Hello and welcome.
In this video, we're going to build a program that is going to inject the message was shellcode into
a Microsoft bin program.
Let's get started.
After we execute our new malware, you will look for the Microsoft pain program in memory.
Why is it feinted?
He would then inject the MessageBox Chalco into Microsoft pain and then immediately he would show he
was sure the messagebox go in, download this project and zip into your mandate for the first Forestier
compound backstory, which you take the process injection SARS-CoV-2 and give the SFA and the files
to one we are going to use to inject MessageBox Chakwal into a Microsoft bin.
And you have MessageBox Chalco here.
So let's open the process injection shakuri now.
You can look at plus plus it.
Now we have to prepare the sherkat in a format suitable for use.
To do that, we open our hex editor.
Inject messagebox and beam into our house, Ed, next, you can file export C.
And safe, the message box got Cifas into this for the.
Click on Safe.
Confirm that the fire has been created, messagebox, see now you can close your hastey, Ed.
Thanks, Ed..
Then you open the messagebox, see in notepad plus plus.
Copia the.
For the Sherko Rackley copy.
And coming to your process, injection's CPB fa.
In fact, down here.
Next, we are going to change the name into Chocolate Bill, so copy the name from the top.
Come down here in your name and then wrinkly and piss in your name here.
Now you can delete.
This sample.
So this is a 64 bit Chalco to display MessageBox.
And the scientists recently soundbytes.
Come down here and change this to the same number I saw here January seven.
Now, this program has got a main function.
So when the program runs.
You call the function search for process.
This function will look for this program.
And I spent Yasi in the memory.
If you manage to find these places, you is safe.
You process it into this variable.
And then he checks to see whether the pads is really in pads, not zero.
Then he will print a message to the console.
Ms.
Pennisi, iPads.
Such and such.
Nacy recalling the open process API.
And then here.
You trying to open iPad?
Based on this?
Did you have fun?
So this is a Microsoft Windows API, kindly download this file from the recession.
It contains links, references to the API that you are using in this in this program.
So open process is here.
You can go and look up open process function.
Opens an existing law process object.
It takes three barometers.
And we turn to hinder to the process.
The first parameter is design access and the access to the process object and then the Tideway Sensorites.
You can read from here.
Yes, right click and open it.
So this is a kind of a centralized it you can specify.
Yes, along this year.
So the first parameter we specify all these says if you want.
And then the second parameter will then process is the inherent Hindoo, which I know Keith, he said
before, since you are not inheriting from any other process, and then the parameter is a process ID.
It is the identify of the local process to be open.
So in our case, we were passing the process in which you obtain from this search for process function.
After opening the tiger process, which is Makassar pain, he will return to handle 10 percent and safety
in this variable.
Next year we check whether the process is known, if it is not known.
It means we have successfully open the process.
Then we will call the Chalco inject function.
Yeah, Sherko inject function will pass three parameters.
First parameter is to handle to process, which we obtain from here.
The open process function.
The second parameter is a sherkat and anyone to use to inject.
And this comes from here.
And it is barometer is a line of shock appeal, which comes from here.
Then after you close the handle of the process.
Let's take a look in detail among these two functions, search for process and shackling.
Leads to user user.
So they are defiant up here.
Social process is defined here, a circle is defined here.
A process accepts the name of the process.
He runs a search for a nanny here.
We used to create to have 32 snapshot API that's looking to create, to update, to snapshot.
Takes a snapshot of these specified processes, as well as the heaps more news and tricks used by these
processes.
So in summary, this API release will capture all the processes which are running in memory and access
to parameters.
And we tend to handle.
So these are two parameters, the one snapshot of the process.
Second parameter we normally levy heads you then after he returns handle containing a snapshot of the
processes which are running in memory and safety in this variable.
These object.
And then he checks whether or not the snapshot is already here is in reality.
He would only return zero, meaning to in the function and return to zero.
If he succeeds to get a snapshot of all the running processes in memory, he was save the size of the
structure process and data into one of the members of this structure.
This structure was created up here in order to save all the data abstract from the creating hub snapshot
and this structure.
You can look it up from here.
Process and 332 structure describes an entry from a list of the processes residing in the system address
base when a snapshot was taken.
And he has got all these members.
The first one is the size of the structure.
So here is very initialised SISO, the structure.
