Data section as a container

Data section as a container

Video Contents

- Storing payloads in .data section - code template walk-through [0:00]
- Code compilation and demo under debugger [1:12]

Addendum

Initialized Global Variables and .data Section

Initialized global variables are stored in the .data section of the PE file, which is a dedicated section used to hold global data that needs to have a specific initial value when the program starts executing. In programming languages like C and C++, global variables can be initialized like this:

int g_GlobalVariable = 42;

int main() {
    printf("The value of the global variable is: %d\n", g_GlobalVariable);
    return 0;
}

RED TEAM Operator: Malware Development Essentials Course

Buy nowLearn more

Intro and Setup

  • Introduction
  • Development VM Setup
  • RTO-Win10.ova
  • RTO-maldev.zip
  • RTO-maldev-encrypted.zip
  • Shellcodes

Portable Executable

  • PE files - format and structure
  • PE Bear - looking inside
  • Generating EXE vs DLL
  • PE compilation

Droppers

  • Where to store payloads?
  • Storing payloads in code section
  • Data section as a container
  • Payloads in resource section

Obfuscation and Hiding

  • Encoding and Encryption
  • Payload encoding
  • Encrypting payloads - XOR
  • Encrypting payloads - AES
  • Antivirus vs call obfuscation
  • Implementing function call obfuscation

Backdoors and Trojans

  • Backdooring PE theory
  • Making Putty a trojan

Code Injection

  • What is code injection?
  • Injecting code into remote process
  • Implementing code injection
  • Loading DLLs into remote process
  • DLL generator and injector

Extras

  • Making program invisible

Combined Project

  • Dropper overview
  • Dropper implementation
  • Bypassing Windows Defender
  • Assignment

Summary

  • Your Feedback
  • Course closing information