Hello and welcome to a new session in this new session.
We are going to talk about how now we can drop Trojans to do some malicious activity.
Now, how do they do this?
Typically, Trojans or malware do this by hiding the executables inside the file itself and the places
normally that they do, we do.
This is either in the tech section or in the data section or in recession.
Now, this is an example of a calculated program which you can look from your Windows system to read
to you where you can find your calculator program.
So after loading it, you will find it to create a program.
You have all this behavior, plus the various action.
So in this session, I'm going to show you how you can create code to hide other executable shortcuts
inside the taxation.
All the data session of the recession.
So let's get started.
To do this, we are going to use another project file called Embedding Bailleau, which you can download
from the resource.
I should unzip and put it in your mouth folder inside it.
And you will find this project called Payroll in Taxation.
So this first project is where I will show you how you can hire a payroll, a shellcode payroll tax
issue.
So what you say chocolate Shaquill is actually a string of bytes that gives instructions to execute
to to do something.
This thing, can you execute it from memory directly?
And an example of this can be found in this faqir, CPP file in taxation.
So just right click on it and open, if not back.
And in this example here, you see on top, we have the usual see clutz and then, yes, our main function,
you get a premium section begins.
And here you see there are a few variables being declared and also simple for white chocolate.
So this is the thing that you are going to execute.
You are going to hide this inside taxation of your coat and then security.
Now, how do we do that?
First you need to do is to call a function call what you're ALAC, which is a Windows API function that
you can create memory locations for use and by your process.
And he set parameters for it.
The first one is the address.
And normally we leave it blank over here.
Zero and then the length of the address and you need the size.
And then here you type the location.
So the type normally we would put memory commy and we are in memory reserve.
Then the last one is what kind of permission you and you set for peritta.
So in this case, we want to set it to be readable and writable.
So after you call, would you allow you allocate some region of memory for the process to use?
And then he will return it in in that Facebook.
Hello.
In this case, we call it a lot men over here.
You can see the parameter that is being written.
If you scroll down the return type.
Return type.
Within the Falcons, I see the return value is their base and drastically allocated regional pages.
So this is how your program can allocate memory for its own use.
This is called private memory.
And then after you allocate it in memory, dislocation in memory is reserved for use by this process
to do whatever you want.
So in this example here, our show shellcode is for base.
And these are the hexadecimal values --.
Ninety ninety six and C three ninety is no operation.
That means end the CPU C.
If we just ignore it and proceed to the next instruction, c, c is an introductory, thereby he will
cross the program to halt if you are using a debugger to run the program.
The debugger will halt in any C.C.C. instruction.
It is deliberate down to make it easy for you to inspect this program using X DBG later and see trees,
quote, for return.
We are going to put this inside the allocated region and memory here.
These two lines here is just a prenup.
The address of the shellcode payload, which is this array here.
And in this line here, the print, the value of the allocated region of memory, even virtual blocks
of seats.
You will get an allocated region here.
And this is where you print up so you can see.
And over here, this API, RTL move memory has got three parameters.
And you can take a look at the M.N. documentation for this API function.
The first parameter is a destination address.
The second parameter is a source address.
And it took parameter eastern.
So over here, you are going to copy the shortcut into the destination.
So this Chalco comes from this array and you are going to copy into the newly allocated region and memory,
which is over here, which has to be set to be readable, writable.
You need to be set to this to readable and writable so that this API function will be able to write
to it.
And then the parameter from the documentation is the line to the line of the source that you are going
to copy over to the destination.
So the length of the Shockley's state is four, four bytes, because each of this instruction is a one
by one, two, three, four.
So for bytes here.
So this is what is Chako looks like, charcoaled is very low level machine code and is ready to run
by the C.P.U.
So he doesn't have schmoozy Hadir and you know that it is it is already.
And he's tracking very low level form.
It can be executed by the CPU.
And in the real life malware, the chocolate will not be so shut.
He'll be very long and he can do many malicious things after this line.
Here we have what you're purpose but possible to protect is to change the protection for a particular
region of memory.
And what's important, that takes four parameters.
The first parameter is the address where you want to change the mission and the size of it and the new
permissioned and you the set.
And what is he Holper mission that was previously there.
So if you take a look at this, we should protect here.
He also has four parameters.
And then the first parameter is the newly allocated region of memory here.
So he allocated region in memory.
You make it readable, writable.
And then here you copy a shortcut to that region in memory because it is writable.
So you can copy after that, before you can execute this new chacal.
There has just been copy.
You need to make this region a memory executable.
That is why you need for shipment.
So here the parameter here is the type of permission you're using to set the new protection value.
As you can see here, in this case, you want to make it executable and readable.
That's why you said it to be this value in this parameter.
And the fourth one is just a pointer to the all protection value, which normally put a zero once is
which X-axis everything?
True or false?
And this is true for successful and false, for failure to achieve the permission.
So we can see the return type is bool.
And you can scroll down and see the return type.
You define success.
The return value is only zero.
So and then here you bring a message to the program to show a prompt to tell the user.
For our case, for educational purposes, we want to be able to see this so that we can press, enter.
And then here we get your and turkey and get char function.
You enter key from your terminal.
And then here you would test the return value from the checkpoint right into what you protect succeeds.
Then this return value would be non-zero.
That means you be able to enter here and create a tray out of this memory.
Great trick.
Create.
So I think within the virtual address space of the calling process.
And these are all the parameters to it.
So crypto actually run who execute this call?
I mean, in in a separate track and the parameters, it is normally the first two.
We leave it as zero zero.
And then that parameter, the instruction that you want to execute.
So in this case, the instruction is a memory address that we are located here, which only Kapela Sherko
into it.
Now we want to execute it.
And normally the cost this memi region to become an executable check routine.
And the last three parameters, we just it has zero.
After that, we worked for a single J because the check is running.
We don't need a program.
We talked this program three.
So this is the way in which you can create a program with social cohesion, USAID, and allocate space
memory using Machala and then copy a Chakotay, the newly allocated space.
And it changes to protection, to executable.
Now, why why is it over here if you don't want to put executable?
Why are we putting executable in a separate API?
And the reason is because some antivirus can detect this anomaly.
If your process suddenly coslovich alarm, which makes it much misallocate in memory, both available.
Right, as well as active.
So that's why we split into two parts which are duplicate writable and then which are protective Cheju
to executable.
OK, so this is how we are going to do in this next video.
You know, we'll go ahead and try to compile this code.
So I'll see you in the next video.
Thank you for watching.