Wednesday, September 7, 2011

Parsing API calls in Windows binaries

Salaam,

Python could be my closest friend here, it helps a lot when you actually exposed to the richness of Pythonists out there!

Here is the example of getting API calls from calc.exe, a benign software in Windows

Here is the example of getting API calls from a Windows binary.


Next step, hooking the intended API calls using Python with pydbg in PaiMei framework.

This process proved to be working on both Windows 7 and Ubuntu 11.04