusermatherr, etc.)

  • I don't know exactly if there are equivalent APIs in the dynamic report or not? Why are they missing in the dynamic report?
  • What is the relationship between the Windows API and the C run time library?
Improve this question
3
  • The Visual C/C++ runtime is implemented mostly based on the Windows API. You need to ask your dynamic and static reporting programs to know why symbols are missing.
    – Dr. Koutheir Attouchi
    Commented Jul 26, 2016 at 19:17
  • Dear blabb, Static analysis considers all paths in code,and dynamic analysis should execute at least one of them
    – Shirin
    Commented Jul 27, 2016 at 11:26
  • _p_commode is a variable, not an "API". presumably your dynamic report only includes functions. In any case, this question is almost impossible to answer without seeing the reports and knowing how they were produced.
    – Igor Skochinsky ♦
    Commented Jul 28, 2016 at 18:01

1 Answer 1

Reset to default
3

To answer the main question, some C functions call WinAPI functions. Some don't.

There are things that you have to call WinAPI function for. (e.g. exit()) There are things that you have convenient WinAPI for, but can implement as pure C, so it depends on the library.

Improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.