Bronze IIIWinDbg: Ep.3 – Debugging Malware
The briefing says:
[...]
bp kernel32!LoadLibraryA ".printf \"Loading Library: %ma\",poi(esp+0x4);.echo};g"bp kernel32!GetProcAddress ".printf \"\t Looking up function: %ma\",poi(esp+0x8);.echo;g"bp advapi32!CreateServiceW ".printf \"Creating Service: \";.echo;.printf \"\tService Name: %mu\",poi(esp+0x4);.echo;.printf \"\tDisplay Name: %mu\",poi(esp+0x8);.echo;g"
[...]
Yet, none of these work. The OS was updated, the instructions not.
Fix:
bp KernelBase!LoadLibraryA
bp KernelBase!GetProcAddress
bp sechost!CreateServiceW
Hey netcat thanks for your feedback on the lab! We have not updated the OS, the content was reflective of the sort of APIs you should be looking for. It wasn’t hugely clear to look for related symbols of those APIs.
The fix you proposed absolutely works! We have also updated the content to show how you can still use kernel32 and advapi32.
Thanks again for the feedback, we appreciate it!
