I am working on a highly obfuscated driver that is virtualized. In an attempt to work on this driver I asked a question about some python scripts which turned out not to be effective at all so I decided to delete that question and ask my question directly by explaining all the details so maybe I can find a better solution for my problem.
Driver size is about
3mb and it is packed and when it's loaded on memory it gets around
6mb which shows how much garbage code is actually there, it used anti static analysis methods like jumping to different locations by register, calling
API functions using
ret instructions and getting
API addresses using brute force and many more methods that I am not aware.
Now when I am using
windbg to analyze the driver I tried the
ta instruction which was suggested in the previous question about python script, even 6 hours was not enough to get to that address. As a result I thought about the ideas below but I am not sure if they are working or if there is any open source tool for these ideas so I would really appreciate it if anyone can give me a solution to this problem.
DTraceis one of the ideas that I tried, the problem is, driver detecting both debugger and my virtual machine so when I am using
sccommand to run the driver, its getting closed immediately so I do not know how can I use
DTracesince I am not familiar that much with the tool.
Using or writing an
IRPtracker so I can find out what functions get called when I am using
sccommand. I found out OSR has a tool for this purpose but sadly it is not working for windows 11 but maybe there is an open source tool for this idea.
Tldr; Working on a virtualized and heavily mutated driver with tons of fake calls that hide all import functions and getting addresses using brute forcing memory I need a way to find all those functions.