3

I have a malware sample that wraps LoadLibrary & GetProcAddress duo to dynamically resolve functions. After this wrapper is called the value stored in eax(which is the function name)immediately gets called. The strings are encrypted and it's too difficult for me to reverse the encryption algorithm. Instead I wrote a python script which sets breakpoints where a call eax instruction is mentioned. Everyting's fine, I get the addresses of the functions from eax that are dynamically imported. The problem is I need them to be readable. I know how to resolve the address to a function name in widbg by calling ln address. But I don't want to sit all day and copy all of the 649 imports one by one to the windbg console. I looked up the windbg's scripting capabilities but I could not write anything that would do the job.

Thanks

  • I looked up the windbg's scripting capabilities but I could not write anything that would do the job. you can use python with windbg through pykd – adrián Oct 29 '17 at 1:23
4

i dont know if i understood your query correctly but if you want to log the function names that are passed to getproc address you can log them like this in windbg

C:\>cdb calc

Microsoft (R) Windows Debugger Version 10.0.15063.468 X86

ntdll!LdrpDoDebuggerBreak+0x2c:
775605a6 cc              int     3

0:000> bp KERNELBASE!GetProcAddress ".printf \"%ma\\n\",poi(@esp+8);gc"

0:000> bl
 0 e 756c6c81     0001 (0001)  0:**** KERNELBASE!GetProcAddress ".printf \"%ma\\n\",poi(@esp+8);gc"


0:000> g

ImmWINNLSEnableIME
ImmWINNLSGetEnableStatus
ImmSendIMEMessageExW
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
CtfImmTIMActivate
CtfImmRestoreToolbarWnd
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
LpkPSMTextOut
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
ModLoad: 740c0000 740d3000   C:\Windows\system32\dwmapi.dll
DwmIsCompositionEnabled
GetLayout
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
ModLoad: 75590000 7559c000   C:\Windows\system32\CRYPTBASE.dll
SystemFunction036
CLSIDFromOle1Class
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
ModLoad: 73b70000 73bac000   C:\Windows\system32\oleacc.dll
EventWrite
EventRegister
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
BufferedPaintStopAllAnimations

ntdll!DbgBreakPoint:
774f4108 cc              int     3
0:004> q
quit:

C:\>

afaik windbg also resolves the address to its function Name

0:000> rM0
calc!WinMain+0x6b:
001316a0 ffd7            call    edi {kernel32!GetModuleHandleWStub (7737ccac)}
  • Thanks, but I wanted to know specifically how to resolve the value eax holds to a function name. IDA does it for instance if there address like 0x77****** IDA shows what function that is. – rustam Shirinov Oct 28 '17 at 20:58
  • windbg as far as i know also resolves the address to function names see the edit – blabb Oct 29 '17 at 3:48
  • I am aware of that. I want windbg to do that for all of the 649 addresses and I don't want to do that manually. Also I don't know if that's possible with idapython. – rustam Shirinov Oct 29 '17 at 7:12
  • your query is still unclear you have to set breakpoint on all call eax to do that you need to pattern match and collect the addresses for pattern matching you can use # call*eax range then use .foreach on the results there is no arbitrary way in any debugger to break on call eax automatically you either need to step each instruction or preset bps based on some manual work if you know getproc address is called each time your best bet is to grab it there – blabb Oct 29 '17 at 7:40
  • found out that windbg has .for loops and it did the job Thanks. Your answer was helpful. – rustam Shirinov Oct 29 '17 at 9:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.