Mark Lim peta909

references:

manual import resolution

example from 0f5d5d07c6533bc6d991836ce79daaa1:

_0:00F20012 33 D2                   xor     edx, edx
_0:00F20014 64 8B 52 30             mov     edx, fs:[edx+30h] // TEB->PEB
_0:00F20018 8B 52 0C                mov     edx, [edx+0Ch]    // PEB->LDR_DATA
_0:00F2001B 8B 52 14                mov     edx, [edx+14h]    // LDR_DATA->InMemoryOrderLinks (_LDR_DATA_TABLE_ENTRY)
                                                              // alt: 0xC: InLoadOrderLinks
 // alt: 0x1C: InInitializationOrderLinks

Windows Toolkit

Binary

Native Binaries

IDA Pro

IDA Plugins	Preferred	Neutral	Unreviewed

	from zipfile import ZipFile

	def unpack_zip(zipfile='', path_from_local=''):
	filepath = path_from_local+zipfile
	extract_path = filepath.strip('.zip')+'/'
	parent_archive = ZipFile(filepath)
	parent_archive.extractall(extract_path)
	namelist = parent_archive.namelist()
	parent_archive.close()
	for name in namelist:

	#include <Windows.h>

	#include <iostream>
	#include "ntdll_undoc.h"

	PPEB get_default_peb()
	{
	#if defined(_WIN64)
	return (PPEB)__readgsqword(0x60);
	#else

	#########################################
	# Created by @kuroi_dotsh - KuroiSH #
	# Website: https://dengisan.nl/ #
	# E-mail: [email protected] #
	#########################################

	;
	; The executable is stored in the final section, so that it does not need
	; relocations (as we can simply load it over our own headers and pad with
	; virtualsize to keep our module running).

Mark Lim peta909

manual import resolution

example from 0f5d5d07c6533bc6d991836ce79daaa1:

Windows Toolkit

Binary

Native Binaries

IDAPython cheatsheet

Important links

Basic commands

Get informations on the binary