Forum Discussion

netcat's avatar
netcat
Icon for Bronze II rankBronze II
21 days ago

WinDbg: Ep.3 – Debugging Malware

The briefing says:
[...]
bp kernel32!LoadLibraryA ".printf \"Loading Library: %ma\",poi(esp+0x4);.echo};g"bp kernel32!GetProcAddress ".printf \"\t Looking up function: %ma\",poi(esp+0x8);.echo;g"bp advapi32!CreateServiceW ".printf \"Creating Service: \";.echo;.printf \"\tService Name: %mu\",poi(esp+0x4);.echo;.printf \"\tDisplay Name: %mu\",poi(esp+0x8);.echo;g"
[...]

Yet, none of these work. The OS was updated, the instructions not.

Fix:
bp KernelBase!LoadLibraryA 
bp KernelBase!GetProcAddress
bp sechost!CreateServiceW

No RepliesBe the first to reply