0

I have a injected PE (kernel mode rootkit to be exact) that only has the IAT table, which basically only stores the addresses of some kernel functions in an array which is referenced inside its code, then this is followed by some data section which stores strings, and after that comes the functions.

My question is that after i dump this injected mini PE, what is the easiest way that i convert it to a real PE in order to analyse it easier with IDA (or even better, a full working PE/.sys file that i can actually load and debug) ?

Also lets assume that i have found its entrypoint.

So, is there any tool for this?

Improve this question
4
  • Hi ... hmm, this sounds like eliciting opinions ("easiest way"). You'd have to undo the section alignment and return to file alignment, that part is trivial. Then you'd have to record the base address and use that to undo relocations (if any). But since you state it's a rootkit, are you sure you are even getting to see everything there is to see from user mode? Have you considered setting Windows to create a full dump (pagefile.sys must be set to system-managed before and rebooted once after the change) and analyze that? The kernel view of memory should be more complete.
    – 0xC0000022L ♦
    Jan 12, 2022 at 14:11
  • 1
    @0xC0000022L The view of it is complete i am sure of that, also i am attached to the remote kernel using IDA pro. So right now i am mostly looking to see if there is any tool available that can help me with this or not. Obviously i can write a very complex script that creates a PE from this dump, but if someone has already written it, there is no point, since it is very common for malwares to remove many parts of their PE headers and only keep those that are needed.
    – OneAndOnly
    Jan 12, 2022 at 14:42
  • How about this Q&A (OllyDumpEx)? Or LordPE (download links in archive.org should work)? Or Scylla? There are many options out there. I think most emphasize the reconstruction of the import table, though, because this (along with relocations) is the tougher nut to crack, compared to fixing section vs. file alignment.
    – 0xC0000022L ♦
    Jan 13, 2022 at 14:02
  • Oh, fascinating. Hadn't realized IDA also facilitates remote kernel debugging.
    – 0xC0000022L ♦
    Jan 13, 2022 at 14:03

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Browse other questions tagged or ask your own question.