IDA Reverse Engineering - Module 1.2

Module 1, Part 2 of our IDA reverse engineering series. A step by step guide to marking up Windows PE binaries using IDA. In this tutorial we continue our analysis of the stage 1 DLL diving into the only export "work".

This is a very basic tutorial that reinforces the concept of Function Definitions, Types, variable Names, Enums, and the "API-first approach" to reverse engineering. We also have a small explainer about string operations optimized by the compiler.

Sample

93f9703cc7339014cd1bc82da0ab8909957112b93fba2430b5ee90a1d424a5ed

References

• Process32First 
  https://learn.microsoft.com/en-us/windows/win32/api/tlhelp32/nf-tlhelp32-process32first

• PROCESSENTRY32
  https://learn.microsoft.com/en-us/windows/win32/api/tlhelp32/ns-tlhelp32-processentry32

• Process32NextW 
  https://learn.microsoft.com/en-us/windows/win32/api/tlhelp32/nf-tlhelp32-process32nextw

• IsWow64Process
  https://learn.microsoft.com/en-us/windows/win32/api/wow64apiset/nf-wow64apiset-iswow64process

• GetTempPathW
  https://learn.microsoft.com/en-us/windows/win32/api/fileapi/nf-fileapi-gettemppathw

• GetTempFileNameW
  https://learn.microsoft.com/en-us/windows/win32/api/fileapi/nf-fileapi-gettempfilenamew

• wcsrchr
  https://learn.microsoft.com/en-us/cpp/c-runtime-library/reference/strrchr-wcsrchr-mbsrchr-mbsrchr-l?view=msvc-170

• CreateFileW
  https://learn.microsoft.com/en-us/windows/win32/api/fileapi/nf-fileapi-createfilew

• File Access Rights Constants
  https://learn.microsoft.com/en-us/windows/win32/fileio/file-access-rights-constants