Tracing Memory Allocations with VirtualAlloc, VirtualAllocEx and NtAllocateVirtualMemory
There is more than one way to trace memory allocations. If VirtualAlloc is not working for you, then lookout for VirtualAllocEx and NtAllocateVirtualMemory, instead.
Malware usually has additional payloads embedded within it. VirtualAlloc is used to allocate memory for unpacking these payloads. By tracing the memory allocations, we can identify where to manually dump these payloads into separate files for further analysis. The REMAI Course (Udemy Reverse Engineering & Malware Analysis Intermediate: https://www.udemy.com/course/malware-...) and the MALDEV1 course ( https://crackinglessons.com/learn) show how to use xdbg and ProcessHacker to unpack and dump payloads from malware.
VirtualAlloc:
https://docs.microsoft.com/en-us/wind...
VirtualAllocEx:
https://docs.microsoft.com/en-us/wind...
NtAllocateVirtualMemory:
https://docs.microsoft.com/en-us/wind...
NTSTATUS Values:
https://docs.microsoft.com/en-us/open...