Hello and welcome back.
We are now going to discuss API functions used in new injection.
So please download this project zero five Mamu injection and zip and put it into the mountain dashboard
to.
Inside it, you will find a few.
Compound bench, which is to compile this source code into ESG, and you have also the message box,
binary code and glossy file with the properly formatted for use in the C program.
Let's take a look at the source code for this malware by opening the press.
On top, we have the usual includes, and here you see the same shark for showing a message box pop
up created on Kleenex using Metasploit, the Lion Shark TV seven times before.
And here you find some time death for the fashion pointers in structures that are used in this.
Now they.
And if you want to know more information going down the notes that I provide for you here.
So it is not shall we give you all the links where you can more can go and read in details about some
of these structures function pointers.
Over here, you see the same function that we used before social process.
And we hear something new in Jane view.
So this is a user defined function.
In a sense, these parameters the handles through a process that you went to inject the pill itself
in the light.
Inside it, you create a.
New session, but before that, you need to get the process address for A. Great session by using this
function.
The reason we do this is to be stealthy.
So this dynamic random loading as we have done before.
So integration comes from Antigua.
So after you've got the address for this function, you save into this function pointer and then over
here you will use the function pointer to.
Create a new section and this is an undocumented.
You can go and look at the undocumented apps who are here.
A.S..
So this website has got a list of undocumented guys, if you wanted to search for an API which is undocumented,
you just need to click on a search button and type in here the API and you only look for.
So, for example, in this one and decrease session accepts these parameters.
The first one session handle these, I says I'll tell you attributes and so on.
And now in the modern library, there is no hazing API.
By day, something similar called that debut session function.
So the parameters are the same.
Strikingly similar.
And if you want to read the details, you can read the Microsoft MSDE for this API instead.
So let's take a look at this in here, we specify the handle through the section.
We're going to create.
So after you've successfully called this commission, you see the handle to this book or section.
And you won't do it, he says all access for compressors for this session and the Sony LIV lives now
here you specify the line and the payload so that you would create the size of the station large enough
for your appeal.
And you also are going to make it executable and readable and readable and committed in the last pad
Middle East.
Normally that has no next year you want to make use of the of sessions.
So we need to use the proper address to dynamically look the address of this function.
And this function also comes from an DDL and I tell you, got the address to receive it in this function
pointer and over here you will use it to create a local view.
So it is how you create local view.
And if you want to read more about this, you can also refer to the undocumented functions website here.
Which brings all this, and the Microsoft media has quite a some almost similar to the U.S..
So this one here you specify the handout to the session, which you got from the previous API, and
here you specify current process because in this first call to make this issue.
Yeah, getting the look of you and then over here is a pointer to the look of you, which you created
here as a white pointer.
And then here it is not now specified a better length.
And here you specify a special kind of stroke you can enumeration over here.
So this inauguration is also undocumented, and you can go and read up by referring to these references
I have given to you.
The.
S. Inherit this one session, Harry enumeration you can read by referring to this, so you need to specify
this view I meant as the barometer for this.
And finally put it now for next parameter and set it to be readable and rainy.
So after you call this API look, a view will be created to get can assess your session.
So at this point in time, why have you done what you've accomplished carefully?
Antique recession?
Is this part here where we created a session and then here met your session?
He created a local you because the second parameter, he specified the local process and it corresponds
to this one.
Create local you to create this view here.
After that, we need to copy the chocolate to the local session.
So we use memory copy that corresponds to this part of the stage copy to chuck over to your local view.
This is the section you created.
Again, you crazy so of you.
And now you are copying a chocolate to your section that you created.
Next thing is to create remote this remote view.
And again, you call in the U.S. By this time, the second parameter is different from the first time
you call it.
This time you specify the target process.
So this target process will be this one here.
He could be Microsoft Paint.
You'll be doing lab practically to how it could be any adipocytes which he went to target.
So this makes the difference between the fourth and second stage.
In the second stage, you specify the second parameter to the gate progress because you are creating
a local view.
But in this hostage, you specify the second parameter to the target process in order to create this
remote view.
So after you done this, you have a remote view that the target process is animal sharing with your
memory from the malware trojans.
So we didn't shares his memory use using the remote you.
And then here you print some messages.
And over here you will then call the function out.
Here's a track.
So I think he's a threat.
You need to get a dynamically he addressed by using a proper address.
And once you get it, he will call your function here.
So this is the meeting.
This is where the magic happens.
Once you call creating more track, what you are doing is you are executing a shall call remotely.
That means you are using the target process as a proxy to execute your own memory, which you shouldn't
be your target process.
So this is your usefulness or how create a trick.
So attacker is a threat.
He's also an undocumented function.
You can wait here for the various parameters and hear the important one is the first parameter where
you specify the target process and also this parameter here.
The seven barometer, they specify the address of the remote view that you are going to use in order
to access the memory and also the handle to the tracking issue be created once this process succeeds,
it last is a tragedy which you created here, Chidi.
He claimed it.
We should read it here.
So as I read the check to execute and then you wait for it because this is the concurrent processing.
So it said you are running concurrently with the mean process.
And then here is your main function, which ties it all together.
The first step is this search process.
In this case, you'll be targeting Microsoft Paint.
So after searching, you get a.
And here you used iPad to open the process.
And then you start you handled who is credible process and down here, you passed his process as a parameter
to inject you along with the chocolate and the lines chocolate.
So this is how you you use map view ingestion in the melody in the next video, you are going to compile
and do this in running the song or this video.
Thank you for watching.