Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Using IDAPython to Make Your Life Easier: Part 2

Summary: Unit 42's second IDAPython tutorial addresses shellcode and malware that hides loaded functions and libraries behind a hashing algorithm, commonly CRC32 or ROR13, with the sample at hand calling the hash-based loader 190 times. The author identifies the CRC32 constant 0xEDB88320, generates a JSON dictionary of common Windows function names hashed with CRC32, then uses IDAPython to build an IDA enumeration mapping each hash to its function name and rename the DWORDs that store the resolved addresses.

What you should know: A single sample resolving 190 functions by hash is 190 manual lookups an analyst would otherwise do by hand, and the resulting enumeration can be exported and imported into other IDA projects when the same obfuscation shows up again.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related