Skip to main content
1 of 2
blabb
  • 16.7k
  • 1
  • 15
  • 30

It should also be storing address of GetProcAddress() at <lpparm+4>

it should store a string the name of module at <lpparam+14>

it should store a string the name of proc for getProcAddress at <lpparm+46>

at [esp+8] it accesses the lpparam which was written to the remote process so you may need to find this WriteProcessMemory Also and look at the local Buffer to Know the data ie name of dll and name of Proc

or you may need to attach to the Remote process and Break on Thread CreateEvent and single Step through the BaseThreadStartThunk() Routine in this routine you will notice ebp is Zeored in there and Eax and Ebx holds LpStart and lpParam and that is how lpStart gets Executed

push [ebp+c] lpparam
call [enp+8] lpStart

esi gets the lpparm via mov esi [esp+8] which in your case holds the Address of LoadLibrary as you correctly observed but you have not observed what is at

assuming [esp+8 ] holds 403000 <lpparam>
[[esp+8] + 0 ] [403000] holds Address of LoadLibrary as you observed
[[esp+8] + 4]  [403004] will hold Address of GetProcAddress
[[esp+8] + 14] [403014] will hold a string the dll name
[[esp+8] + 46] [403046] will hold the name of  Proc in the Loaded Dll
[[esp+8] + 10] [403010] gets the Result of LoadLibrary Return in your above snippet
blabb
  • 16.7k
  • 1
  • 15
  • 30