I have memory dump of injected process. But the malware load libraries/functions dynamically and I need to resolve this. For example, If malware will use createThread, first get address of this function with getprocaddress then kept the pointer into a variable. To call function use variable.

So I need to resolve dynamic addresses to disassemble. How can I do it?

1 Answer 1


you could write a script which will get all xref's toGetProcAddressthen go one by one to checkGetProcAddress second parametes lpProcName next follow disassembly trace return value eax to first memory write e.g. mov dword ptr [unknown_ptr], eax and rename the pointer.

For inspiration look at IDAscope plugin: https://hex-rays.com/contests/2012/index.shtml#idascope or funcap https://hex-rays.com/contests/2013/index.shtml#funcap

  • Is this still possible to do statically even if a custom loader or calls to GetProcAddress itself is generated dynamically?
    – the_endian
    Nov 20, 2017 at 21:43
  • yes but more work and the results might be not that good
    – krusty
    Nov 27, 2017 at 10:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.