0

ive recently dumped a few mem page sections of a possibly malicious dll. However, I can't analyze the files correctly since i don't know how to allign all the sections correctly for analysis at once in IDA. I can analyze them individually but many values are displayed in red under names like v123456789. Can someone guide me in the right direction?

2
  • If you can, dump the complete memory region of the dll, it'll save some trouble
    – Nordwald
    Apr 7, 2017 at 5:05
  • Unfortunately, this isn't possible as it seems that the module gets split and mapped into different parts of the process upon injection.
    – Bob Bobby
    Apr 7, 2017 at 11:14

1 Answer 1

2

If possible, please try to dump modules together.

If that is not possible, load any of them in IDA and go to File -> Load file -> Additional binary file to load each file one after another. After selecting the file, IDA will display the following dialog:

enter image description here

Here you have to make sure that each part is loaded at the right offset.

14
  • I have been doing this, however, my issue is trying to find the correct offset to load the next section at.
    – Bob Bobby
    Apr 7, 2017 at 11:15
  • @BobBobby I'm sorry, I'm afraid there is not much you could do about it other than regenerating the dumps with annotated offsets. There is no way for IDA to know how to align them.
    – Nordwald
    Apr 7, 2017 at 11:30
  • What do you mean by annotated offsets? Sorry if this is a stupid question, I'm sort of new to using IDA
    – Bob Bobby
    Apr 7, 2017 at 21:32
  • @BobBobby The term offset refers to their starting address in memory (e.g. page at 0x40000 should be loaded at that address)
    – Nordwald
    Apr 10, 2017 at 6:38
  • Okay thanks, sorry for misunderstanding. Do you know how I could go about finding the correct loading segment offset for loading the next bin file though?
    – Bob Bobby
    Apr 10, 2017 at 20:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.