Right now I have a obfuscated driver, that in order to call something like KeDelayExecutionThread, it does the following:
mov rax, cs:KeDelayExecutionThrea
lea r8, [rsp+28h+arg_0]
xor edx, edx
xor ecx, ecx
call cs:trampolineFunction_Address
and:
trampolineFunction_Address dq offset trampolineFunction
trampolineFunction proc near
jmp rax
trampolineFunction endp
So it just pushes the destination function in rax, and calls this trampolineFunction indirectly using call cs:trampolineFunction_Address
.
The problem is, in the decompiled output, every call is now shown as trampolineFunction_Address( ... )
:
if ( trampolineFunction_Address(&v34, 1i64, &v22, v31, 0i64, v13, v16) >= 0 )
{
*&v20 = trampolineFunction_Address(v7, v6, v8, v9, v11, v14, v17);
if ( trampolineFunction_Address(&v33, 64i64, &v27, &v20, v12, v15, v18) >= 0 )
...
So how can I make IDA's decompiler to show me the correct function name?
Note that for example, KeDelayExecutionThread in above assembly is basically the address of KeDelayExecutionThread, which this rootkits resolves during initialization and puts it in its data section, and as you can see after I renamed that address to that, IDA correctly knows the function definition:
.data:FFFFF80019E5F000 ; NTSTATUS (*KeDelayExecutionThread)(KPROCESSOR_MODE WaitMode, BOOLEAN Alertable, PLARGE_INTEGER Interval)
.data:FFFFF80019E5F000 KeDelayExecutionThread dq 0FFFFF8001A2CFB30h