oalabs patreon

Quick Tip: IDA Pro Type Libraries For Analyzing Windows Malware

🕑 Added 2021-11-14 01:04:56 +0000 UTC

Comments

OALABS

Discord is better for these discussions since you will have more "crowdsourced" input. Join us there : )

OALABS

Not directly no. Obviously you can build signatures (Yara etc.), and try DiE, and maybe Lumina, but I'm not aware of anything that will automatically give you a match. Also, if you are dealing with Delphi there is a specific way you can setup IDA to make the analysis easier, we covered this in a recent livestream https://www.patreon.com/posts/live-stream-vod-60239735

Brian Rogalski

Is there a "tool" out there that will match a sample with a specific type library? Will a tool like DIE help "you" with this identification. I specifically look at Delphi exe's and need all the help I can get ...

OALABS

I don't think there is a way to load the type libraries by default since they really depend on the binary you are analyzing... if you open an elf you don't want the windows types loaded. But I might be wrong, and I think you could definitely accomplish this using a plugin (if you only analyze windows binaries so you just want the types loaded for everything).