Monday, November 12, 2018

IDA common locations to put breakpoints

I'm learning that if you're looking for somewhere to breakpoint in confusing malware try

jmp eax ;   // or any register for that matter, it's jumping to a dynamic address
call eax ;   // or any register for that matter, it's jumping to a dynamic address
call dword_xxx;   // it's jumping to an address saved in data, perhaps dynamically loaded

Also a breakpoint in
ntdll.dll -> ResumeThread ; // malware may suspend and then restart when completed editing
ntdll.dll -> ResumeProcess ; // malware may suspend and then restart when completed editing

Also look at the IDA color coded graph across the top, look for a large chunk of data, which is probably the packed code, find the label for it, for xrefs to that label, then breakpoint there.

7 comments:

  1. Thank you Dr.Ogudugu for the great work you did for me when my lover broke my heart. Dr.Ogudugu was able to bring my lover that left for about 2 months back to me within 48 hours of me contact Dr.Ogudugu. Contact Dr.Ogudugu on greatogudugu@gmail.com or better still you can give Dr.Ogudugu a call onWhatsApp +27663492930 for a better understanding for what i just said about him..

    ReplyDelete
  2. This is a testimony that I will tell everyone to hear. i have been married four 4 years and on the fifth year of my marriage, another woman had a spell to take my lover away from me and my husband left me and the kids and we have suffered for 2 years until i meant a post where this man Dr, kuta have helped someone and i decided to give him a try to help me bring my love Husband home and believe me i just send my picture to him and that of my husband and after 48 hours as he have told me, i saw a car drove into the house and behold it was my husband and he have come to me and the kids and that is why i am happy to make every one of you in similar to met with this man and have your lover back to your self His email: drkutaherbalcenter@gmail.com you can also contact him or whatspp him on this +2347054547814 thank so much

    ReplyDelete
  3. All thanks to the great Priest Dr bow for helping me restore back my marriage when i taught all hope was lost.,this Priest helped me, and my relationship is now perfect. Contact for any spiritual work  (@Drbowsolutionhome1) Your partner will definitely love you email him Drbowsolutionhome@gmail.com or whatapp him +2348121786772

    ReplyDelete
  4. How I Got My Ex Husband Back..Am so excited to share my testimony of a real spell caster who brought my husband back to me. My husband and I have been married for about 6 years now. We were happily married with two kids, a boy and a girl. 3 months ago, I started to notice some strange behavior from him and a few weeks later I found out that my husband is seeing someone else. He started coming home late from work, he hardly care about me or the kids anymore, Sometimes he goes out and doesn't even come back home for about 2-3 days. I did all I could to rectify this problem but all to no avail. I became very worried and needed help. As I was browsing through the internet one day, I came across a website that suggested that Dr Aluya can help solve marital problems, restore broken relationships and so on. So, I felt I should give him a try. I contacted him and and told him my problems and he told me what to do and i did it and he did a spell for me. 48 hours later, my husband came to me and apologized for the wrongs he did and promise never to do it again. Ever since then, everything has returned back to normal. I and my family are living together happily again.. All thanks to Dr Aluya Powerful Love Spell that really works. If you have any problem contact him and i guarantee you that he will help you. He will not disappoint you. Email him at: aluya.48hoursspelltemple@gmail.com. or whatsapp him on: +2348110493039 

    ReplyDelete
  5. SPELLS THAT WORKS I am sharing this testimony to partners suffering in their relationships LOVE because there is an enduring solution.
    My husband left me and our 2 kids for another woman for 3 years. I tried to be strong just for my kids but I could not control the pains that torment my heart. I was hurt and confused. I needed a help, so i did a research on the internet and came across a site where I saw that Dr. Aluya a spell caster, can help get lovers back. I contacted him and he did a special prayer and spells for me. To my surprises, after some days, my husband came back home. That was how we reunited again and there was a lot of love, joy and peace in the family.
    You can as well contact Dr.  Aluya  , a powerful spell-caster for solutions on his contact aluya.48hoursspelltemple@gmail.com or directly on Whats App: +2348110493039

    ReplyDelete
  6. HAVE YOU BEEN IN SEARCH FOR GENUINE HACKER'S ONLINE?. HAVE YOU LOST YOUR MONEY TO BINARY OPTION SCAM OR ANY ONLINE SCAM WHATSOEVER?. WELL, YOU HAVE FOUND REDEMPTION IN ASORE CORP.
    asorehackcorp@gmail.com

    Asore Corp is a group of multinational Hacker's, an affiliate of Evil Corp. We make sure by all means necessary that our clients get the best of services on a🔐PAYMENT AFTER JOB IS DONE BASIS✅. Rather than send money and trust a criminal to fulfill your deal, you can make sure the job is done before WORKMANSHIP is paid for. You'll get excellent customer service.
    That's a 100% guarantee. Our Cyber security Technicians are on standby 24/7 to receive your job requests.

    ⚠️ BEWARE OF FRAUDSTARS looking to hoax.
    if you have been a VICTIM, contact : ✉️cyberprecinct@gmail.com for directives.
    Here, it's always a win for you.

    🔸OUR SERVICES🔸
    ➡️Binary Option funds recovery
    ➡️Social media hack
    ➡️Recovery of loan scam
    ➡️Credit repair (Equifax,Experian,Transunion)
    ➡️E mail hack
    ➡️College score upgrade
    ➡️Android & iPhone Hack
    ➡️Website design
    ➡️Website hack
    And lots more.

    DISCLAIMER: Asore Cyber Corp accepts no responsibility for any information,previously given to anybody by clients on as regarding the job. Asore Cyber Corp will not distribute contact information collected on any hacking job other than in the Asore corps Hacker's listings themselves, and will not sell contact information to third parties.

    CONTACT INFO:
    📧 asorehackcorp@gmail.com
    cyberprecinct@gmail.com

    Copyright ©️
    Asore Cyber Corp 2021.
    All rights reserved.

    ReplyDelete
  7. I was married at 32 and immediately tried to get pregnant. When I was unable to conceive I had blood tests for fertility and was told that I had an FSH (follicle stimulating hormone) of 54 and would not be able to have children. Even though the doctors knew that I had been diagnosed with Hashimoto’s thyroiditis since age 25, no one bothered to check my thyroid levels. my TSH was measured at .001. My Synthroid dosage was lowered. a friend advise me to contact a spiritualist who help with fertility with his medicine, i collected his contact and explain my situation to him he prepared for me a herbal medicine which i took as describe by him. became pregnant very quickly, I had a successful pregnancy. I have my baby august 2017. to get pregnant at age 35 with my 2nd child in september 2019, thank you sir , this is his email contact if you require his help babaka.wolf@gmail.com or Facebook at priest.babaka

    ReplyDelete