0

The executable is a firmware updater for a specific device.

I want to find where exactly does the executable checks for the devices plugged into the computer, before updating the firmware of the relevant hardware.

My guess was to look for relevant Imports.GDI32 and USER32 are not interesting because they deal with UI.The third library imported is Kernel32 (promising) and functions imported are the following :

GetObjectA
TextOutA
CreateCompatibleDC
BitBlt
SelectObject
DeleteObject
SetBkMode
DeleteDC
GetModuleFileNameA
WinExec
GetTempPathA
SetCurrentDirectoryA
CloseHandle
TerminateProcess
ExitProcess
SetEndOfFile
LoadLibraryA
GetProcAddress
GetStringTypeW
GetStringTypeA
CreateFileA
FlushFileBuffers
HeapFree
GetLastError
CreateDirectoryA
HeapAlloc
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
Sleep
WriteFile
ReadFile
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
SetStdHandle
GetEnvironmentStringsW
GetCurrentProcess
SetFilePointer
UnhandledExceptionFilter
FreeEnvironmentStringsA
MultiByteToWideChar
FreeEnvironmentStringsW
GetEnvironmentStrings
GetOEMCP
WideCharToMultiByte
GetCPInfo
GetACP
SetHandleCount
GetStdHandle
GetFileType
RtlUnwind
ReleaseDC
GetDC
CreateWindowExA
RegisterClassA
DefWindowProcA
GetSystemMetrics
LoadBitmapA
GetAsyncKeyState

It looks like most of them deal with actually communicating with the device, which is not of interest to me. I was not able to find the function allowing the program to look for the appropriate device to be updated. Am I missing something ?

Edit : is the updater looking for the appropriate device in the registry ?

  • is it importing anything from Setupapi.dll? Check the calls to LoadLibraryA too. – Igor Skochinsky Sep 5 at 13:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.