Skip to Main Content
Malware Analyst's Cookbook and DVD: Tools and Techniques for Fighting Malicious Code
book

Malware Analyst's Cookbook and DVD: Tools and Techniques for Fighting Malicious Code

by Michael Hale Ligh, Steven Adair, Blake Hartstein, Matthew Richard
November 2010
Intermediate to advanced content levelIntermediate to advanced
744 pages
17h 18m
English
Wiley
Content preview from Malware Analyst's Cookbook and DVD: Tools and Techniques for Fighting Malicious Code

Chapter 16. Memory Forensics: Code Injection and Extraction

Malware leverages code injection to perform actions from within the context of another process. By doing so, the malware can force a legitimate process to perform actions on its behalf, such as downloading additional trojans or stealing information from the system. Attackers can inject code into a process in many ways, such as writing to the remote process's memory directly or adding a registry key that makes new processes load a DLL of the attacker's choice. This chapter discusses how you can determine if any processes on the system are victims of code injection, and if so, how you can extract the memory segments that contain malicious code.

Investigating DLLs

Every _EPROCESS structure contains a member called the PEB (Process Environment Block). The PEB contains the full path to the process executable, the full command line used to start the process, the current working directory, and three doubly linked lists that contain the full path to DLLs loaded by the process. All three lists should contain the same DLLs, but ordered differently depending on their position in memory (InMemoryOrderModuleList), when they were loaded (InLoadOrderModuleList), and when they initialized (InInitializationOrderList).

To enumerate the loaded DLLs in a process, you can parse the three doubly linked lists. Using WinDbg (once again on an XP system for our examples), you can see that at offset 0xC of the PEB there is a member named Ldr, which ...

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Start your free trial

You might also like

Hacking Exposed Malware & Rootkits: Security Secrets and Solutions, Second Edition, 2nd Edition

Hacking Exposed Malware & Rootkits: Security Secrets and Solutions, Second Edition, 2nd Edition

Christopher C. Elisan, Michael A. Davis, Sean M. Bodmer, Aaron LeMasters
Malware Forensics Field Guide for Linux Systems

Malware Forensics Field Guide for Linux Systems

Eoghan Casey, Cameron H. Malin, James M. Aquilina
The Basics of Cyber Safety

The Basics of Cyber Safety

John Sammons, Michael Cross

Publisher Resources

ISBN: 9780470613030Purchase book