About This File
IDA loader module for Hidden Bee's custom executable file format.
Here's a half-day project that I did this weekend for my own edification. Perhaps someone will benefit from the source code in the future.
While reading hasherezade's research on the Hidden Bee malware family's custom file format, I was struck with the thought that this use-case seemed particularly well-suited for an IDA custom loader module. The IDA loader module approach has a few advantages over the previous approach: it's fully automated, requiring no additional programs, plugins, or scripts; the imports have proper names and type information, allowing IDA's ordinary P.I.T. algorithms to propagate the information; and the user can relocate the database to an arbitrary base address.
There are no comments to display.
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!Register a new account
Already have an account? Sign in here.Sign In Now