I have a malware sample that wraps
GetProcAddress duo to dynamically resolve functions. After this wrapper is called the value stored in
eax(which is the function name)immediately gets called. The strings are encrypted and it's too difficult for me to reverse the encryption algorithm. Instead I wrote a python script which sets breakpoints where a
call eax instruction is mentioned. Everyting's fine, I get the addresses of the functions from
eax that are dynamically imported. The problem is I need them to be readable. I know how to resolve the address to a function name in widbg by calling
ln address. But I don't want to sit all day and copy all of the 649 imports one by one to the
windbg console. I looked up the
windbg's scripting capabilities but I could not write anything that would do the job.