What this book covers
Chapter 1, From Source to Binaries – The Journey of a C Program, includes the basics of how compilers package EXE binaries from C code and techniques for system processes to run dynamically as processes.
Chapter 2, Process Memory – File Mapping, PE Parser, tinyLinker, and Hollowing, explains the file mapping process, builds a compact compiler, attaches malware into system services, and infects game programs.
Chapter 3, Dynamic API Calling – Thread, Process, and Environment Information, elaborates on the basics of Windows API calls in x86 assembly.
Chapter 4, Shellcode Technique – Exported Function Parsing, explains how to get the desired API address from loaded DLL modules.
Chapter 5, Application Loader Design, explains how a simple application loader can execute EXE files in memory without creating any child process.
Chapter 6, PE Module Relocation, discusses the relocation design of PE modules. We will learn to manually analyze PE binary and implement dynamic PE module relocation, allowing any program to be loaded into memory.
Chapter 7, PE to Shellcode – Transforming PE Files into Shellcode, explains how to write a lightweight loader in x86 assembly that can be used to convert any EXE file to shellcode.
Chapter 8, Software Packer Design, develops a minimalist software packer.
Chapter 9, Digital Signature – Authenticode Verification, explores Windows Authenticode specification, reverse-engineering the signature verification function, WinVerifyTrust, and how to hijack well-known digital signatures.
Chapter 10, Reversing User Account Control and Bypassing Tricks, reverse-engineers UAC design to understand the internal workflow of UAC protection and learn the techniques used by threat actors to bypass UAC design for privilege elevation.
The Appendix – NTFS, Paths, and Symbols, explores the file path resolve principle of Windows and the use of special paths to attack in the wild.
