I have memory dump of injected process. But the malware load libraries/functions dynamically and I need to resolve this. For example, If malware will use createThread, first get address of this function with getprocaddress then kept the pointer into a variable. To call function use variable.So I need to resolve dynamic addresses to disassemble. How can I do it?
How can I resolve dynamic addresses (for APIs,DLLs etc.) to disassemble in IDA Pro?
ida;dynamic linking;memory dump