Using CAPA and IDA Pro to Identify Runtime Linking in Malware
· 8:10 · Watch on YouTube ↗
Summary
A reverse-engineering tutorial demonstrates using CAPA output and IDA Pro to locate runtime linking, recognize PEB access, trace code references, and prepare for time-travel debugging.
Key points
- CAPA's verbose output helps locate code areas associated with runtime linking in IDA Pro.
- The tutorial identifies PEB access and traversal as clues that code is finding libraries or modules loaded in memory.
- Cross-references help trace the runtime-linking code to the malware's starting point and build analysis context.
- IDA Pro's cloud decompiler can be used alongside disassembly, but it requires internet access, which may conflict with an isolated analysis VM setup.
- The presenter plans to use a time-travel debugging trace in the next video and says a trace will be available in the course material.
Article Details
- Topics
- [00:15] Using CAPA output to locate runtime-linking code in IDA Pro
- [02:25] Recognizing PEB access and traversal as a clue to runtime linking
- [04:03] Following cross-references to identify the malware's starting point
- [06:24] Using IDA Pro's cloud decompiler alongside disassembly
- [07:42] Preparing a time-travel debugging trace for further analysis