Forum Discussion

netcat's avatar
netcat
Icon for Silver III rankSilver III
9 months ago
Solved

WinDbg: Ep.3 – Debugging Malware

The briefing says: [...] bp kernel32!LoadLibraryA ".printf \"Loading Library: %ma\",poi(esp+0x4);.echo};g"bp kernel32!GetProcAddress ".printf \"\t Looking up function: %ma\",poi(esp+0x8);.echo;g"bp...
feedback
  • AndradaCraciun's avatar
    AndradaCraciun
    8 months ago

    Hey netcat thanks for your feedback on the lab! We have not updated the OS, the content was reflective of the sort of APIs you should be looking for. It wasn’t hugely clear to look for related symbols of those APIs.

    The fix you proposed absolutely works! We have also updated the content to show how you can still use kernel32 and advapi32.

    Thanks again for the feedback, we appreciate it!

AndradaCraciun's avatar
AndradaCraciun
Icon for Community Support rankCommunity Support
8 months ago

Hey netcat thanks for your feedback on the lab! We have not updated the OS, the content was reflective of the sort of APIs you should be looking for. It wasn’t hugely clear to look for related symbols of those APIs.

The fix you proposed absolutely works! We have also updated the content to show how you can still use kernel32 and advapi32.

Thanks again for the feedback, we appreciate it!