Hello.
Welcome to a new section on code injection.
This time we are going to take a look at net new code injection, never code injection use by creating
views on sections of memory and mapping them to remote processes.
The basic concepts involved in this injection are the more.
It is a type of internal process, communication or IPC, the mapping view techniques.
Letting views are accomplished by sharing memory between due processes, and now they share his memory
if a target process that is the meaning or view.
Then and now, the execution is set many remotely via the talent process, so that can happen because
the local view of the memory is being shared even remotely.
So that concept is called mapping the.
Mechanism or net new injection in this diagram on the left who have maybe children and even embedded
childhood on the right is a target process, which is going to be injected.
The first step is to create a new section in malware Trojans memory.
And this is accomplished by using the API function call and to create session, as you can see here.
After calling this API function, you will get this new session in the memory email that Trojan.
The second step involves creating a local view.
A view is actually real, assessing a session inside the memory, and this local view is accomplished
by calling the API function and view of session, as you can see here, these blue shaded area is the
could you?
The tests involves copying the shackle to the newly created section by using the look of you.
And this is accomplished by by using a copy function named Poppy is a see language function.
So after copping shackled, the new session will be populated with the shackles of the American Legion,
and it is accessible using the view.
And if Offset is to create a remote view in each other process and that is accomplished by using and
the U.S., which is actually the same API, it was used in the two.
And finally, the fifth step is to assess the issue, and this is accomplished by using the API function
call.
How do you create user track?
And in this in this step, the miracle union actually use the target process three months of you.
As a proxy to access the show locally and a security.
So this is a stealthy technique, because it will appear as though the charcoal is coming from the tanker
process, rather from the malware Trojan.
Advantages and disadvantages of Mamu injection advantages.
Firstly, there is no need to use which he and Wright possess memory gearbox, who calls classic telltale
signs or possess injection, which antivirals can detect.
And other advantages by sharing memory, we make it appear like a legitimate remote process is executing
a shocker.
The target process as a proxy for the malware, the malware runs the show via the tagging process,
and this is more stealthy than continuously, Dennis.
The disadvantages are that it makes use of the API and demonization, which may be monitored by a.
So that's all for the theoretical background concepts on this map.
View buccal injection.
Thank you for watching.