SlideShare a Scribd company logo

Reversing & malware analysis training part 2 introduction to windows internals

Download as PPTX, PDF
securityxploded, profile picture
securityxploded

The document from SecurityXploded presents a disclaimer stating the provided content is 'as is' with no warranty, while also acknowledging contributions from the community and trainers. It includes details of a reversing and malware analysis training program and covers aspects of Windows architecture, memory management, processes, threads, and important APIs. The training aims to enhance understanding of software interactions and system operations without responsibility for any misuse of the information presented.

Technology
Related topics:
Reverse Engineering
1 of 21
Downloaded 141 times
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
www.SecurityXploded.com
Disclaimer The Content, Demonstration, Source Code and Programs presented here is "AS IS" without any warranty or conditions of any kind. Also the views/ideas/knowledge expressed here are solely of the trainer’s only and nothing to do with the company or the organization in which the trainer is currently working. However in no circumstances neither the trainer nor SecurityXploded is responsible for any damage or loss caused due to use or misuse of the information presented here. www.SecurityXploded.com
Acknowledgement  Special thanks to null & Garage4Hackers community for their extended support and cooperation.  Thanks to all the trainers who have devoted their precious time and countless hours to make it happen. www.SecurityXploded.com
Reversing & Malware Analysis Training This presentation is part of our Reverse Engineering & Malware Analysis Training program. Currently it is delivered only during our local meet for FREE of cost. For complete details of this course, visit our Security Training page. www.SecurityXploded.com
Who am I #1 Amit Malik (sometimes DouBle_Zer0,DZZ)  Member SecurityXploded & Garage4Hackers  Security Researcher  RE, Exploit Analysis/Development, Malware Analysis  Email: m.amit30@gmail.com www.SecurityXploded.com
Who am I #2 Swapnil Pathak  Member SecurityXploded  Security Researcher  RE, Malware Analysis, Network Security  Email: swapnilpathak101@gmail.com www.SecurityXploded.com
Windows Architecture www.SecurityXploded.com
Memory Management  Virtual Memory - An invisible layer between a software and physical memory - Every process first get loaded into its virtual memory address space - Small units called “pages” are used to do mapping between physical memory and virtual memory.  Paging - Memory management scheme that stores and retrieves data from secondary storage for use in main memory - Uses same size blocks called pages - Page table is used to translate virtual addresses in physical memory addresses www.SecurityXploded.com
Memory Management Cont.  User Address Space - Allocated for user mode applications. - All processes execute in their own virtual space. - Use operating system dlls to interact with kernel  Kernel Address Space - Strictly reserved for kernel, device drivers and operating system executive. - No user mode application can directly interact with the kernel. www.SecurityXploded.com
Kernel & User Address Space www.SecurityXploded.com
Process and Thread  Process - Executing instance of an application. - Isolated address space - PEB data structure store information about process - PEB is an user space data structure  Threads - Multiple threads share the same address space in the process. - Each process has at least a single executing thread. - TEB data structure store information about thread www.SecurityXploded.com
PEB (Process Environment Block) An opaque data structure that store information about process in user space www.SecurityXploded.com
PEB Cont. www.SecurityXploded.com
TEB (Thread Environment Block) TEB is a data structure that store information about thread www.SecurityXploded.com
Application Programming Interface  API - Includes functions, classes, data structures and variables - Interface between various software components to communicate with each other. - Windows APIs are used to interact with kernel or other modules.  MSDN - Provides documentation for various API functions.  System Dlls - ntdll.dll, kernel32.dll, user32.dll, advapi32.dll, hal.dll etc www.SecurityXploded.com
System Service Dispatching www.SecurityXploded.com
System Service Dispatching Cont. www.SecurityXploded.com
Important API  File and Directories - CreateFile, GetSystemDirectory, ReadFile, WriteFile etc  Network - socket, send, recv, URLDownloadToFile etc  Registry - RegOpenKey, RegSetValue, RegQueryValue etc www.SecurityXploded.com
Important API Cont.  Processes, Threads, Synchronization using mutex, semaphore. - CreateProcess, ReadProcessMemory, WriteProcessMemory,CreateRemoteThread, CreateMutex etc  Memory - VirtualAlloc, VirtualProtect ,HeapAlloc, LocalAlloc etc www.SecurityXploded.com
Reference  Complete Reference Guide for Reversing & Malware Analysis Training www.SecurityXploded.com
Thank You ! http://SecurityXploded.com

More Related Content

PPTX
Advanced Malware Analysis Training Session 5 - Reversing Automation
securityxploded
 
PPTX
Reversing & malware analysis training part 3 windows pe file format basics
securityxploded
 
PPTX
Primer on password security
securityxploded
 
PPTX
Reversing & Malware Analysis Training Part 11 - Exploit Development [Advanced]
securityxploded
 
