Welcome.
We are not going to look at the explanation for the call in use using the reflective loading technology.
Going down this projecting zero eight reflective loading, unzip it and put it in email def to folder
within it, you find all these files and also not a folder called Trojan.
All of these files are used to create the refractive loader, whatever you want to do.
You need to put it in the L file so you need to create and you have first.
So this is a detail that will contain wherever things you want from.
And then you have to compile this into a deal and the process of compiling.
You need to also include Steven Few with source code.
We need both the reflective gear to work.
So let's take a look at this zip file.
So we open it in back plus and you can see here this is how you include different view.
You have a library or you need to do is include the header file, which is this header file here.
So this header file here we include the source code for your this article here for your reflective library.
So just by putting this line here, you totally convert this entire source code into reflective gear.
So after you have already compiled this reflective detail, you would take the binary off the DL and
then put it inside your Drugeon.
So and then once that region runs, you will thank you.
Yeah.
Embedded inside Iran, back in the air and then you execute it.
So this is how it works.
So let's take a look at this.
Yeah, our first.
So this is the part where you put your Microsoft Bench or any chocolate.
So here we go.
They created chocolate from the lesson from the first costs.
And we use Metasploit to create this chocolate this year called the open Microsoft Bing.
So the binary or the how is this one?
Microsoft paints it for being so you need to open your the.
And in these this insight here.
And then from here, you need to export.
I see far.
So once I spot a CFR, you can save in a folder in this folder and then you can call it any name me
one, for example, you can call.
And it's being
shall quote.
So now you have these shackled.
We'll hear.
Right.
So you can now open this door.
We use copy all of this.
And then put it in here.
That's how we got in this.
So we're here and then we need this to become be.
So he says same as the sample here, so he can use this.
So this is a reflective Gale.
So when he runs, he's going to run your.
Running is our function here.
And this could you be creating memory using which other?
And then here you can put your options and the Captain Cook, if you're.
Peter was encrypted by in this case, it is not.
And then here you copy appear to your allocated memory and in chief the protection to become executable
and readable using which are protect.
And finally, Azikiwe, using Create.
So all of this will be created on the fly again, reflective, Gail notes.
So this thing only is being created during the reflective loading process.
So just how useful it is before that, it does not exist.
So let's take a look.
And in fact, we know this quote.
So this is the reflective little quote we here so reflective of the code is written by Stephen Kua.
So we just use it as it is without any changes.
It is a very complicated piece of code, but basically what it is doing.
Can be understood by and looking at this diagram here.
So the reflecting loader will create HEDA in memory.
Here to her behavior.
All of this directories and also session tables and also the various sections, all of this would be
done dynamically.
You would think.
You grab hold of.
All the court from.
This loaded process itself and a copy to another location in memory.
In effective will that we do and then I see copies, you create all the various sections it be here
all the way down to the section here, and he will then relocate in memory aswell, incite the memory
region.
And then you execute.
All right.
So the next step is to compile this.
So after this thing has been on file, you will get the alpha.
So after you have compiled compiled Yam, you will give a yes.
This is to have another kind of layer of obfuscation.
So it is entirely optional.
So are you going to give to yes, you then copy the bill as well as the key for a yes.
Let's take a look at this.
This is a Python script.
So what he does is he will create two separate areas.
One is your alias key, which is randomly generated by here.
Get random base key and then here you formatted in the Hex format.
And then here he will also in January, he say safely ciphertext.
Over here, this is a very see prenup in parliament for sir.
So you have he Bill and Caterpillar as well as the key and you will copy all those out and put it in
your effective Trojan.
We're here for the people we have with the key.
After you will built, you were confined to this, in fact, intrusion, as you can see, this is a
Win-Win, which makes you stealthy.
No conceal.
So when this thing runs, you will allocate memory and then decrypt the appeal and then copy the memory
to the newly allocated memory up here.
To ensure protection of the allocated memory to become readable and accessible, then look for the effective
leader, the effective and know function.
Now, the every year, in fact, even though the library has got a reflective go, the function.
So you can see in here, sir.
He in effect, even though the.
This is doing, in fact, even though the commission is.
So you're finding their function.
You stand.
Once you find that effect, even though they're finally came over here, you save it to the offset.
And then after that, you can create a trip by using a creative solution and then putting the offset
adding offset to the base base address of your executable allocating memory, which is here.
So then we effectively execute.
You execute and then you do your executable file in memory, piece by piece.
Until you get everything created and loaded in memory, and once that is completed, you will then create
a rainy.
And you give it about five thousand milliseconds for it to do all that.
So that's why you see four, five times in here.
So this could here get effect zero, the offset is also provided by Steve Wynn fewer.
We're here.
In here, so all these adapted from Stephen Few.
The library function.
So this is how the court for the reflective of the Trojan works.
Thank you for watching.