Quick Tip: IDA Pro Type Libraries For Analyzing Windows Malware
Added 2021-11-14 01:04:56 +0000 UTCIgor's Tips: Type Libraries Deep Dive
Igor's Tips: Creating Custom Type Libraries
Comments
Discord is better for these discussions since you will have more "crowdsourced" input. Join us there : )
OALABS
2022-03-01 22:13:04 +0000 UTCNot directly no. Obviously you can build signatures (Yara etc.), and try DiE, and maybe Lumina, but I'm not aware of anything that will automatically give you a match. Also, if you are dealing with Delphi there is a specific way you can setup IDA to make the analysis easier, we covered this in a recent livestream https://www.patreon.com/posts/live-stream-vod-60239735
OALABS
2022-03-01 22:11:56 +0000 UTCIs there a "tool" out there that will match a sample with a specific type library? Will a tool like DIE help "you" with this identification. I specifically look at Delphi exe's and need all the help I can get ...
Brian Rogalski
2022-03-01 07:56:58 +0000 UTCI don't think there is a way to load the type libraries by default since they really depend on the binary you are analyzing... if you open an elf you don't want the windows types loaded. But I might be wrong, and I think you could definitely accomplish this using a plugin (if you only analyze windows binaries so you just want the types loaded for everything).
OALABS
2021-12-22 23:48:19 +0000 UTCIs it possible that load both MS SDK and MS NDK at default in IDA?
Lalalazarus
2021-12-22 19:43:16 +0000 UTC