PPTX
Advanced Malware Analysis Training Session 2 - Botnet Analysis Part 1
securityxploded
 
PPTX
Reversing & malware analysis training part 1 lab setup guide
securityxploded
 
PPTX
Advanced Malware Analysis Training Session 6 - Malware Sandbox Analysis
securityxploded
 
PPTX
Advanced Malware Analysis Training Session 1 - Detection and Removal of Malwares
securityxploded
 
Advanced Malware Analysis Training Session 5 - Reversing Automation
securityxploded
 
Reversing & malware analysis training part 3 windows pe file format basics
securityxploded
 
Primer on password security
securityxploded
 
Reversing & Malware Analysis Training Part 11 - Exploit Development [Advanced]
securityxploded
 
Advanced Malware Analysis Training Session 2 - Botnet Analysis Part 1
securityxploded
 
Reversing & malware analysis training part 1 lab setup guide
securityxploded
 
Advanced Malware Analysis Training Session 6 - Malware Sandbox Analysis
securityxploded
 
Advanced Malware Analysis Training Session 1 - Detection and Removal of Malwares
securityxploded
 

What's hot (20)

PPTX
Reversing & Malware Analysis Training Part 9 - Advanced Malware Analysis
securityxploded
 
PPTX
Advanced Malware Analysis Training Session 3 - Botnet Analysis Part 2
securityxploded
 
PPTX
Anti-Virus Evasion Techniques and Countermeasures
n|u - The Open Security Community
 
PPTX
Advanced Malware Analysis Training Session 4 - Anti-Analysis Techniques
securityxploded
 
PPTX
Advanced Malware Analysis Training Session 7 - Malware Memory Forensics
securityxploded
 
PPTX
Anatomy of Exploit Kits
securityxploded
 
PPTX
Reversing & Malware Analysis Training Part 13 - Future Roadmap
securityxploded
 
PPTX
Reversing & Malware Analysis Training Part 4 - Assembly Programming Basics
securityxploded
 
PPTX
Advanced malware analysis training session 7 malware memory forensics
Cysinfo Cyber Security Community
 
PPTX
Reversing & Malware Analysis Training Part 6 - Practical Reversing (I)
securityxploded
 
PPTX
Advanced malwareanalysis training session2 botnet analysis part1
Cysinfo Cyber Security Community
 
PPTX
Advanced Malware Analysis Training Session 11 - (Part 2) Dissecting the Heart...
securityxploded
 
PPTX
Advanced malware analysis training session5 reversing automation
Cysinfo Cyber Security Community
 
PPTX
Hunting Rootkit From the Dark Corners Of Memory
securityxploded
 
PPTX
Reversing malware analysis training part6 practical reversing
Cysinfo Cyber Security Community
 
PPTX
Reversing malware analysis training part11 exploit development advanced
Cysinfo Cyber Security Community
 
PPTX
Reversing malware analysis training part3 windows pefile formatbasics
Cysinfo Cyber Security Community
 
PPTX
Automating Malware Analysis
securityxploded
 
PPTX
Reversing malware analysis trainingpart9 advanced malware analysis
Cysinfo Cyber Security Community
 
PPTX
Reversing malware analysis training part7 unpackingupx
Cysinfo Cyber Security Community
 
Reversing & Malware Analysis Training Part 9 - Advanced Malware Analysis
securityxploded
 
Advanced Malware Analysis Training Session 3 - Botnet Analysis Part 2
securityxploded
 
Anti-Virus Evasion Techniques and Countermeasures
n|u - The Open Security Community
 
Advanced Malware Analysis Training Session 4 - Anti-Analysis Techniques
securityxploded
 
Advanced Malware Analysis Training Session 7 - Malware Memory Forensics
securityxploded
 
Anatomy of Exploit Kits
securityxploded
 
Reversing & Malware Analysis Training Part 13 - Future Roadmap
securityxploded
 
Reversing & Malware Analysis Training Part 4 - Assembly Programming Basics
securityxploded
 
Advanced malware analysis training session 7 malware memory forensics
Cysinfo Cyber Security Community
 
Reversing & Malware Analysis Training Part 6 - Practical Reversing (I)
securityxploded
 
Advanced malwareanalysis training session2 botnet analysis part1
Cysinfo Cyber Security Community
 
Advanced Malware Analysis Training Session 11 - (Part 2) Dissecting the Heart...
securityxploded
 
Advanced malware analysis training session5 reversing automation
Cysinfo Cyber Security Community
 
Hunting Rootkit From the Dark Corners Of Memory
securityxploded
 
Reversing malware analysis training part6 practical reversing
Cysinfo Cyber Security Community
 
Reversing malware analysis training part11 exploit development advanced
Cysinfo Cyber Security Community
 
