Windows APT Warfare

2

Process Memory – File Mapping, PE Parser, tinyLinker, and Hollowing

In Chapter 1, From Source to Binaries – The Journey of a C Program, we learned how C/C++ can be packaged as an executable in the operating system. In this chapter, we will explain the file mapping process, build a compact compiler, attach malware to system services, and infect game programs.

In this chapter, we’re going to cover the following main topics:

• The memory of the static contents of PE files
• PE Parser example
• Dynamic file mapping
• PE infection (PE Patcher) example
• tinyLinker example
• Examples of process hollowing
• PE files to HTML

Sample programs

The sample programs mentioned in this chapter are available on GitHub, where you can download the exercises: https://github.com/PacktPublishing/Windows-APT-Warfare/tree/main/chapter%2302 ...