Ordinals

Here the PE parsing tool Professional PE Explorer aka Puppy is used to display the DLL exports. Notice how each has a name, ordinal, and relative virtual address (RVA).

Continue reading


IDA_Pro_rundll32

Notice the path of rundll32.exe as the main program to load with arguments of the dll file and ordinal number. Make sure you replace these paths with whereever your system32rundll32.exe is and your dll file.

Continue reading


Success

The file is in working order and successfully run. We’ve complied with the author’s request in this blog.

Continue reading


GetProcAddress_REc

Notice there are no obvious clues that this is GetProcAddress in the disassembly, however, the fact that the function is small and only contains references to apphelp funcs and also is sandwiched between two unrelated thunks in the thunk list, shows us that this is the GetProcAddress problem.

Continue reading


OEP_RECon

We take the last 5 digits of the 32-bit address and place it into the OEP box in ImpREc. This is the offset of the OEP

Continue reading


ImpRec_Proces_Select

Make sure to run ImpRec as ADMIN or else your debugged process may not appear in the dropdown. Also make sure you did not close out the process in the debugger.

Continue reading


6_Dump_debugged

The code may look like this or it could just be a series of bytes without assembly instructions listed. The final step is shown

Continue reading