With the help of red-team techniques learn Windows system design from the PE Binary structure, culminating in modern attack techniques used by multiple red teams in practice.
Key Features
- Explore modern compilers generate executable files from scratch
- Learn to write and develop a Windows Shellcode Generator in Python
- Understand several ways malware evades modern security products and tactics
Book Description
This book will help you learn the inner workings of Windows systems and gain a red team perspective on how to abuse system design to achieve mainstream APT attack techniques.
The book distills three aspects of reverse engineering, compilers, and system practice principles into a practical study of Windows cyberattacks and explains the attack techniques from a red red-team perspective, which have been used by national cyber armies in recent years on the solid foundation of PE attack techniques. This book also covers practical examples of malware and online game hacking, such as EXE infection, shellcode development, software packer, UAC bypass, path parser vulnerabilities, and digital signature forgery.
At the end of this book, you will be able to combine the techniques in this book with the victim's computer environment to construct appropriate ways to bypass security and anti-virus products.
What you will learn
- Discover how contemporary compilers create executable files from nothing
- Prepare any software file by the Windows OS using a dynamic process
- Understand how malware circumvents current security measures and tools
- Learn how to decompile program files in the common PE format
- Find out how attackers undermine system functions and exploit vulnerabilities
Who This Book Is For
This book is for Windows engineers, malware researchers, network administrators, and ethical hackers who want to apply their skills in Windows exploitation, Kernel Practice, and Reverse Engineering. The readers need to have basic knowledge of C/C++ and hands-on experience with reverse engineering.
Table of Contents
- From Source to Binaries: The Journey of a C Program
- Process Memory: File Mapping, PE Parser, Tiny-Linker, and Hollowing
- Dynamic API Calling: Thread, Process, and Environment Information
- Shellcode Technique: Export Functions Parsing
- Application Loader Design
- PE Module Relocation
- PE To Shellcode: Transform PE Files into Shellcode
- Software Packer Design
- Digital Signature: Authenticode, Verify, and Attacks
- Reversing User Account Control (UAC) and Bypass Tricks
- Appendix: NTFS, Paths, and Symbols
