1

When i take memory snapshot with IDA to try to analyze it statically later, the problem is there are a lot of symbols that get lost when i dump the memory, how can i solve this?

for example this is the dump before :

rootkit:84582008 40 DE A4 82                             dd offset nt_memcpy
rootkit:8458200C C1 BA C7 82                             dd offset nt_RtlFreeUnicodeString
rootkit:84582010 10 AF AC 82                             dd offset nt_RtlEqualString
rootkit:84582014 20 D5 A4 82                             dd offset nt_RtlInitAnsiString
rootkit:84582018 BA 6A B3 82                             dd offset nt_ExFreePoolWithTag
rootkit:8458201C 9B D2 C7 82                             dd offset nt_RtlUnicodeStringToAnsiString
rootkit:84582020 05 60 B3 82                             dd offset nt_ExAllocatePoolWithTag
rootkit:84582024 58 12 A5 82                             dd offset nt_ZwQuerySystemInformation
rootkit:84582028 C0 E4 A4 82                             dd offset nt_memset
rootkit:8458202C DC 01 A5 82                             dd offset nt_ZwClose
rootkit:84582030 1C 03 A5 82                             dd offset nt_ZwCreateFile
rootkit:84582034 35 9A C3 82                             dd offset nt_RtlEqualUnicodeString
rootkit:84582038 6F DF C7 82                             dd offset nt_ObQueryNameString
rootkit:8458203C 83 D2 A8 82                             dd offset nt_ObfDereferenceObjec

after i take the memory snapshot and detach from kernel :

rootkit:84582000                 dd 82A851FEh
rootkit:84582004                 dd 82A84D9Bh
rootkit:84582008                 dd 82A4DE40h
rootkit:8458200C                 dd 82C7BAC1h
rootkit:84582010                 dd 82ACAF10h
rootkit:84582014                 dd 82A4D520h
rootkit:84582018                 dd 82B36ABAh
rootkit:8458201C                 dd 82C7D29Bh
rootkit:84582020                 dd 82B36005h
rootkit:84582024                 dd 82A51258h
rootkit:84582028                 dd 82A4E4C0h
rootkit:8458202C                 dd 82A501DCh
rootkit:84582030                 dd 82A5031Ch
rootkit:84582034                 dd 82C39A35h
rootkit:84582038                 dd 82C7DF6Fh
rootkit:8458203C                 dd 82A8D283h
Improve this question
1

Two options:

  1. Include the targets of the pointers into the snapshot (can be done by enabling the target segment’s loader flag in segment properties, or via “Analyze module” from the Modules context menu)

  2. Rename the import table pointers using the pointed-to names (e.g. using renimp.idc or similar script)

Improve this answer
4
  • Thank you for answer, the problem is the module is not really a module, its a rootkit executable buffer so it doesnt show in modules list so i cant use Analyze module, also i coudln't find the "enable segment loader flag" in the segment attributes? (edit - > segments - > edit segment) – Notoriouss Nov 18 '20 at 13:47
  • I should note that the segment you see in my question is created by me manually, i found the rootkit's kernel module and created a segment for so i can analyze it later when i create memory snapshot – Notoriouss Nov 18 '20 at 14:12
  • @Notoriouss the target is the nt module which should be in the list – Igor Skochinsky♦ Nov 18 '20 at 16:36
  • thank you that fixed it, but i still couldn't find anything regarding enabling the target segment’s loader flag in segment properties in edit - > segments - > edit segment, where is this option? – Notoriouss Nov 19 '20 at 11:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.