Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.
Sign up to join this community
I have a .dmp file for googleupdate.exe process. I wanted to check in WinDbg this process has a certificate or not in order to detect this process has modified or not because this process has tried access lsass.exe multiple time.
How can I check the integrity and also maliciousness of this process in WinDbg? I have just a memory dump from that process and nothing more. I should check it in WinDbg.
In short, the PE loader does not explicitly load up the certificate details into the new process at run-time.
In the binary, the certificates are referenced via the IMAGE_DIRECTORY_ENTRY_SECURITY directory; but they are not in a section that is mapped into virtual memory. The data is instead appended to the file.
You might get lucky and find the cert data has been mapped via a memory mapped file, or if you captured a full kernel dump you might have a copy of it. Otherwise you will have to try and source the file from the computer.
Your best bet is to manually compare the code-in-memory to a valid copy of googleupdate.
Also keep in mind that the source binary could be completely valid, but the behavior changed at run-time (via code injection, etc.). So even if you could easily validate the integrity of the certificate, it wouldn't detect rogue threads, hooked functions, etc.
