oalabs
patreon
IDA Reverse Engineering - Module 1.2
🕑 Added 2025-01-27 15:00:12 +0000 UTCModule 1, Part 2 of our IDA reverse engineering series. A step by step guide to marking up Windows PE binaries using IDA. In this tutorial we continue our analysis of the stage 1 DLL diving into the only export "work".
This is a very basic tutorial that reinforces the concept of Function Definitions, Types, variable Names, Enums, and the "API-first approach" to reverse engineering. We also have a small explainer about string operations optimized by the compiler.
Sample
93f9703cc7339014cd1bc82da0ab8909957112b93fba2430b5ee90a1d424a5ed
References
Process32First
https://learn.microsoft.com/en-us/windows/win32/api/tlhelp32/nf-tlhelp32-process32firstPROCESSENTRY32
https://learn.microsoft.com/en-us/windows/win32/api/tlhelp32/ns-tlhelp32-processentry32Process32NextW
https://learn.microsoft.com/en-us/windows/win32/api/tlhelp32/nf-tlhelp32-process32nextwIsWow64Process
https://learn.microsoft.com/en-us/windows/win32/api/wow64apiset/nf-wow64apiset-iswow64processGetTempPathW
https://learn.microsoft.com/en-us/windows/win32/api/fileapi/nf-fileapi-gettemppathwGetTempFileNameW
https://learn.microsoft.com/en-us/windows/win32/api/fileapi/nf-fileapi-gettempfilenamewCreateFileW
https://learn.microsoft.com/en-us/windows/win32/api/fileapi/nf-fileapi-createfilewFile Access Rights Constants
https://learn.microsoft.com/en-us/windows/win32/fileio/file-access-rights-constants
Comments
Amar
Thanks a lot for this math or logical demonstration of API and it is really great way of explaining.... love your work Sergi
