Monday, November 12, 2018

IDA common locations to put breakpoints

I'm learning that if you're looking for somewhere to breakpoint in confusing malware try

jmp eax ;   // or any register for that matter, it's jumping to a dynamic address
call eax ;   // or any register for that matter, it's jumping to a dynamic address
call dword_xxx;   // it's jumping to an address saved in data, perhaps dynamically loaded

Also a breakpoint in
ntdll.dll -> ResumeThread ; // malware may suspend and then restart when completed editing
ntdll.dll -> ResumeProcess ; // malware may suspend and then restart when completed editing

Also look at the IDA color coded graph across the top, look for a large chunk of data, which is probably the packed code, find the label for it, for xrefs to that label, then breakpoint there.

9 comments:

  1. Thank you Dr.Ogudugu for the great work you did for me when my lover broke my heart. Dr.Ogudugu was able to bring my lover that left for about 2 months back to me within 48 hours of me contact Dr.Ogudugu. Contact Dr.Ogudugu on greatogudugu@gmail.com or better still you can give Dr.Ogudugu a call onWhatsApp +27663492930 for a better understanding for what i just said about him..

    ReplyDelete
    Replies
    1. Hello to everyone out here, I am here to share the unexpected miracle that happened to me … My name is Susan Christian , I live in London, UK. we got married for more than 9 years and have gotten two kids. thing were going well with us and we are always happy. until one day my husband started to behave in a way i could not understand, i was very confused by the way he treat me and the kids. later that month he did not come home again and he called me that he want a divorce, i asked him what have i done wrong to deserve this from him, all he was saying is that he want a divorce that he hate me and do not want to see me again in his life, i was mad and also frustrated do not know what to do, i was sick for more than 2 weeks because of the divorce. i love him so much he was everything to me without him my life is incomplete. i told my sister and she told me to contact a spell caster, i never believe in all this spell casting of a thing. i just want to try if something will come out of it. i contacted Dr Emu for the return of my husband to me, they told me that my husband have been taken by another woman, that she cast a spell on him that is why he hate me and also want us to divorce. then they told me that they have to cast a spell on him that will make him return to me and the kids, they casted the spell and after 24 hours my husband called me and he told me that i should forgive him, he started to apologize on phone and said that he still live me that he did not know what happen to him that he left me. it was the spell that he Dr Emu casted on him that make him come back to me today, me and my family are now happy again today. thank you Dr Emu for what you have done for me i would have been nothing today if not for your great spell. i want you my friends who are passing through all this kind of love problem of getting back their husband, wife , or ex boyfriend and girlfriend to contact Dr Emu ,if you need his help you can contact him through his private mail: emutemple@gmail.com or you can contact him through his website https://emutemple.wordpress.com/ fb page Https://web.facebook.com/Emu-Temple-104891335203341 and you will see that your problem will be solved without any delay.

      Delete
  2. This is a testimony that I will tell everyone to hear. i have been married four 4 years and on the fifth year of my marriage, another woman had a spell to take my lover away from me and my husband left me and the kids and we have suffered for 2 years until i meant a post where this man Dr, kuta have helped someone and i decided to give him a try to help me bring my love Husband home and believe me i just send my picture to him and that of my husband and after 48 hours as he have told me, i saw a car drove into the house and behold it was my husband and he have come to me and the kids and that is why i am happy to make every one of you in similar to met with this man and have your lover back to your self His email: drkutaherbalcenter@gmail.com you can also contact him or whatspp him on this +2347054547814 thank so much

    ReplyDelete
  3. All thanks to the great Priest Dr bow for helping me restore back my marriage when i taught all hope was lost.,this Priest helped me, and my relationship is now perfect. Contact for any spiritual work  (@Drbowsolutionhome1) Your partner will definitely love you email him Drbowsolutionhome@gmail.com or whatapp him +2348121786772

    ReplyDelete
  4. How I Got My Ex Husband Back..Am so excited to share my testimony of a real spell caster who brought my husband back to me. My husband and I have been married for about 6 years now. We were happily married with two kids, a boy and a girl. 3 months ago, I started to notice some strange behavior from him and a few weeks later I found out that my husband is seeing someone else. He started coming home late from work, he hardly care about me or the kids anymore, Sometimes he goes out and doesn't even come back home for about 2-3 days. I did all I could to rectify this problem but all to no avail. I became very worried and needed help. As I was browsing through the internet one day, I came across a website that suggested that Dr Aluya can help solve marital problems, restore broken relationships and so on. So, I felt I should give him a try. I contacted him and and told him my problems and he told me what to do and i did it and he did a spell for me. 48 hours later, my husband came to me and apologized for the wrongs he did and promise never to do it again. Ever since then, everything has returned back to normal. I and my family are living together happily again.. All thanks to Dr Aluya Powerful Love Spell that really works. If you have any problem contact him and i guarantee you that he will help you. He will not disappoint you. Email him at: aluya.48hoursspelltemple@gmail.com. or whatsapp him on: +2348110493039 

