2

I'm trying to reverse a malware that builds its IAT at runtime. Due to my inexperience, I'm having trouble to understand this function that accepts into EAX a dword (maybe some sort of hash) and into EDX the base address of kernel32.dll. Could you point me how can I work it out? I can't use the decompiler right now.

DecryptionFunction

3

The function parses the PE header to locate the IMAGE_EXPORT_DIRECTORY which has the structure

enter image description here

NumberOfNames contains the number of symbols exported by this PE and is located at an offset of 0x18.

AddressOfNames is a pointer to an array of null-separated list of exported function names. This is located at offset 0x20.

Using the NumberOfNames value it iterates over the list of exported function names and calculates a hash value for each.

The algorithm to calculate hash is something like.

#include <stdlib.h>
#include <stdio.h>
#include <string.h>

int main()
{
    // The name to hash
    char name[] = "GetModuleFileNameA";

    unsigned int hash = 0;
    unsigned char ch, cl;

    for (int i=0; i<strlen(name); i++)
    {
        ch = ((hash >> 8) & 0xFF) ^ name[i];
        hash = (hash & 0xffff00ff) | (ch << 8);
        hash = _rotl(hash, 8);        
        cl =  (hash & 0xFF) ^ ((hash >> 8) & 0xFF);
        hash = (hash & 0xFFFFFF00) | cl;
    }
    printf("%08X", hash);
}

If the calculated hash matches, it returns the corresponding address of the API.

The above code calculates the hash of GetModuleFileNameA which comes out to 416F346F. The code can thus be assumed to be correct.

Check here: https://rextester.com/NIBW6473

| improve this answer | |
  • This 0x416F346F could be the hash for GetModuleFileNameA. Or this 0x0A7E6B43 could be the hash for VirtualAlloc and this 0x65233F5A could be for Sleep. – Kartone Sep 11 '19 at 13:14
  • @Kartone The code works for the given hashes. – 0xec Sep 11 '19 at 14:36
  • Great answer! Thanks for your help. Last question, do you know if symbol _IMAGE_EXPORT_DIRECTORY is working into Win7 and over? Actually I'm following your hints but, different from other structures, WinDBG complain there is no symbol associated. Thanks again! – Kartone Sep 11 '19 at 14:53
  • 1
    @Kartone Yes, _IMAGE_EXPORT_DIRECTORY is defined in the PE specification and would work across all Windows OS. Probably you don't have the proper pdb symbols loaded in windbg. – 0xec Sep 11 '19 at 15:25
  • I will dig into the issue, then. Thanks. – Kartone Sep 11 '19 at 15:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.