Skip to Main Content
Malware Analyst's Cookbook and DVD: Tools and Techniques for Fighting Malicious Code
book

Malware Analyst's Cookbook and DVD: Tools and Techniques for Fighting Malicious Code

by Michael Hale Ligh, Steven Adair, Blake Hartstein, Matthew Richard
November 2010
Intermediate to advanced content levelIntermediate to advanced
744 pages
17h 18m
English
Wiley
Content preview from Malware Analyst's Cookbook and DVD: Tools and Techniques for Fighting Malicious Code

Chapter 13. Working with DLLs

Windows exposes a majority of its Application Programming Interface (API) in Dynamic Link Library (DLL) files. Thus, the functions that processes need to interact with the file system, Registry, network, and GUI interface are contained within DLLs. When a process wants to call an API function, it must first load a copy of the DLL that exports the API into its private memory space. The fact that DLLs execute in the context of a process makes their use very desirable to malware authors. By distributing malicious code as DLLs instead of EXEs, the malware can run inside any process (henceforth known as the target or host process), including winlogon.exe, csrss.exe, or explorer.exe. Not only does this capability help malware conceal its actions (any actions the malware performs will then appear to originate from the host process), but it gives the malware access to the entire addressable memory range owned by the host process.

If the host process is a browser, the malware can steal credentials from SSL-secured transactions before encryption takes place. If the host process accepts user input, the malware can record keystrokes or mouse movements. Of course, there are other ways to perform these malicious actions, but from a programmer's perspective, creating a DLL that contains the functionality and then injecting the DLL into a host process is extremely easy. Attackers are attracted to easy solutions, because they save time. Another reason attackers use DLLs ...

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Start your free trial

You might also like

Hacking Exposed Malware & Rootkits: Security Secrets and Solutions, Second Edition, 2nd Edition

Hacking Exposed Malware & Rootkits: Security Secrets and Solutions, Second Edition, 2nd Edition

Christopher C. Elisan, Michael A. Davis, Sean M. Bodmer, Aaron LeMasters
Malware Forensics Field Guide for Linux Systems

Malware Forensics Field Guide for Linux Systems

Eoghan Casey, Cameron H. Malin, James M. Aquilina
The Basics of Cyber Safety

The Basics of Cyber Safety

John Sammons, Michael Cross

Publisher Resources

ISBN: 9780470613030Purchase book