1

I am currently analyzing some malware which loads a DLL from an embedded resource and executes it. Normally I would dump the DLL and create a separate database for the DLL. However, I am running into an issue since the unpacker passes a structure to the DLL through DllMain (it still passes three arguments they just mean different things and the DLL accounts for this). The dll will not load properly if it is not loaded by the unpacker since it needs the information contained in this structure in order to run properly and will fail with an error code.

What I would like to do is define both the unpacker and the DLL in the same IDB since the DLL is always loaded at the same address I would like to be able to set a breakpoint on DLLMain and then run the unpacker. The unpacker would then decrypt and load the dll at that address and then I would be able to debug it from the DllMain I can do this fine just using the debugger, but I would like to have both the executable and the dll defined in my idb to make analysis easier and so that I can have my comments and other things saved in the IDB. Also the injected code is not analyzed by IDA which makes the disassembly hard to read.

My question then is how do I do this? I took a memory snapshot after the dll is loaded, but before it is run and then saved that in a loadable segment, but IDA is not recognizing the file as a DLL. What should I do to get it so IDA recognizes both the embedded DLL and the executable in the same file. The DLL is not identified by IDA as a module or anything since it is not loaded by loadlibrary. I have been searching for hours trying to figure this out without making any decent progress whatsoever.

  • Okay, so, what you need to do is configure the debugger to run the unpacker and then configure the input file as the dll which gets unpacked. The one issue I did run into is that the first byte of the instruction in DllMain was set to zero for some reason and the actual value was suppose to be different, but I just patched this out and it is running fine. – RudyOnRails Dec 18 '16 at 18:50
  • I would still be interested in finding a better solution because I do not really like this one... – RudyOnRails Dec 18 '16 at 18:51
1

You need to mark the memory segments you want to be retained as loader segments:

http://www.hexblog.com/?p=8

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.