2

Right now I have a obfuscated driver, that in order to call something like KeDelayExecutionThread, it does the following:

mov     rax, cs:KeDelayExecutionThrea
lea     r8, [rsp+28h+arg_0]
xor     edx, edx
xor     ecx, ecx
call    cs:trampolineFunction_Address  

and:

trampolineFunction_Address dq offset trampolineFunction
 
trampolineFunction proc near
jmp     rax
trampolineFunction endp

So it just pushes the destination function in rax, and calls this trampolineFunction indirectly using call cs:trampolineFunction_Address.

The problem is, in the decompiled output, every call is now shown as trampolineFunction_Address( ... ) :

if ( trampolineFunction_Address(&v34, 1i64, &v22, v31, 0i64, v13, v16) >= 0 )
        {
          *&v20 = trampolineFunction_Address(v7, v6, v8, v9, v11, v14, v17);
          if ( trampolineFunction_Address(&v33, 64i64, &v27, &v20, v12, v15, v18) >= 0 )
...

So how can I make IDA's decompiler to show me the correct function name?

Note that for example, KeDelayExecutionThread in above assembly is basically the address of KeDelayExecutionThread, which this rootkits resolves during initialization and puts it in its data section, and as you can see after I renamed that address to that, IDA correctly knows the function definition:

.data:FFFFF80019E5F000 ; NTSTATUS (*KeDelayExecutionThread)(KPROCESSOR_MODE WaitMode, BOOLEAN Alertable, PLARGE_INTEGER Interval)
.data:FFFFF80019E5F000 KeDelayExecutionThread dq 0FFFFF8001A2CFB30h

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.