How to debug malware injected code?

Question

I am debugging a malware do injection to Notepad.exe use following approach:

CreateProcess(notepad.exe , create_suspend)  
GetThreadContext  
VirtualProtectEx  
WriteProcessMemory(address=1000000, Size:10200)  
WriteProcessMemory(address=7FFD8008, Size:4)  
SetThreadContext  
ResumeThread

There is no pid to attach Notepad.exe to debugger before it resume.
after resume, the thread run so fast that I can't attach to ollydgb in time.
I Dump memory and save it as PE from what it write to Notepad.exe, but it run with error.

so how to debug malware injected code? thanks!!

yorath · Accepted Answer · 2012-09-27 02:55:41Z

4

You should modify the first byte of the injected code to 'int 3' (opcode is cc) before invoking WriteProcessMemory.
OD can't attach to the process that hasn't started the main thread, use WinDbg instead.
Invoke ResumeThread after WinDbg is attached to the subprocess.
Press F5 to let the main thread run.
The main thread will stop when it sees 'int 3', now you should change the byte to the original value. For example: eb addr_to_change 55. PS: opcode 55 means 'push ebp', which is the most common instruction executed at the beginning of one function.
Now, Press F10 to start single-step debugging.

answered Sep 27, 2012 at 2:55

yorath

1991 silver badge7 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Igor Skochinsky · Accepted Answer · 2012-09-14 11:19:17Z

1

After CreateProcess returns, the process should already exist and you should be able to attach to it. Another approach is to skip the ResumeThread call and attach at that point.

answered Sep 14, 2012 at 11:19

Igor Skochinsky

25.5k2 gold badges76 silver badges113 bronze badges

Collectives™ on Stack Overflow

How to debug malware injected code?

2 Answers 2

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related