Deep Dive into OS Internals with Windbg

[Nytro]

Deep Dive into OS Internals

with Windbg

Malware and OS Internals

An approach towards reversing malwares, shellcodes and other malicious codes

to understand the ways in which they use the OS Internals for their

functionality.

Preface ............................................................................................................................................................................3Reversing Windows Internals..........................................................................................................................................4
Portable Executable Anatomy.........................................................................................................................................5
Data Directories of Interest.............................................................................................................................................7
Import Directory..............................................................................................................................................................8
Import Address Table....................................................................................................................................................12
Export Directory ............................................................................................................................................................13
Manual Walkthrough of Export Directory.....................................................................................................................14
Process Environment Block...........................................................................................................................................17
Different methods to locate the PEB ............................................................................................................................18
Understanding an Example Shellcode...........................................................................................................................20
Using _PEB_LDR_DATA .................................................................................................................................................20
Using _LDR_DATA_TABLE_ENTRY.................................................................................................................................23
Practical Example with Rustock.B Rootkit.....................................................................................................................25
Conclusion.....................................................................................................................................................................32
References.....................................................................................................................................................................33

Download:

http://www.exploit-db.com/wp-content/themes/exploit/docs/18576.pdf