Reversing & malware analysis training part 2 introduction to windows internals

22
www.SecurityXploded.com

description

 

Transcript of Reversing & malware analysis training part 2 introduction to windows internals

Page 1: Reversing & malware analysis training part 2 introduction to windows internals

www.SecurityXploded.com

http://www.securityxploded.com/
Page 2: Reversing & malware analysis training part 2 introduction to windows internals

Disclaimer

The Content, Demonstration, Source Code and Programs presented here is "AS IS"

without any warranty or conditions of any kind. Also the views/ideas/knowledge

expressed here are solely of the trainer’s only and nothing to do with the company or

the organization in which the trainer is currently working.

However in no circumstances neither the trainer nor SecurityXploded is responsible for

any damage or loss caused due to use or misuse of the information presented here.

www.SecurityXploded.com

Page 3: Reversing & malware analysis training part 2 introduction to windows internals

Acknowledgement

Special thanks to null & Garage4Hackers community for their extended support and

cooperation.

Thanks to all the trainers who have devoted their precious time and countless hours to

make it happen.

www.SecurityXploded.com

Page 4: Reversing & malware analysis training part 2 introduction to windows internals

Reversing & Malware Analysis Training

This presentation is part of our Reverse Engineering & Malware Analysis Training

program. Currently it is delivered only during our local meet for FREE of cost.

For complete details of this course, visit our Security Training page.

www.SecurityXploded.com

http://securityxploded.com/security-training.php
Page 5: Reversing & malware analysis training part 2 introduction to windows internals

Who am I #1

Amit Malik (sometimes DouBle_Zer0,DZZ)

Member SecurityXploded

Security Researcher @ McAfee Labs

RE, Exploit Analysis/Development, Malware Analysis

Email: [email protected]

www.SecurityXploded.com

Page 6: Reversing & malware analysis training part 2 introduction to windows internals

Who am I #2

Swapnil Pathak

Member SecurityXploded

Security Researcher @ McAfee Labs

RE, Malware Analysis, Network Security

Email: [email protected]

www.SecurityXploded.com

Page 7: Reversing & malware analysis training part 2 introduction to windows internals

Course Q&A

Keep yourself up to date with latest security news

http://www.securityphresh.com

For Q&A, join our mailing list.

http://groups.google.com/group/securityxploded

www.SecurityXploded.com

http://www.securityphresh.com/
http://groups.google.com/group/securityxploded
Page 8: Reversing & malware analysis training part 2 introduction to windows internals

Windows Architecture

www.SecurityXploded.com

Page 9: Reversing & malware analysis training part 2 introduction to windows internals

Memory Management

Virtual Memory

- An invisible layer between a software and physical memory

- Every process first get loaded into its virtual memory address space

- Small units called “pages” are used to do mapping between physical memory and virtual

memory.

Paging

- Memory management scheme that stores and retrieves data from secondary storage for use

in main memory

- Uses same size blocks called pages

- Page table is used to translate virtual addresses in physical memory addresses

www.SecurityXploded.com

Page 10: Reversing & malware analysis training part 2 introduction to windows internals

Memory Management Cont.

User Address Space

- Allocated for user mode applications.

- All processes execute in their own virtual space.

- Use operating system dlls to interact with kernel

Kernel Address Space

- Strictly reserved for kernel, device drivers and operating system executive.

- No user mode application can directly interact with the kernel.

www.SecurityXploded.com

Page 11: Reversing & malware analysis training part 2 introduction to windows internals

Kernel & User Address Space

www.SecurityXploded.com

Page 12: Reversing & malware analysis training part 2 introduction to windows internals

Process and Thread

Process

- Executing instance of an application.

- Isolated address space

- PEB data structure store information about process

- PEB is an user space data structure

Threads

- Multiple threads share the same address space in the process.

- Each process has at least a single executing thread.

- TEB data structure store information about thread

www.SecurityXploded.com

Page 13: Reversing & malware analysis training part 2 introduction to windows internals

PEB (Process Environment Block)

An opaque data structure that store information about process in user

space

www.SecurityXploded.com

Page 14: Reversing & malware analysis training part 2 introduction to windows internals

PEB Cont.

www.SecurityXploded.com

Page 15: Reversing & malware analysis training part 2 introduction to windows internals

TEB (Thread Environment Block)

TEB is a data structure that store information about thread

www.SecurityXploded.com

Page 16: Reversing & malware analysis training part 2 introduction to windows internals

Application Programming Interface

API

- Includes functions, classes, data structures and variables

- Interface between various software components to communicate with each other.

- Windows APIs are used to interact with kernel or other modules.

MSDN

- Provides documentation for various API functions.

