Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.
Sign up to join this community
For example, you want to use Ollydbg to reverse a binary that is injected using WriteProcessMemory and CreateRemoteThread. How do you do this with ease?
Currently I am setting a breakpoint on WriteProcessMemory on the injector. Then I open the target with a new instance Ollydbg and set a breakpoint for when the written memory is accessed. Is there an easier way?
In general you probably want to break (just) before the entry point is executed. The first code to be executed could be DllMain, a TLS callback, or a static constructor.
You should definitely start with static analysis if at all possible. Check out all entrypoints using IDA and figure out what they are doing.
After that, edit the physical DLL file, dropping an int 3 in DllMain, and all TLS callbacks/static constructors. That should let you debug it immediately after injection. (disclaimer: I haven't actually tried this)
If you don't want to be that thorough, a bp on CreateThread may be enough (if your static analysis indicates that creating a thread is all that the entry point does).
Alternatively, load the dll file in yourself using a manual mapping method. That way you'll have full control over what code is executed and when. Depending on the sophistication of the method used, this could break some or all of the DLL's functionality.
Further dynamic analysis depends on what you expect the DLL to be doing. If you think it's modifying code, take before/after snapshots of memory or use HookShark. If you think it's doing malicious things outside the process use API Monitor or Process Monitor. Also consider using code instrumentation to find all calls from inside the DLL to other modules, or all writes to memory outside the DLL.