Do the science of processing treat any to any misuse or to the EPA to iterate through the list of processes,
process data first and process 82 next?
Great to have 32 snapshot is always used to gather the process data first and to 82 these.
So this is how we can search for process in memory making use of these three API processed edito, first
go to parameters, processed ST2 first function retrieves information, and thus the first process encountered
in a system snapshot.
And it takes two parameters.
So the two parameters we provide, the handle of the snapshot of processes and the process structure
which we created here.
If it is not successful, you will close the handle of the special processes and return zero, which
means quick.
But if successful, that means you managed to retrieve the lists of the processes.
You would then use a value to iterate through the entire list and search for the process that you want.
So use possessory tunics to do this in a loop process, 32 next function, which is information about
the next process recorder in a system snapshot.
It also accepts two parameters.
And these are two parameters.
A handle to the natural processes come from here.
And the precise structure which came from here, then we will go through the loop and compare it process
name given the name of the SFR in the present structure.
The process name.
Comes from here.
So they call this search for process function, the past name, which is Microsoft bin eeX MSP.
Here we look through and use this information.
Our string compar ignore case ia4.
You know, that means he doesn't matter whether he's capitalized or who acase, you just want the name.
So the first band is a name, second parameter is also the name.
So this second parameter.
Comes from the process of of string EIC funding of the structure process structure.
String.
Yes, he finally is the last member on this structure, and he starts to name off the process.
So in this case, you are comparing it where there is a mess EIC.
If it is, then you will get the ID.
So the IDs obtained from this member.
Which is the third member of the structure.
And then you save to.
And then you bring him back out of the loop.
You no longer need to continue because you found what you want.
But if you did not find a name me, see if this name here does not match.
Then you come after Eastmond and go to the next iteration loop.
And this API would then go to the second processing.
The list should continue until he finds the name of the process or Hoie doesn't find.
And finally, you close to Hinga return the bid.
So these kids return to the caller who are here.
And then he said, you predicted and then you call open process to open.
And then while still being processed, you will call Shockoe Jack Shakarian Jeni's define here.
So he takes three parameters.
They handle the process, which you got from open process after passing a kid from here.
The second parameter is the shock appeal, and it third parameter is a line of the shark appeal.
Yes, I hear you used to watch.
Yes, EPA to allocate some memory in the target.
In this case, Microsoft P.
People say the U.S.
Which Anna Biodesign has gone to extension in front.
Yes.
So it is a standard from the Coachella.
He reserves, comes or changes the state of a region of memory within the virtual address piece of a
specified process.
You can use this to create a memory space in another running process.
And he accepts these parameters five parameters.
The first parameter is a target process where you want to allocate your memory.
So in here.
The first parameter is the handless process, which is your handoff or the Microsoft being process.
The second one he was sent to now says he don't want to specify a specific address.
The third one is a line on the chocolate bill.
Next one is to commit, memory, commit.
And the last perimeter is a protection type.
You want to set which is executable and readable after you have called this EPA.
You will then move on to the right process.
Memory API, write process.
Memory function.
Race data to an area of memory in a specified process.
The entire race to be written, too, must be accessible.
Audio, brief interviews.
And assess these parameters, five parameters, first parameter is a hanger to process.
Second parameter is the basic price in our case.
You pass it in the remote allocated address, which came from the previous caller to what you are.
It is burM, you say Chalco, the buffer Sherko debut and the right to.
Then the next parameter after that is a length on the Sherko.
And the final parameter, PDV has blank.
After we have copied chocolate over to the target process, we will then call an API call, create a
remote tray.
Create a remote chat function, create a arancini virtual address space of another process.
And this is how the parameters for this function.
So this is where we will run the show in the idea of copy to the Microsoft buying process.
The first parameter is to handle the process.
The second parameter, we believe, is now, since we have no particular attributes to set the third
parameter, Yossele zero.
The fourth parameter is to allocate the memory address very shakuri sites.
And the remaining parameters are reset to now zero and none.
So after you call this process, they shall Covid run and then you will show the messagebox.
Next, you test whether the process for successfully created.
If it was, then you will wait for Hatra is how this process injection program works.
So the stuff here for this video game will continue in the next video where we will compiling build
this CRC and test it.
See you in the next video.
Thank you for watching.