Forum Discussion

netcat's avatar
netcat
Icon for Bronze III rankBronze III
2 months ago

WinDbg: Ep.3 – Debugging Malware

The briefing says: [...] bp kernel32!LoadLibraryA ".printf \"Loading Library: %ma\",poi(esp+0x4);.echo};g"bp kernel32!GetProcAddress ".printf \"\t Looking up function: %ma\",poi(esp+0x8);.echo;g"bp...
feedback
  • AndradaCraciun's avatar
    AndradaCraciun
    18 days ago

    Hey netcat thanks for your feedback on the lab! We have not updated the OS, the content was reflective of the sort of APIs you should be looking for. It wasn’t hugely clear to look for related symbols of those APIs.

    The fix you proposed absolutely works! We have also updated the content to show how you can still use kernel32 and advapi32.

    Thanks again for the feedback, we appreciate it!

AndradaCraciun's avatar
AndradaCraciun
Icon for Community Support rankCommunity Support
18 days ago

Hey netcat thanks for your feedback on the lab! We have not updated the OS, the content was reflective of the sort of APIs you should be looking for. It wasn’t hugely clear to look for related symbols of those APIs.

The fix you proposed absolutely works! We have also updated the content to show how you can still use kernel32 and advapi32.

Thanks again for the feedback, we appreciate it!