I have a dumped PE that has calls like

call    ds:dword_4010B4

now these are actually addresses of APIs in kernel32.dll

my problem is IDA doesn't know that these are kernel32 APIs and therefore in the decompiler all i see is stuff like

MEMORY[address](&v1, "explorer.exe %s", &v2);

which are API calls without names

so how can i sync these API calls with their actual names? is there any way i can tell IDA that for example kernel32.dll is loaded at address x so it can therefore load it there statically or dynamically and resolve these names ?

  • 1
    Does that dumped PE resolves that called function at runtime? If yes look for any GetProcAddress. Then attach a debugger, set a breakpoint there and investigate... – Biswapriyo Dec 9 '19 at 21:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.