x64dbg : TraceInto only in user code

Question

The question seems pretty simple, but I can't achieve this simple thing in a reasonable time. I have a malware proceeding to deobfuscate a large amount of APIs in memory. Only the pointer to the functions is stored, not the name. I just wanted to quickly get a list of the API names using the trace feature when x64dbg sees the info from the register. ({a:register} gives me the symbol related to this pointer)

The problem is that the TraceInto is really too slow since it has to test every non-user instruction. I have just tried to TraceInto and launches the command "StepOut" when the base address isn't linked to user code. But this command stops the tracing. RunToParty, RunToUserCode stop the tracing as well. I could set some commands to restart the tracing, but I haven't found any options in the documentation to append logs to the log file. The provided log file is cleared each time the tracing starts.

Do you have some tricks to perform such common tasks, that is to say, TraceInto only in the usercode ?

Answer 1

Based on the following sample:

be7df9b222558c6b2afce6db5b20645bf394901f3d5ba27945d5497a367c8034

The unpacked Quakbot payload is this:

c85839f837d0312d9fb5440b16fa4fe3769df6d8f986dfaa0b5a28fb9ec80e19

I have identified the call to the function which resolves the API names that you're asking about at address 0x10031E22. To catch all the API names, just set a conditional breakpoint there (SHIFT-F2). In the Log Text field of the breakpoint configuration, put {a:eax}. Then in the Break Condition field, put 0. With the breakpoint set, click the Run button or hit F9. You then go look at the log tab, and the API names should all be listed there. This is much faster than trying to do a trace, and you end up with the same dataset. It looks like there are more locations where API names are resolved, so you may need to rinse and repeat this process a couple times for each location where the API names are resolved. You can set multiple breakpoints for all the locations. Here is the list of API names that I collected from this sample at the address above:

Breakpoint at 10031E22 set!

<kernel32.LoadLibraryA>
<kernel32.LoadLibraryW>
<kernel32.FreeLibrary>
<kernel32.GetProcAddress>
<kernel32.GetModuleHandleA>
<kernel32.CreateToolhelp32Snapshot>
<kernel32.Module32First>
<kernel32.Module32Next>
<kernel32.WriteProcessMemory>
<kernel32.OpenProcess>
<kernel32.VirtualFreeEx>
<kernel32.WaitForSingleObject>
<kernel32.CloseHandle>
<kernel32.LocalFree>
<kernel32.CreateProcessW>
<kernel32.ReadProcessMemory>
<kernel32.Process32First>
<kernel32.Process32Next>
<kernel32.Process32FirstW>
<kernel32.Process32NextW>
<kernel32.CreateProcessAsUserW>
<kernel32.VirtualAllocEx>
<kernel32.VirtualAlloc>
<kernel32.VirtualFree>
<kernel32.OpenThread>
<kernel32.Wow64DisableWow64FsRedirection>
<kernel32.Wow64EnableWow64FsRedirection>
<kernel32.GetVolumeInformationW>
<kernel32.IsWow64Process>
<kernel32.CreateThread>
<kernel32.CreateFileW>
<kernel32.CreateFileA>
<kernel32.FindClose>
<kernel32.GetFileAttributesW>
<kernel32.SetFilePointer>
<kernel32.WriteFile>
<kernel32.ReadFile>
<kernel32.CreateMutexA>
<kernel32.ReleaseMutex>
<kernel32.FindResourceA>
<kernel32.FindResourceW>
<kernel32.SizeofResource>
<kernel32.LoadResource>
<kernel32.GetTickCount64>
<kernel32.ExpandEnvironmentStringsW>
<kernel32.GetThreadContext>
<kernel32.SetLastError>
<kernel32.GetComputerNameW>
<kernel32.Sleep>
<kernel32.SleepEx>
<kernel32.OpenEventA>
<kernel32.SetEvent>
<kernel32.CreateEventA>
<kernel32.TerminateThread>
<kernel32.QueryFullProcessImageNameW>
<kernel32.CreateNamedPipeA>
<kernel32.ConnectNamedPipe>
<kernel32.GetLocalTime>
<kernel32.ExitProcess>
<kernel32.GetEnvironmentVariableW>
<kernel32.GetExitCodeThread>
<kernel32.GetFileSize>
<kernel32.VirtualProtect>
<kernel32.VirtualProtectEx>
<kernel32.InterlockedCompareExchange>
<kernel32.CreateRemoteThread>
<kernel32.SetEnvironmentVariableW>
<kernel32.ResumeThread>
<kernel32.TerminateProcess>
<ntdll.RtlAddVectoredExceptionHandler>
<kernel32.DeleteFileW>
<kernel32.CopyFileW>
<kernel32.AllocConsole>
<kernel32.SetConsoleCtrlHandler>
<kernel32.GetModuleFileNameW>
<kernel32.GetCurrentProcess>
<kernel32.CreatePipe>

Cheers!