You're reading from Malware Development for Ethical Hackers Learn how to develop various types of malware to strengthen cybersecurity

Product type Paperback

Published in Jun 2024

Publisher Packt

ISBN-13 9781801810173

Length 390 pages

Edition 1st Edition

Concepts

Cybersecurity

Author (1):

Mr. Zhassulan Zhussupov

View More author details

Table of Contents (23) Chapters

Preface

1. Part 1: Malware Behavior: Injection, Persistence, and Privilege Escalation Techniques FREE CHAPTER

2. Chapter 1: A Quick Introduction to Malware Development

3. Chapter 2: Exploring Various Malware Injection Attacks

4. Chapter 3: Mastering Malware Persistence Mechanisms

5. Chapter 4: Mastering Privilege Escalation on Compromised Systems

6. Part 2: Evasion Techniques

7. Chapter 5: Anti-Debugging Tricks

8. Chapter 6: Navigating Anti-Virtual Machine Strategies

9. Chapter 7: Strategies for Anti-Disassembly

10. Chapter 8: Navigating the Antivirus Labyrinth – a Game of Cat and Mouse

11. Part 3: Math and Cryptography in Malware

12. Chapter 9: Exploring Hash Algorithms

13. Chapter 10: Simple Ciphers

14. Chapter 11: Unveiling Common Cryptography in Malware

15. Chapter 12: Advanced Math Algorithms and Custom Encoding

16. Part 4: Real-World Malware Examples

17. Chapter 13: Classic Malware Examples

18. Chapter 14: APT and Cybercrime

19. Chapter 15: Malware Source Code Leaks

20. Chapter 16: Ransomware and Modern Threats

21. Index

Why subscribe?

22. Other Books You May Enjoy

Identifying flags and artifacts

By default, the 0 value is stored in the NtGlobalFlag field of the Process Environment Block (located at offset 0x68 on 32-bit Windows and 0xBC on 64-bit Windows):

Figure 5.11 – NtGlobalFlag

The value of the NtGlobalFlag variable is unaffected by the attachment of a debugger. On the other hand, if a debugger was responsible for creating the process, the following flags will be set:

FLG_HEAP_ENABLE_TAIL_CHECK (0x10)
FLG_HEAP_ENABLE_FREE_CHECK (0x20)
FLG_HEAP_VALIDATE_PARAMETERS (0x40)

To check whether a process has been started with a debugger, check the value of the NtGlobalFlag field in the PEB structure.

Practical example

Let’s observe the practical implementation and demonstration via a straightforward PoC code for anti-debugging:

/*
 * Malware Development for Ethical Hackers
 * hack.c - Anti-debugging tricks
 * detect debugger via NtGlobalFlag
 * author: @cocomelonc
*/
#include...