Hello and welcome back to a new section in this new section.
You got going to look at the injection, the injection.
He's about injecting the path to another process.
In this slide here, we can see that there are several components of a direct injection mechanism.
On the left, we have some malgre corrosion.
On the right, we have a target process.
Then we are going to inject.
And at the bottom here we see there is a file called the far.
The objective of the injection is to cross and the target process to look the deer far and execute it
in order to do that.
The measure Trojan will contain the path to this valve far this year, far could have been downloaded
by the network Drugeon, or it could have been planted day by some other means.
So the first thing in that region to do is to allocate memory in a targeted process as denoted by the
green box here.
If we do that by using the API function, vertue ALAC eex.
Next, the metro region will write to memory.
You copy this path to jam over to the allocated nemy region, this path to jail contains a path to this
far.
He does that by using the API function call, right.
Process memory.
You then create no library track.
So you create a track using the API called Create a remote track and passing some parameters to it.
Two of the parameters are law library, which is to look Nadifa.
And the other barometer is the path to the GHAFFAR to below that after this created what is called the
target process, will look this library using the library API.
How does the malware from, you know, the address of the library API in order to get the address of
the library API?
The medical unit who used to get proper dress function, the library function comes from country to
the law library comes from country to drill.
And Lewis had a similar dress for all prosthesis, therefore get the address is used to get library
function from country to DNA within the military unit.
So then used the same address for the target process.
So this is how the Mehretu, you know, the address, the library, once the grid in which she runs
and uses the library to look yellow.
Today, I will be loaded into the target process, and I say good days, because in a deal that is the
main function in the the main function, that is to switch the switch, they will have a few cases.
The reason for the call and if the case falls under the first one, the process Thach, Iran, the sherkat.
This circle is defined here.
In this function, also in the same year.
And this Chalco is designed to run Sherko shown up here.
And this court is similar to what we used in the previous lessons to run Unshackle.
So this makes it possible for the owls to be secure the moment it is loaded.
API calls for DNA injection.
There are four functions in total.
These are the four APIs used in DNA injection get proper address is used.
You get in the is just what you Elaheh X is used to allocate memory in the target process.
Right, process, memory, he used to write a part of the mail to the target, and this part of the
year is a return to the allocated memory.
It came from which?
Yes.
Finally, they create a remote EPA, who we call Rita Barometers of the address of the library, which
she got from Get Proc. address and also the path to the air.
So that's all for this theory on how the injection works when we do the practical sessions.
All this would become clear.
Thank you for watching.