In order to avoid detection by users, operating systems, or AVs, malware often uses unexported functions. Since these functions are internal, one can’t locate them using trivial ways, like WinAPI functions, and attackers are required to think outside of the box in order to find the hidden gems inside the box.
In this talk, I’ll share my journey searching for ways to locate these functions in memory, in runtime, using tools like IDA and IDAPython scripts. I’ll show what worked, what didn’t work, and how I overcame the challenge of compatibility between Windows versions.