System Dlls

- ntdll.dll, kernel32.dll, user32.dll, advapi32.dll, hal.dll etc

www.SecurityXploded.com

Page 17: Reversing & malware analysis training part 2 introduction to windows internals

System Service Dispatching

www.SecurityXploded.com

Page 18: Reversing & malware analysis training part 2 introduction to windows internals

System Service Dispatching Cont.

www.SecurityXploded.com

Page 19: Reversing & malware analysis training part 2 introduction to windows internals

Important API

File and Directories

- CreateFile, GetSystemDirectory, ReadFile, WriteFile etc

Network

- socket, send, recv, URLDownloadToFile etc

Registry

- RegOpenKey, RegSetValue, RegQueryValue etc

www.SecurityXploded.com

Page 20: Reversing & malware analysis training part 2 introduction to windows internals

Important API Cont.

Processes, Threads, Synchronization using mutex, semaphore.

- CreateProcess, ReadProcessMemory,

WriteProcessMemory,CreateRemoteThread, CreateMutex etc

Memory

- VirtualAlloc, VirtualProtect ,HeapAlloc, LocalAlloc etc

www.SecurityXploded.com

Page 21: Reversing & malware analysis training part 2 introduction to windows internals

Reference

Complete Reference Guide for Reversing & Malware Analysis Training

www.SecurityXploded.com

http://securityxploded.com/malware-analysis-training-reference.php
http://technet.microsoft.com/en-us/library/cc768129.aspx
Page 22: Reversing & malware analysis training part 2 introduction to windows internals

Thank You !

http://SecurityXploded.com

http://securityxploded.com/

Reversing & malware analysis training part 2 introduction to windows internals

Reversing & malware analysis training part 2 introduction to windows internals

Advanced Malware Analysis Training Session 10 - (Part 1) Reversing & Decrypting Communications of HeartBeat RAT

Advanced Malware Analysis Training Session 10 - (Part 1) Reversing & Decrypting Communications of HeartBeat RAT

Internals of Windows Memory Management (not only) for Malware Analysis · 2011-04-19 · Internals of Windows Memory Management (not only) for Malware Analysis Carsten Willems University

Internals of Windows Memory Management (not only) for Malware Analysis · 2011-04-19 · Internals of Windows Memory Management (not only) for Malware Analysis Carsten Willems University

Reversing & malware analysis training part 9 advanced malware analysis

Reversing & malware analysis training part 9 advanced malware analysis

Reversing and Decrypting the Communications of APT Malware (Etumbot)

Reversing and Decrypting the Communications of APT Malware (Etumbot)

.NET MALWARE THREAT: INTERNALS AND REVERSING … CON 27/DEF CON 27 presentations/DEFCON-27... · ALEXANDRE BORGES – MALWARE AND SECURITY RESEARCHER DEF CON USA 2019 5 9Motivationsto

.NET MALWARE THREAT: INTERNALS AND REVERSING … CON 27/DEF CON 27 presentations/DEFCON-27... · ALEXANDRE BORGES – MALWARE AND SECURITY RESEARCHER DEF CON USA 2019 5 9Motivationsto

Practical Reversing IV – Advanced Malware Analysis

Practical Reversing IV – Advanced Malware Analysis

Reversing Android Malware - Hack In The Box Security ...conference.hitb.org/hitbsecconf2011kul/materials/D1T1 - Mahmud Ab... · Reversing Android Malware ... - Spyeye’s’fake’security’tool

Reversing Android Malware - Hack In The Box Security ...conference.hitb.org/hitbsecconf2011kul/materials/D1T1 - Mahmud Ab... · Reversing Android Malware ... - Spyeye’s’fake’security’tool

Reversing & malware analysis training part 11 exploit development advanced

Reversing & malware analysis training part 11 exploit development advanced

Reversing malware analysis training part11 exploit development advanced

Reversing malware analysis training part11 exploit development advanced

Reversing malware analysis training part5 reverse engineering tools basics

Reversing malware analysis training part5 reverse engineering tools basics

Windows for Reverse Engineers OS Internals · Windows for Reverse Engineers OS Internals CS-E4330 - Special Course in Information Security Reverse Engineering Malware Course 2017.

Windows for Reverse Engineers OS Internals · Windows for Reverse Engineers OS Internals CS-E4330 - Special Course in Information Security Reverse Engineering Malware Course 2017.

Reversing and decrypting communications of apt malware

Reversing and decrypting communications of apt malware

Reversing & Malware Analysis Training Part 10 - Exploit Development Basics

Reversing & Malware Analysis Training Part 10 - Exploit Development Basics

Reversing & Malware Analysis Training Part 9 - Advanced Malware Analysis

Reversing & Malware Analysis Training Part 9 - Advanced Malware Analysis

Reversing & Malware Analysis Training Part 12 - Rootkit Analysis

Reversing & Malware Analysis Training Part 12 - Rootkit Analysis

Reversing & malware analysis training part 10 exploit development basics

Reversing & malware analysis training part 10 exploit development basics

Reversing malware analysis training part10 exploit development basics

Reversing malware analysis training part10 exploit development basics

Reversing & malware analysis training part 12 rootkit analysis

Reversing & malware analysis training part 12 rootkit analysis

Reversing malware analysis training part8 malware memory forensics

Reversing malware analysis training part8 malware memory forensics