In this lesson, we are going to take a look at the apps that are used, so go and download this Project
zero for context, injection and zip it and put it in the malware to folder.
Inside it, you will find a few files.
These files are also using the malware development that will one cause.
In here, you have to compile a batch script.
The message was being shellcode we sure generated using Metasploit on Kali Linux and the message Moxie,
which is the formatted version article there, was used in this quote here.
So this is a transition CBP source code itself on the top.
We have the usual includes.
And then here is your 64bit code to display message box generated using Metasploit on Kali Linux.
The size is 27 bytes.
You should also put it here.
The length of the shower could be.
Then we have a user defined function code, such for process.
And this works exactly the same as the lesson we did in the government course.
Have a one.
And then this is something you hear.
Search for trick search for is almost similar to search for process.
The difference is that over here you are using create to try to snapshot and passing a barometer of
snip snapshot track instead of the snapshot process, which was used when you are searching for a process
now to understand this.
You can look for the missing library.
I have provided this file for you containing the note saying the references so you can go here and look
for create 232 two snapshot and in over here you do not need a first parameter, a snapshot tray.
So this is the reference to.
The documentation for create two, three two snapshot in the first married woman costs.
He used this in order to search for processes in memory, and the first barometer is the Flex, which
is, you specify one of these here.
So if you are looking for a snapshot of all the processes running memory, he will provide this parameter
snap process.
See here social processes.
He passed the first parameter snap process.
However, if you are looking for searching, you are looking for tracks running in memory and then you
should provide this parameter instead.
As can be seen here, when you are searching for track, you pass the snap track as the first parameter.
So once you pass this first parameter, you create a snapshot.
The other important strategy is, you know, he's trick and treat to structure, which is define who
is created here and use by the creator snapshot who are here.
You need this structure in order to save the snapshot.
So, so once you can create this snapshot, you save it to this.
Handle to the snake.
And here is where you iterate through.
So I teach you by using this structure trick and treat every two, so the explanation for that is found
here.
Amazing library territory to structure consists of all these members, but the most important one is
your.
On the process, Heidi.
And you will hear you see on the process it is the body of the pairing process.
So despite his return from here, when he search process, he will return to Paddy and you used tempted
to search for the trapped within the process.
So that is important because you need to get a handle to the track.
So here, once you have found the idea that matches the Pattern ID, you will then return the handle
to the track and save it here.
So now that you've got to be returning to the corner, so that's where you can make use of the handle
to try to perform your contacts, your contacts injection.
And this is the user defined function where you actually inject the now injecting chocolate.
So I sense all of these parameters, the idea, the pairing process, the handle to the vetting process,
the payload itself and a lengthy debate.
Now we'll hear the first thing you do is you search for a track based on the video that you got.
And then over here you fail to find the train.
Then you find out you were to show an error message saying Fail to hijack track.
And here is your optional function to decrypt failure.
If you use payload that was encrypted, then here's where you should put a good.
Over here is where you actually create a little memory in the target process by using which?
Hello.
Yes.
And you can refer to it over here, which you discussed before following cause number one, which he
likes.
And we'll hear you then write your shock to the educated meeting memory.
And here is something new.
This is where you suspend the trip.
So the suspension, you can go and look at my school.
To spend money in library references who are here.
Suspension, so suspension is way you pass a check, you just passed the first bear guess only one parameter,
which is to handle, and once you call it, it said it would be suspended.
There is one other thing which I want also talk about directly to annex territory to next is use when
you are searching for a check up here.
Totally do next.
I trip through the least of the trip in memory.
And then once you find, you know, we tell you, yes, you should be aware.
OK, let's come back to inject.
So after you suspend the train, you're now carry initialise contents, such because you are going to
use this content structure and do save the contents till you get back from the ISS function.
Why do you need context?
Because a context contains information about the running running track, and there is one particular
information called the extraction point.
You want to temper.
That's why you need to do initialize contents and pass it to this API.
So what this context looks like, you can't always refer to your method.
So use your messaging.
The structure contents.
The important one which we're interested in is this one.
R.I.P..
He should point out, is certainly, to be fair, game.
He will be VIP.
So this is a one we're going to temper.
So here we are after suspending the train, we initialize, this one contains flags to fool because
you only capture everything about the contest.
And over here, the car, they get track on decks and past the perimeter, one which is the handle to
the track and whatever information about the train will be safe in a context which we create here.
So get get track contacts, you can really hear key track on things, so get a check on thanks function,
we retrieve the contents of the specified track.
And and save in the second barometer.
So now that you got the contents of the set, you can go and modify the EIB, he was 32 bit and 64 bit
and you modify the R.I.P. to point to your chako.
This is your shellcode.
We'll hear your B remote code.
Right here, you allocate memory in the process.
And then you allocate memory in a remote process.
And here is where you copy appealed to the remote process to allocate a memory.
And is where you modify the instruction pointer to point to your chocolate.
Which you all copied over here.
So this is how it works.
And then finally, you call these separate contacts, you know that you modify the contents of the contract
with your new contacts.
So set contacts, access to parameters and you can refer to it again over here.
Cetera contacts?
OK, so that's two parameters.
It certainly won't modify modifying the context of as soon as the new context the is set for the trip.
So here we pass the new contacts saying we can modify R.I.P. so that this API will cost this trend to
use these new contacts.
Finally, you call the resume trade.
So the resume trade will then run your chocolate.
This is a resume API, so we access only one parameter and it's set which you want to resume that was
previously suspended.
So this is how the API works.
And here is your main function, which ties in everything together.
So the first thing he does is search for the process in this case, Microsoft Paint.
Once it finds it, he will return it to this variable and then Ethiopia ID is zero.
That means you have found the body.
So you bring a message to let the user know that your Microsoft Bing is such and such.
Next, you will use the open process API to open the process containing this guide and return a handle
and story in this variable.
And if the process is not now, then you will call the inject injection function and pass all these
parameters to, as we are discussing.
And finally, you will closely process after injecting.
So this is how he contacts thread injection works.
So the next lesson you are going to do any practical by compiling the U.S. run.
So that's all for this video.
Thank you.