Hello and welcome in the first course on this.
And then we have learned about process injection, and in this case, now we are going to go through
some more advanced techniques for injection.
So now we're going to learn about context injection injecting payload to another.
What is Trent context, quite right, context is information about a threat.
For example, information about memory allocation and body heat and stack the register values and the
next instruction pointer instruction pointer is the address in memory ready Cheney supposed to execute
the next instruction.
And you can exploit it to our advantage in context, injection and mechanism or contextual action on
the left.
He's our malware trojan with an embedded payload containing a shackle that can show a message box on
the right.
He's your target process, which, for example, is Microsoft Paint hitting the target.
We also have a tray running in the process.
Every process has quite a tray.
And this is the train that is running in the target process in the first set, the malware Trojan.
You search for the target process once he finds it.
He would then search for the chip inside the target process.
Next, you allocate memory in a target process using the Microsoft API function call Virtual X. The
purpose of that is to create allocated memory so that you can copy over to the allocated memory.
The next step is the malware Trojan will write the code over to the allocated memory using the API call
write process memory.
Next, the Trojan will suspend the threat of the targeted process by using the API function, call,
suspend, track the purpose of suspending your checks so that you can change the instruction pointer
for the check so that the instruction pointer will point to the code when he resumes later.
Next step is to change the instruction pointer.
So this is where the malware will get the instruction pointer off the track and modify temporary in
order to bring it to the next session, which is the code itself.
He does state by using two apps.
One is called direct contact, which is not shown here and then sent straight contacts.
Short, yeah.
So essentially, contacts would change the interaction point of the set so that he will then execute
initial code in the next step.
So this is the next step where the medical unit will resume the trick by calling by using the API function
call resume zoom trick.
So at this point in time, the trigger will then execute the shark.
Advantages and disadvantages of direct contest ingestion, the advantages is no need to create remote
trick, you can use the existing trait of the target process itself.
So this makes it more stealthy.
There are also disadvantages, the disadvantages that you may crash the parents process of the check
when the hijacked jet exits, you may also disrupt what the original track was doing and disadvantages
it.
It takes a little bit longer to inject compared to process ingestion.
There is a slight delay a leg, so that's all for this juridical background on direct contact ingestion.
Thank you for watching.