Welcome in this video, we're going to study the API calls using the APC injection, so going down low
in this project zero six and Dash APC injection, unzip it and put it in the Murder two folder.
Within this folder, you find a few files similar to what you have seen before.
The only thing new is APC injection CP FA, so it just open this in.
This is a contained file, so everything in this file is similar to the direct injection, direct contact
injection.
You anything different?
These these function inject APC.
So in the APC is where the magic happens.
In a sense, the iPad, the handle to process this is your target process.
The payload in this case, the payload is a simple message box payload.
And then here, the last parameter is the size of the pier inside you search for the tree.
In the same way we use for the convex injection, once you find the train, you don't see to the handle.
And then over here, you will allocate it with your memory in the remote tray in your remote process.
So you use whichever he asked for it.
And once you've allocated memory, you will save it to this point, to the size of the memory, the
size and the payload.
And then he will copy the shortcut to the payload, using the right to process memory.
The first permutation or process handle is mechanical shark.
So the second is your is allocated memory and in 30 seconds.
So you'll be copying the shellcode payload to your educated memory, which you reciting the target process.
Next is the new API function clock.
You use APC.
So this is where you pass the three parameters.
The first is the shortcut to you have copied over over here, period.
Second is the handle to the track issue of search.
And the last one, the anomaly is blank.
You can also refer to Mr Yang for the details about Cuba's AP user, APC.
So I said three parameters.
The first is your remote court machine, Hotchkiss.
He's the allocated region of memory in a remote process, which contains a chocolate second to handle
the display.
And third is a data that you in the past in the train case, you're not passing any data to the track.
So he just could not fully take parameter.
And the last one is your function, the main function which ties everything together.
Everything is the same.
You search for a process.
Our target possesses the Microsoft business.
You should return the PD and open the bid and return the end of the process using the open process API
function.
And then here you inject ABC.
You call the ABC function.
Pass the parameters.
The first one is tepid.
We should go from here.
So can you handle the process from here and then the actual payload itself and and landing page?
So this is the explanation for the API used in APC injection.
Thank you for watching.