I am working on a highly obfuscated driver that is virtualized. In an attempt to work on this driver I asked a question about some python scripts which turned out not to be effective at all so I decided to delete that question and ask my question directly by explaining all the details so maybe I can find a better solution for my problem.
Driver size is about 3mb
and it is packed and when it's loaded on memory it gets around 6mb
which shows how much garbage code is actually there, it used anti static analysis methods like jumping to different locations by register, calling API
functions using push
and ret
instructions and getting API
addresses using brute force and many more methods that I am not aware.
Now when I am using windbg
to analyze the driver I tried the ta
instruction which was suggested in the previous question about python script, even 6 hours was not enough to get to that address. As a result I thought about the ideas below but I am not sure if they are working or if there is any open source tool for these ideas so I would really appreciate it if anyone can give me a solution to this problem.
Using
DTrace
is one of the ideas that I tried, the problem is, driver detecting both debugger and my virtual machine so when I am usingsc
command to run the driver, its getting closed immediately so I do not know how can I useDTrace
since I am not familiar that much with the tool.Using or writing an
IRP
tracker so I can find out what functions get called when I am usingsc
command. I found out OSR has a tool for this purpose but sadly it is not working for windows 11 but maybe there is an open source tool for this idea.
Tldr; Working on a virtualized and heavily mutated driver with tons of fake calls that hide all import functions and getting addresses using brute forcing memory I need a way to find all those functions.