Dynamic API Calling – Thread, Process, and Environment Information
In this chapter, we will learn the basics of Windows API calls in x86 assembly. We will first learn about the Thread Environment Block (TEB) and the Process Environment Block (PEB), and how attackers use these features in malicious software. By the end of this chapter, you should have a better understanding of how the compiler makes dynamic calls through calling conventions so that the program will run as we expect. With these foundations in place, you can move step by step toward the goal of writing your own Windows shellcode. For example, calling a Windows API that does not exist in our source code allows evading antivirus detection of blacklisted API names.
In this chapter, we’re going to cover the following main topics:
- Function calling convention
- Thread Environment Block (TEB)
- Process Environment Block (PEB)
- Examples of process parameter forgery
- Examples of enumerating loaded...
