Hi all,

I just recently started with reverse engineering some malware, using Ollydbg and Ida Pro, and encountered the following problem:

After the malware decompressed itself in memory, as an additional step for obfuscation, it builds its own table for API calls into a data segment, which looks like that (this is only an excerpt):



In the code segment, API calls are then made like this:


Ollydbg itself seems to be able to resolve the VirtualProtectEx call.

I'd like also to be able to analyze it in IDa Pro though. So I used the Ollydump plugin and loaded the resulting file into IDA Pro, but only get



In the data segment, I see

But obviously it can't make the reference to the system call.

I also tried "Rebuild import table", "Method 1: search JMP[API]|CALL[API]", which looked like the thing I needed, but this doesn't work either. Actually, the import table is always empty, just the data stored at dword_40FE40 is modified (to 22EB6). I think my problem is an additional step of indirection that I'd need.

Does anybody know what could be done in this situation to make life easier?

Thanks in advance, Andy

Hi Andy:
Perhaps ImpRec may help?
It will create its own import table and append it to the dumped file. IDA then LIKELY will recognize the imports and disassemble the system and api calls correctly. Keep in mind that the resulting executable is not a carbon copy of the unpacked dump, but certainly could make your life easier in IDA analysis.

Hi Naides,
Thanks a lot, that worked very well :-) It could not resolve all of the calls, but nearly all, so it was no big problem fixing the rest manually.