Главная
Study mode:
on
1
Starting with the function that creates the trampolines
2
Location of the new import table
3
Concerning precomputed values
4
Typing arguments
5
Loading the required DLLs
6
Debugging
7
Preparing to store function pointers
8
Getting the desired function pointer
9
Allocating new memory
10
Checking memory for padding bytes 0xABABABAB
11
Basis for the trampoline
12
Generating random numbers
13
Adding code to the trampoline
14
Example function call
15
Wrapping up and recap
Description:
Save Big on Coursera Plus. 7,000+ courses at $160 off. Limited Time Only! Grab it Watch a 30-minute technical video exploring advanced runtime linking techniques, focusing on trampoline creation and function pointer manipulation in malware analysis. Learn how trampolines are constructed, function pointers are resolved and re-obfuscated, and examine heap memory debugging using the 0xABABABAB pattern. Follow along through key topics including import table locations, precomputed values, DLL loading, memory allocation, random number generation, and trampoline code implementation. Gain practical insights into reverse engineering and malware analysis through detailed explanations and a concrete example function call demonstration.

Creating Trampolines and Re-Obfuscating Function Pointers in Runtime Linking - Part 7

Dr Josh Stroschein
Add to list
#Information Security (InfoSec) #Malware Analysis #Reverse Engineering #Programming #Programming Languages #Assembly Language #Computer Science #Memory Management #Memory Allocation
1 of 15

Starting with the function that creates the trampolines