Process Memory – File Mapping, PE Parser, tinyLinker, and Hollowing
In Chapter 1, From Source to Binaries – The Journey of a C Program, we learned how C/C++ can be packaged as an executable in the operating system. In this chapter, we will explain the file mapping process, build a compact compiler, attach malware to system services, and infect game programs.
In this chapter, we’re going to cover the following main topics:
- The memory of the static contents of PE files
- PE Parser example
- Dynamic file mapping
- PE infection (PE Patcher) example
- tinyLinker example
- Examples of process hollowing
- PE files to HTML
