1

I have memory dump of injected process. But the malware load libraries/functions dynamically and I need to resolve this. For example, If malware will use createThread, first get address of this function with getprocaddress then kept the pointer into a variable. To call function use variable.

So I need to resolve dynamic addresses to disassemble. How can I do it?

1

you could write a script which will get all xref's toGetProcAddressthen go one by one to checkGetProcAddress second parametes lpProcName next follow disassembly trace return value eax to first memory write e.g. mov dword ptr [unknown_ptr], eax and rename the pointer.

For inspiration look at IDAscope plugin: https://hex-rays.com/contests/2012/index.shtml#idascope or funcap https://hex-rays.com/contests/2013/index.shtml#funcap

  • Is this still possible to do statically even if a custom loader or calls to GetProcAddress itself is generated dynamically? – the_endian Nov 20 '17 at 21:43
  • yes but more work and the results might be not that good – krusty Nov 27 '17 at 10:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.