0

I am studying to analysis malware..

While to analysis a malware using IDA, I want to rename array to API Name.

To Help your understanding, attached image. enter image description here

Please help.

Thank you

1 Answer 1

0

You can convert it to structure, this will produce much more readable code.

In order to do this you have to do the following:

  1. Create a structure in structures window, according to the size of array, create there corresponding number of fields (Open window, press INS, use d key to add fields).
  2. Rename structure fields according to API names, and set their type as function pointers with Y key. For example for GetProcAddress field it will look like _DWORD (__stdcall *pGetProcAddress)(_DWORD, _DWORD); - it is a standard definition of C function pointers with small addition of __stdcall marker of the calling convention.
  3. Set your a1 variable type to the created structure (In decompiler window locate cursor on your a1 variable, press Y and enter the structure name)

Let me know if you need more detailed walkthrough.

As an alternative for defining structure inside IDA (bullets 1 and 2) you can write a header file with something similar to the following (btw, see the type definitions in the structure):

struct apis
{
  void* (__stdcall *pGetProcAddress)(_DWORD, _DWORD);
  _DWORD (__stdcall *pSetErrorMode)(_DWORD);
  _DWORD (__stdcall *pGetTempPathA)(_DWORD, _DWORD);
  _DWORD (__stdcall *pGetTempGileNameA)(_DWORD *, _DWORD *, _DWORD, _DWORD *);
};

and import it into the IDB with Ctrl+F9. You can find and edit this structure in Local types window (Shift+F1).

7
  • I completed step1, But I can't set their type as function pointers.. Press Y and then I don't know What I input.. in box[Please enter a string]. thank you sir.
    – ByeongJae
    Commented Mar 15, 2017 at 8:19
  • Answer updated. Do you have definitions of HMODULE and LPCSTR types in your IDB ?
    – w s
    Commented Mar 15, 2017 at 8:26
  • No, I don't have HMODULE and LPCSTR..
    – ByeongJae
    Commented Mar 15, 2017 at 8:35
  • So use _DWORD as a parameters.
    – w s
    Commented Mar 15, 2017 at 8:36
  • Thank you so much!and, I setted Function Pointer,, and then I will set a1,,I know to set structure using Alt+Q, but you said Y! then What I input there?
    – ByeongJae
    Commented Mar 15, 2017 at 8:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.