Hello.
Welcome back.
In this video, I'm going to show you how to repair or fix this memory dump because this memory dump
was dumped from memory.
It has possible corruption in the section alignments and also section headers and import address tables
are not properly set up, so we need to fix it before we can analyze it or do anything further with
it.
And for me, this memory dump came from this memory zero x ten, followed by four zeros, which we dumped
from a previous lesson.
In your case it might not be zero x ten followed by four zeros, so you should make the necessary adjustments
according to your memory dump, which might be different from mine.
Yours could be 0X08 followed by four zeros or zero C followed by four zeros.
So whatever.
First two we need is the P by p, B can be found here under flare.
And then you go to utilities and under utilities you can find p barely.
If you were to open this in P now you will find that pep band will not be able to recognize the structure
of the file.
So if we open it now will be there.
It gives you a warning.
This is because the file has been mapped to memory.
Therefore all the section headers are out of alignment.
So you can see here nothing is recognized.
Normally there will be text, there will be data or data, relocation table and so on.
But at the moment it's all unrecognized.
In order to fix it, you must align the section headers properly.
We will go to Hex editor.
We will use hex editor for Hex.
Editor can be found under flare, but under hex editors.
So I'm going to use Hxd to do this proper adjustments to this file.
So now let us now first close PDB by unloading it, unload all, unload all.
And then here under Hxd, we will open the dump file.
So just drag it into Hxd.
So the first thing to look out for is the header.
The header is intact here as a first byte.
So that means it's okay, we have P here.
That means it's okay.
Now if you go and look at the section headers, section headers should start here, but at the moment
the section header tags here has got three null bytes, three null bytes.
So we should delete these three numbers so that this text will begin at the section alignment.
Here it is the same for every file.
The dot text is the start of the section header.
If you see the numbers in front, that means it's not aligned.
So you have to make sure that the dot text is moved so that it aligns to the left margin here.
So you need to select these three here and cut off these three bytes.
So right click, right click select, and then right click and then cut.
It gives you a warning, click okay.
And now you see the the section header has now been aligned.
But because we cut out three null bytes here, so the entire file is short by three bytes, so you have
to put it back.
So the best place to put it back is just before the end of the section header.
Look for the dot.
See here here before this for zero despite for zero.
And then right click and paste inside.
Click.
Okay.
And now you have pasted three bytes here.
Now notice that the session headers always got a dot followed by the by the text here.
Also saved dot data dot data dot reload.
So the dot is part of the title, the string part of the string.
So you must always make sure there's a dot.
So now that you have cut three bytes here and put put back the three bytes here, you have preserved
the size of the file without damaging it.
And you also align the session header to the left margin here.
So now you can save this.
This is called session alignment.
So you save it and now you close it.
Notice he has made a backup for you.
So now if you open this file back.
Okay, so now you notice after we have repaired the session alignment, you can see all the session
headers clearly.
Now, dot text data, dot data, dot relog.
So the next thing to do is to go and unmap the session headers.
The map is necessary because all this raw address was mapped from memory.
So there are all out of synchronization with the file.
So we have to make sure that the raw address and the virtual address is the same.
So we have to change all these column here to become the same as this column here.
So to do that, we change this to 1000, this 1 to 12,000, and then here is 19,000.
So change this to 19,000 and here is one D followed by three zeros.
So we put one D followed by three zeros.
Next thing is to fix the this column the raw size.
So the raw size is calculated by taking 12,000 -1000 K 11,000.
So this is correct.
And then for this, 7000 is 19,000 -12,000.
That gives you 7000.
So this is correct.
But for this one, this is wrong.
This one is from 1D30 -19.
Three zeros.
Okay, let's open our calculator.
And we change it to programmer calculator.
We take one D followed by three zeros in hex, select hex, one D followed by three zeros.
So now we're going to -19, followed by three zeros.
So we have to click on minus, minus and then 19 followed by three zeros.
You should get four followed by three zeros.
So this one should change to four.
4000.
So once you change 4000, this part here, which is the data section, will the green color will fill
up the entire block.
So we put 4000
hit enter.
And now you see it fills up the entire block.
Now the relocation session, we can just safely ignore it.
No need to do anything about it.
So you leave it as it is.
The next thing we need to fix is the virtual size.
The virtual size is also need to be unmapped, so unmap it to become the raw size.
So here we need to change this to become this.
This to become this.
So let's do it now.
This should be 11,000.
This one should be 7000.
This one should be 4000.
And this one should be 1000.
All right.
So now we have unmap it.
We can go and check the imports as well.
So we can see the import address table is intact.
Now, the import address table is intact because of two reasons, because we have properly do the proper
session alignment.
Now, earlier on we use the hex editor to do the session alignment.
Let me show you the hex editor.
Okay.
This is a hex editor.
Remember, we cut out three null bytes in front of this text and bump it, put it back inside here.
Now, if we had simply cut out three null bytes but did not put it back here, the three null bytes.
What happens is you get import address table, which is all red in color.
That means it is screwed up, not properly aligned.
So it is always important to whatever null bytes that you cut out to align the section header, you
must put it back so that your import address table will be fixed.
He will not be red.
Okay.
So now you can see is proper all the functions there.
Now the last thing we need to do is to fix the base address.
So we have to rebase it.
So click on optional header.
And over here at the moment, the base address is 40 followed by four zeros.
So because this dump came from the address of let's, let's see the address, my came from this address.
100 000X 100,000.
So I have to put the base address as 100,000.
For you, it might be different.
He might be 80,000 or 0.
C zero followed by four zeros and so on.
So you need to follow your base address.
Where did you dump this from?
For me, it's this, so I'll have to use this as a new base address.
So I go to here and image base here.
I will rebase it to.
100,000.
That means one followed by five zeros.
And hit.
Enter.
All right.
So now I have already done the session alignment and fixed the session headers and also the import address
tables and also rebased it.
I am now ready to dump this so I can go to right click on this one, right click on this and save the
executable as.
And now I can see SBC fixed
and then click Save.
Okay.
So it has made to specifics and now we can open it in either to make sure it is properly fixed so we
can now close all this, close this and close this and this.
And let's try to open this.
SBC fixed either to see whether it can can read it.
Okay, click new and go and open your fixed file.
Click open.
Click.
Okay.
Let Aida do the analysis.
Yes, looking good.
You can see the API functions here.
Here as well.
And you can see the import address tables all there and the imports for the functions.
That's good.
So let's see the entry point.
So here you can see there is a set error code and exit process.
That means the entry point should be somewhere here before the error and the end the exit process.
So the first function that it calls is this.
So this must be the entry point.
So we double click on this and go there and see what we get.
And good news.
True enough.
You can see all the API functions in text clearly labeled.
That means we are successful fixing the the dump from memory unmapping and doing section alignment.
All was successfully done.
And the final test is we see.
Let's see.
You can see any strings.
So go to view open subviews and then look for strings.
And there you go.
You can see lots of strings, although it's encrypted, but you can see the strings are there.
Right.
You can see the strings.
This was a successful operation.
We have done the session alignment, fix the session headers and also unmap the file.
Then we have done and also fix the import address tables.
So that's all for this video.
Thank you for watching.