You're reading from Malware Development for Ethical Hackers Learn how to develop various types of malware to strengthen cybersecurity

Product type Paperback

Published in Jun 2024

Publisher Packt

ISBN-13 9781801810173

Length 390 pages

Edition 1st Edition

Concepts

Cybersecurity

Author (1):

Mr. Zhassulan Zhussupov

View More author details

Table of Contents (23) Chapters

Preface

1. Part 1: Malware Behavior: Injection, Persistence, and Privilege Escalation Techniques FREE CHAPTER

2. Chapter 1: A Quick Introduction to Malware Development

3. Chapter 2: Exploring Various Malware Injection Attacks

4. Chapter 3: Mastering Malware Persistence Mechanisms

5. Chapter 4: Mastering Privilege Escalation on Compromised Systems

6. Part 2: Evasion Techniques

7. Chapter 5: Anti-Debugging Tricks

8. Chapter 6: Navigating Anti-Virtual Machine Strategies

9. Chapter 7: Strategies for Anti-Disassembly

10. Chapter 8: Navigating the Antivirus Labyrinth – a Game of Cat and Mouse

11. Part 3: Math and Cryptography in Malware

12. Chapter 9: Exploring Hash Algorithms

13. Chapter 10: Simple Ciphers

14. Chapter 11: Unveiling Common Cryptography in Malware

15. Chapter 12: Advanced Math Algorithms and Custom Encoding

16. Part 4: Real-World Malware Examples

17. Chapter 13: Classic Malware Examples

18. Chapter 14: APT and Cybercrime

19. Chapter 15: Malware Source Code Leaks

20. Chapter 16: Ransomware and Modern Threats

21. Index

Why subscribe?

22. Other Books You May Enjoy

Advanced evasion techniques

Let’s look at a more advanced bypass method: system calls (syscalls).

Syscalls

Windows syscalls let programs talk to the operating system and ask for specific services, such as reading or writing to a file, starting a new process, or assigning memory. Remember that when you call a WinAPI function, syscalls are the APIs that run the tasks. For example, when the VirtualAlloc or VirtualAllocEx WinAPI calls are called, NtAllocateVirtualMemory starts running. Then, this syscall sends the user-supplied arguments from the previous function call to the Windows kernel, does what was asked of it, and then sends the result back to the program.

The error code is shown in the NTSTATUS value that all syscalls return. If the syscall is successful, it returns a status code of 0, which means that the action was successful.

Microsoft hasn’t written documentation for most syscalls, so syscall modules will use the following reference from ReactOS NTDLL...