0

ive recently dumped a few mem page sections of a possibly malicious dll. However, I can't analyze the files correctly since i don't know how to allign all the sections correctly for analysis at once in IDA. I can analyze them individually but many values are displayed in red under names like v123456789. Can someone guide me in the right direction?

  • If you can, dump the complete memory region of the dll, it'll save some trouble – Nordwald Apr 7 '17 at 5:05
  • Unfortunately, this isn't possible as it seems that the module gets split and mapped into different parts of the process upon injection. – Bob Bobby Apr 7 '17 at 11:14
2

If possible, please try to dump modules together.

If that is not possible, load any of them in IDA and go to File -> Load file -> Additional binary file to load each file one after another. After selecting the file, IDA will display the following dialog:

enter image description here

Here you have to make sure that each part is loaded at the right offset.

  • I have been doing this, however, my issue is trying to find the correct offset to load the next section at. – Bob Bobby Apr 7 '17 at 11:15
  • @BobBobby I'm sorry, I'm afraid there is not much you could do about it other than regenerating the dumps with annotated offsets. There is no way for IDA to know how to align them. – Nordwald Apr 7 '17 at 11:30
  • What do you mean by annotated offsets? Sorry if this is a stupid question, I'm sort of new to using IDA – Bob Bobby Apr 7 '17 at 21:32
  • @BobBobby The term offset refers to their starting address in memory (e.g. page at 0x40000 should be loaded at that address) – Nordwald Apr 10 '17 at 6:38
  • Okay thanks, sorry for misunderstanding. Do you know how I could go about finding the correct loading segment offset for loading the next bin file though? – Bob Bobby Apr 10 '17 at 20:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.