When i take memory snapshot with IDA to try to analyze it statically later, the problem is there are a lot of symbols that get lost when i dump the memory, how can i solve this?
for example this is the dump before :
rootkit:84582008 40 DE A4 82 dd offset nt_memcpy
rootkit:8458200C C1 BA C7 82 dd offset nt_RtlFreeUnicodeString
rootkit:84582010 10 AF AC 82 dd offset nt_RtlEqualString
rootkit:84582014 20 D5 A4 82 dd offset nt_RtlInitAnsiString
rootkit:84582018 BA 6A B3 82 dd offset nt_ExFreePoolWithTag
rootkit:8458201C 9B D2 C7 82 dd offset nt_RtlUnicodeStringToAnsiString
rootkit:84582020 05 60 B3 82 dd offset nt_ExAllocatePoolWithTag
rootkit:84582024 58 12 A5 82 dd offset nt_ZwQuerySystemInformation
rootkit:84582028 C0 E4 A4 82 dd offset nt_memset
rootkit:8458202C DC 01 A5 82 dd offset nt_ZwClose
rootkit:84582030 1C 03 A5 82 dd offset nt_ZwCreateFile
rootkit:84582034 35 9A C3 82 dd offset nt_RtlEqualUnicodeString
rootkit:84582038 6F DF C7 82 dd offset nt_ObQueryNameString
rootkit:8458203C 83 D2 A8 82 dd offset nt_ObfDereferenceObjec
after i take the memory snapshot and detach from kernel :
rootkit:84582000 dd 82A851FEh
rootkit:84582004 dd 82A84D9Bh
rootkit:84582008 dd 82A4DE40h
rootkit:8458200C dd 82C7BAC1h
rootkit:84582010 dd 82ACAF10h
rootkit:84582014 dd 82A4D520h
rootkit:84582018 dd 82B36ABAh
rootkit:8458201C dd 82C7D29Bh
rootkit:84582020 dd 82B36005h
rootkit:84582024 dd 82A51258h
rootkit:84582028 dd 82A4E4C0h
rootkit:8458202C dd 82A501DCh
rootkit:84582030 dd 82A5031Ch
rootkit:84582034 dd 82C39A35h
rootkit:84582038 dd 82C7DF6Fh
rootkit:8458203C dd 82A8D283h