netcat
10 days agoBronze II
WinDbg: Ep.3 – Debugging Malware
The briefing says:
[...]
bp kernel32!LoadLibraryA ".printf \"Loading Library: %ma\",poi(esp+0x4);.echo};g"bp kernel32!GetProcAddress ".printf \"\t Looking up function: %ma\",poi(esp+0x8);.echo;g"bp advapi32!CreateServiceW ".printf \"Creating Service: \";.echo;.printf \"\tService Name: %mu\",poi(esp+0x4);.echo;.printf \"\tDisplay Name: %mu\",poi(esp+0x8);.echo;g"
[...]
Yet, none of these work. The OS was updated, the instructions not.
Fix:
bp KernelBase!LoadLibraryA
bp KernelBase!GetProcAddress
bp sechost!CreateServiceW