Windows APT Warfare

5

Application Loader Design

In this chapter, we will learn how a simple application loader can execute EXE files in memory without creating a child process. We will learn how to import an address table in a PE structure and write C programs to analyze them. We will then learn how to hijack Windows API calls, replace API behaviors with malicious code, and do DLL side-loading using examples.

In this chapter, we’re going to cover the following main topics:

• Import Address Table in PE
• Import API analyzer example
• Examples of IAT hijack
• DLL side-loading example

Import Address Table in PE

As we mentioned in Chapter 1, From Source to Binaries – The Journey of a C Program, when a program is executed, the following procedure is performed. First, a new ...