How can I extend a memory of an analysed executable in IDA Pro?

Question

I'm analysing some malware executable with ImmDBG and IDA Pro.

The executable calls the kernel32.VirtualAlloc() at runtime with an argument lpAddress=NULL what means that an operating system decides itself where the memory has to be allocated. The VirtualAlloc() returns an address 0x003F0000. After that the executable writes some function to this memory, which is quite big, and I would like to analyse this function in IDA Pro.

The problem is, that my executable is loaded to the 0x004010000 in IDA Pro and I don't know how could I extend the memory of the executable in IDA Pro in order to create this function manually(with help of PatchBytes).

Also maybe it's possible somehow to build a function from a sequence of opcodes in IDA Pro?

Thank you in advance!

Answer 1

The most reliable solution I've found is to add a new section to the PE file and force the process to write the unpacked code into that new section in memory.

I wrote up a blog post a few years ago with a full walk-through of this approach: http://blog.crowdstrike.com/unpacking-dynamically-allocated-code/

Answer 2

I solved this issue by creating a new section in IDA Pro (File -> Segments -> Create segment). After that I dumped new section in OllyDBG (binary copy) and transferred it to the new created section in IDA Pro (with a Python script). After that I could analyse the code and write comments in IDA to make better analysis and documentation.