0

I'm examining a piece of malware with Ghidra, and like most malware it uses LoadLibrary and GetProcAddress to dynamically load libraries and functions. GetProcAddress stores the function addresses in an area of memory. I have figured out what functions are stored at what addresses and I would like ghidra to reflect this.

That is, i'd like it to say, for example, Call MPR.DLL::WNetOpen rather than Call qword ptr [some_address]. I kind of achieved this by going to the place where the address is stored and adding an external reference, however, this does not propagate the parameters of the reference, and in the disassembled view it looks different from an external function call that ghidra figured out at analysis time. Here are some pictures to help.

The first picture is an image of what I know to be LoadLibraryA through analysis. Notice I had to name it LoadLibraryB to avoid an error due to conflicting labels with the originally imported LoadLibraryA.

The second image is of the actual LoadLibraryA that was imported at the beginning of analysis, notice it has the correct parameters and return value.

I just want them to look the same.

Image of what I know to be LoadLibraryA, notice I had to name it LoadLibraryB to avoid an error due to conflicting labels.

Image of actual LoadLibrary, notice it has the correct parameters and return value

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.