    ReplyDelete
  5. SPELLS THAT WORKS I am sharing this testimony to partners suffering in their relationships LOVE because there is an enduring solution.
    My husband left me and our 2 kids for another woman for 3 years. I tried to be strong just for my kids but I could not control the pains that torment my heart. I was hurt and confused. I needed a help, so i did a research on the internet and came across a site where I saw that Dr. Aluya a spell caster, can help get lovers back. I contacted him and he did a special prayer and spells for me. To my surprises, after some days, my husband came back home. That was how we reunited again and there was a lot of love, joy and peace in the family.
    You can as well contact Dr.  Aluya  , a powerful spell-caster for solutions on his contact aluya.48hoursspelltemple@gmail.com or directly on Whats App: +2348110493039

    ReplyDelete
  6. HAVE YOU BEEN IN SEARCH FOR GENUINE HACKER'S ONLINE?. HAVE YOU LOST YOUR MONEY TO BINARY OPTION SCAM OR ANY ONLINE SCAM WHATSOEVER?. WELL, YOU HAVE FOUND REDEMPTION IN ASORE CORP.
    asorehackcorp@gmail.com

    Asore Corp is a group of multinational Hacker's, an affiliate of Evil Corp. We make sure by all means necessary that our clients get the best of services on a🔐PAYMENT AFTER JOB IS DONE BASIS✅. Rather than send money and trust a criminal to fulfill your deal, you can make sure the job is done before WORKMANSHIP is paid for. You'll get excellent customer service.
    That's a 100% guarantee. Our Cyber security Technicians are on standby 24/7 to receive your job requests.

    ⚠️ BEWARE OF FRAUDSTARS looking to hoax.
    if you have been a VICTIM, contact : ✉️cyberprecinct@gmail.com for directives.
    Here, it's always a win for you.

    🔸OUR SERVICES🔸
    ➡️Binary Option funds recovery
    ➡️Social media hack
    ➡️Recovery of loan scam
    ➡️Credit repair (Equifax,Experian,Transunion)
    ➡️E mail hack
    ➡️College score upgrade
    ➡️Android & iPhone Hack
    ➡️Website design
    ➡️Website hack
    And lots more.

    DISCLAIMER: Asore Cyber Corp accepts no responsibility for any information,previously given to anybody by clients on as regarding the job. Asore Cyber Corp will not distribute contact information collected on any hacking job other than in the Asore corps Hacker's listings themselves, and will not sell contact information to third parties.

    CONTACT INFO:
    📧 asorehackcorp@gmail.com
    cyberprecinct@gmail.com

    Copyright ©️
    Asore Cyber Corp 2021.
    All rights reserved.

    ReplyDelete
  7. Hello Friend am so happy to give this testimony about an Africa herbalist doctor called Dr Ogudugu who save my life from a herpes virus that almost took my life away, Never in my life did I think herpes virus could be cured by a herbal medicine, Thank you lord for giving me a second chance so am using this medium to reach the life of hundreds of people currently facing such diseases all hope is not lost. How ever chronic is the sickness or disease Dr Ogudugu will cure you permanently from it for i am a living testimony of his miraculous work and you can get in touch with this doctor via greatogudugu@gmail.com or WhatsApp him +2348063739701
    Visit his website: https://greatogudugu.wixsite.com/website
    I will forever be thankful to you Dr Ogudugu, God bless

    ReplyDelete
  8. I was married at 32 and immediately tried to get pregnant. When I was unable to conceive I had blood tests for fertility and was told that I had an FSH (follicle stimulating hormone) of 54 and would not be able to have children. Even though the doctors knew that I had been diagnosed with Hashimoto’s thyroiditis since age 25, no one bothered to check my thyroid levels. my TSH was measured at .001. My Synthroid dosage was lowered. a friend advise me to contact a spiritualist who help with fertility with his medicine, i collected his contact and explain my situation to him he prepared for me a herbal medicine which i took as describe by him. became pregnant very quickly, I had a successful pregnancy. I have my baby august 2017. to get pregnant at age 35 with my 2nd child in september 2019, thank you sir , this is his email contact if you require his help babaka.wolf@gmail.com or Facebook at priest.babaka

    ReplyDelete