ive recently dumped a few mem page sections of a possibly malicious dll. However, I can't analyze the files correctly since i don't know how to allign all the sections correctly for analysis at once in IDA. I can analyze them individually but many values are displayed in red under names like v123456789. Can someone guide me in the right direction?
2
-
If you can, dump the complete memory region of the dll, it'll save some trouble– NordwaldApr 7, 2017 at 5:05
-
Unfortunately, this isn't possible as it seems that the module gets split and mapped into different parts of the process upon injection.– Bob BobbyApr 7, 2017 at 11:14
Add a comment
|
1 Answer
If possible, please try to dump modules together.
If that is not possible, load any of them in IDA and go to File -> Load file -> Additional binary file to load each file one after another. After selecting the file, IDA will display the following dialog:
Here you have to make sure that each part is loaded at the right offset.
-
I have been doing this, however, my issue is trying to find the correct offset to load the next section at. Apr 7, 2017 at 11:15
-
@BobBobby I'm sorry, I'm afraid there is not much you could do about it other than regenerating the dumps with annotated offsets. There is no way for IDA to know how to align them.– NordwaldApr 7, 2017 at 11:30
-
What do you mean by annotated offsets? Sorry if this is a stupid question, I'm sort of new to using IDA Apr 7, 2017 at 21:32
-
@BobBobby The term offset refers to their starting address in memory (e.g. page at 0x40000 should be loaded at that address)– NordwaldApr 10, 2017 at 6:38
-
Okay thanks, sorry for misunderstanding. Do you know how I could go about finding the correct loading segment offset for loading the next bin file though? Apr 10, 2017 at 20:53