2

I'm a RE beginner and I decided to start writing my own simple code for practice.

I wrote a simple code which uses a winAPI function called CreateProcess to start a calc.exe, I've wrote it in C and compiled it using with the official Microsoft SDK with visual studio 2019 as a Release version.

The exe file works with Windows 7 and Windows 10 without any issue.

I searched through IDA and went to the start function which should point where the main user code is, so here are my problems:

  1. The start function's analysis has failed and I have failed to find where the code redirects to the CreateProcess function which I used in the code, this is how it looks:

enter image description here

  1. When I look up "calc.exe", I find it in a different section, where I'm not used to see it (as compared to the Practical Malware Analysis book examples). This is how it looks:

Where I found my user code to be in IDA pro

I have IDA pro 6.8 installed.

This is how the original code looks, the main function only contains a call to the Create() function:

void Create()
{
    STARTUPINFO si;
    PROCESS_INFORMATION pi;

    SecureZeroMemory(&si, sizeof(si));
    si.cb = sizeof(si);
    SecureZeroMemory(&pi, sizeof(pi));

    if (!CreateProcess(L"C:\\Windows\\system32\\calc.exe", NULL, NULL, NULL, FALSE, 0, NULL, NULL, &si, &pi))
    {
        printf("failed, error: %d", GetLastError());
    }
    else {
        printf("Process successfuly started!");
    }
}

EDIT:

I added to linked PDB file that was in the Release folder and IDA works great and it immediately detects the main function!

But I say to myself, if I'm a malware analyst, I will get the EXE file without any PDB file, so what am I to do?

  • Is that start function definitely the main() function, and not the CRT start? Can you look at the imports window to find CreateProcessW and look for XRefs for it? Can you click on the "DATA XREF" for the path string to see where it's used? – Rup Sep 30 at 22:56
  • It might also be worth giving IDA the PDB for your code. It should fill in all the symbols correctly for you. – Rup Sep 30 at 23:20
  • 1
    ok, once I added the pdb file, IDA works like magic! I recognize all the user code easily, but I don't understand what am I to do if I only get the exe file, how will I analyze it..? – just_C Oct 1 at 11:14
0

Eventually, I analyzed how the program looks with all the symbols from the PDB file so that I'll know the actual Main function address.

After finding that out, I just searched the file without the PDB to understand what path do I need to take in order to get to the main function from the start function that the MSVC creates.

This solves my problem for future programs compiled with the MSVC aswell.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.