How can I resolve dynamic addresses (for APIs,DLLs etc.) to disassemble in IDA Pro?

Question

I have memory dump of injected process. But the malware load libraries/functions dynamically and I need to resolve this. For example, If malware will use createThread, first get address of this function with getprocaddress then kept the pointer into a variable. To call function use variable.

So I need to resolve dynamic addresses to disassemble. How can I do it?

Answer 1

you could write a script which will get all xref's toGetProcAddressthen go one by one to checkGetProcAddress second parametes lpProcName next follow disassembly trace return value eax to first memory write e.g. mov dword ptr [unknown_ptr], eax and rename the pointer.

For inspiration look at IDAscope plugin: https://hex-rays.com/contests/2012/index.shtml#idascope or funcap https://hex-rays.com/contests/2013/index.shtml#funcap