06 - Finding Functions from the Export Directory and Using Seeds to Compute Checksums
Part 6 continues to explore runtime-linking by seeing how Lockbit not only uses the EXPORT_DIRECTORY structure to find APIs, but also how it uses the DLL name seed to compute the checksum values to identify necessary APIs.
Join this channel to get access to perks:
/ @jstrosch
Cybersecurity, reverse engineering, malware analysis and ethical hacking content!
🎓 Courses on Pluralsight 👉🏻 https://www.pluralsight.com/authors/j...
🌶️ YouTube 👉🏻 Like, Comment & Subscribe!
🙏🏻 Support my work 👉🏻 / joshstroschein
🌎 Follow me 👉🏻 / jstrosch , / joshstroschein
⚙️ Tinker with me on Github 👉🏻 https://github.com/jstrosch
🤝 Join the Discord community and more 👉🏻 https://www.thecyberyeti.com
0:38 Seed from DLL name
1:20 Computing checksum from API name
4:00 Getting the API name
4:36 Using the export directory structure
5:40 Starting in the export directory
8:00 Debugging to see API names
10:09 When a precomputed value matches
12:00 Easy button to find APIs