Posts

Introduction When developing with C or C++ on Windows systems, we generally use GetProcAddress to call a function inside a DLL. The process is fundamentally simple: the DLL is loaded into memory with LoadLibrary, and then the DLL’s handle value and the name of the searched function are passed to GetProcAddress. But how exactly does this process work in the background? How does the operating system find the string value we provided inside a massive memory block and return its address to us? In this post, instead of using standard Windows APIs, we are writing our own GetProcAddress function by parsing the memory structure of a PE file. ...

Introduction Analyzing exactly how Windows APIs work under the hood gives us many new techniques and tactics when writing malware. In this post, we will explore how to implement one of the most frequently used APIs, GetModuleHandle, from scratch without calling a single Windows API. Of course, one of the main reasons for doing this is to hide this heavily used function from the IAT (Import Address Table). As you know, GetModuleHandle returns the base memory address of a loaded module given its DLL name. What it actually does is quite straightforward: it scans a list of loaded modules maintained by the OS loader for each process. This list resides inside the Process Environment Block (PEB) structure. The focus of this post will be to show, step by step, how to manually access the PEB and parse this list. ...

Apc Injection Today, there are many techniques we use to execute our payload when writing certain malware. In this post, we will focus on the APC Injection technique, which is one of the most fundamental and effective methods where we use the natural operation of the operating system to our advantage. Without wasting time on standard parts that are repeated in every injection, like memory allocation, we will focus directly on the technique. ...

In this article, I will explain how to gather information about processes or threads using the CreateToolhelp32Snapshot function. If we want to interact with a target process in the tools we develop or the malware we write, we first need to pinpoint exactly where that process resides in the system. We will divide our operation into two main stages. First, starting with plain text (such as a process name like notepad.exe), we will scan all the processes on the system and extract our target’s unique identification number, namely its PID. In the second stage, using this PID we obtained, we will dive into the target process and capture a valid thread that we can manipulate or hijack. ...

Remote_Thread_Creation In this article, I will talk about a technique in which we suspend a legitimate process, inject shellcode into its memory region, and then manipulate the RIP/EIP registers of its existing thread. In the cybersecurity world, APIs such as CreateRemoteThread are generally the preferred choice for executing code inside a target process. However, these functions are monitored very tightly by security mechanisms (AV/EDR) and blocked instantly. Thread Hijacking, on the other hand, instead of creating a brand-new and suspicious thread from scratch, aims to “steal” the route of an already existing legitimate thread. ...

Process Enumeration Finding the Target’s PID Value (EnumProcesses) When developing malware, we often need a legitimate running process (e.g., notepad.exe or explorer.exe) on the system to execute techniques like hiding or running our payload. We need to speak Windows’ language and find the PID (Process ID) value of that process. This process of listing the active processes on the system to find our target’s PID or gather similar information about processes is generally called Process Enumeration. In this article, we will look step-by-step at how to do this from scratch using the standard Windows EnumProcesses API. ...

Process Enumeration Finding the Target’s PID Value (NtQuerySystemInformation) During malware development ,we generally need a legitimate process that already exists on the system (such as notepad.exe, explorer.exe, or svchost.exe) to hide our payload in memory or to execute various techniques in a stable manner. This is exactly where we refer to the practice of listing the currently active processes on the system to extract our target’s PID value or to collect telemetry about processes, generally known as Process Enumeration. In our previous article, we looked step-by-step at how to perform this operation from scratch using Windows’ standard EnumProcesses API. However, in the cybersecurity world, there are always more complex and harder-to-learn ways… ...

When writing programs in high-level languages, there are many operations handled automatically in the background that we must manage manually in low-level languages (especially Assembly). Among the most critical of these are the prologue and epilogue sequences. Before diving into this topic, let’s touch upon a few fundamental concepts: Register: The fastest data storage area within the CPU; data to be processed is held here. Stack: A memory area operating on a LIFO (Last In, First Out) basis, holding temporary data during function calls. Stack Frame: A block of memory allocated on the stack each time a function is called, containing arguments and local variables. ESP/RSP: The stack pointer; it points to the top of the stack. It is called ESP in x86 and RSP in x64 architecture. EBP/RBP: The base pointer; it holds the base address of the stack frame and serves as a reference point for accessing variables. Calling Convention: A set of rules determining how arguments are passed to functions and how return values are retrieved. Push: Pushes a value onto the stack, moving the stack pointer down. Pop: Pops the value from the top of the stack, moving the stack pointer up. All these concepts form the foundation for understanding prologue and epilogue operations. Essentially, these two sequences consist entirely of setting up and tearing down the stack frame. ...

RC4 Encryption RC4 is a symmetric stream cipher that encrypts data byte by byte rather than in blocks. Under the hood, it consists of two primary phases: the Key-Scheduling Algorithm (KSA), where the key is initialized and permuted in memory, and the Pseudo-Random Generation Algorithm (PRGA), which generates keystream bytes to be XORed with the data. Thanks to its symmetric architecture, the exact same routine is utilized for both encryption and decryption. ...

XOR Encryption In the world of malware development, one of the most critical factors determining the lifespan of your payload is how effectively you can conceal it. If you embed shellcode or a PE file into memory in plain text, static analysis tools and antivirus (AV) signatures will flag it within seconds. This is precisely where payload encryption comes into play. In this post, we will examine the XOR algorithm—one of the most fundamental yet heavily modified encryption techniques in the malware domain. We will start from the basics and progress toward complex, position-dependent rolling structures. ...