Reversing malware analysis training part3 windows pefile formatbasics
Cysinfo Cyber Security Community
 
Automating Malware Analysis
securityxploded
 
Reversing malware analysis trainingpart9 advanced malware analysis
Cysinfo Cyber Security Community
 
Reversing malware analysis training part7 unpackingupx
Cysinfo Cyber Security Community
 
Ad

Similar to Reversing & malware analysis training part 2 introduction to windows internals (20)

PDF
Reversing & malware analysis training part 2 introduction to windows internals
Abdulrahman Bassam
 
PPTX
Reversing malware analysis training part2 introduction to windows internals
Cysinfo Cyber Security Community
 
PDF
Reversing & malware analysis training part 12 rootkit analysis
Abdulrahman Bassam
 
PDF
Reversing & malware analysis training part 3 windows pe file format basics
Abdulrahman Bassam
 
PPTX
Advanced malware analysis training session8 introduction to android
Cysinfo Cyber Security Community
 
PPTX
Threat Modeling a Batch Job System - AWS Security Community Day
2nd Sight Lab
 
PDF
Design Decisions For Understanding Software Architecture
Tiffany Graham
 
PPT
Ch11
Raja Waseem Akhtar
 
PPT
Ch11 system administration
Raja Waseem Akhtar
 
PDF
12 core technologies you should learn, love, and hate to be a 'real' technocrat
linoj
 
PDF
CS9222 Advanced Operating System
Kathirvel Ayyaswamy
 
PPTX
Advanced Malware Analysis Training Session 8 - Introduction to Android
securityxploded
 
PDF
Reversing & malware analysis training part 5 reverse engineering tools basics
Abdulrahman Bassam
 
PDF
Linux Assignment 3
Diane Allen
 
PPTX
Anatomy of a Drupal Hack - TechKnowFile 2014
University of Toronto Libraries - Information Technology Services
 
DOCX
My first Operating System Presentation
Rida Bilgrami
 
PDF
Reversing & malware analysis training part 10 exploit development basics
Abdulrahman Bassam
 
PDF
amrapali builders@@@@hacking windows internals.pdf
amrapalibuildersreviews
 
PPTX
Some more Concepts of DOT cvcvcvNET.pptx
zmulani8
 
PDF
Multicore Software Development Techniques Applications Tips and Tricks 1st Ed...
zmqyytgwu0985
 
Reversing & malware analysis training part 2 introduction to windows internals
Abdulrahman Bassam
 
Reversing malware analysis training part2 introduction to windows internals
Cysinfo Cyber Security Community
 
Reversing & malware analysis training part 12 rootkit analysis
Abdulrahman Bassam
 
Reversing & malware analysis training part 3 windows pe file format basics
Abdulrahman Bassam
 
Advanced malware analysis training session8 introduction to android
Cysinfo Cyber Security Community
 
Threat Modeling a Batch Job System - AWS Security Community Day
2nd Sight Lab
 
Design Decisions For Understanding Software Architecture
Tiffany Graham
 
Ch11
Raja Waseem Akhtar
 
Ch11 system administration
Raja Waseem Akhtar
 
12 core technologies you should learn, love, and hate to be a 'real' technocrat
linoj
 
CS9222 Advanced Operating System
Kathirvel Ayyaswamy
 
Advanced Malware Analysis Training Session 8 - Introduction to Android
securityxploded
 
Reversing & malware analysis training part 5 reverse engineering tools basics
Abdulrahman Bassam
 
Linux Assignment 3
Diane Allen
 
Anatomy of a Drupal Hack - TechKnowFile 2014
University of Toronto Libraries - Information Technology Services
 
My first Operating System Presentation
Rida Bilgrami
 
Reversing & malware analysis training part 10 exploit development basics
Abdulrahman Bassam
 
amrapali builders@@@@hacking windows internals.pdf
amrapalibuildersreviews
 
Some more Concepts of DOT cvcvcvNET.pptx
zmulani8
 
Multicore Software Development Techniques Applications Tips and Tricks 1st Ed...
zmqyytgwu0985
 
Ad

More from securityxploded (20)

PPTX
Fingerprinting healthcare institutions
securityxploded
 
PDF
Hollow Process Injection - Reversing and Investigating Malware Evasive Tactics
securityxploded
 
PDF
Buffer Overflow Attacks
securityxploded
 
PPTX
Malicious Client Detection Using Machine Learning
securityxploded
 
PDF
Understanding CryptoLocker (Ransomware) with a Case Study
securityxploded
 
PDF
Linux Malware Analysis using Limon Sandbox
securityxploded
 
PPT
Introduction to SMPC
securityxploded
 
PPTX
Breaking into hospitals
securityxploded
 
PPTX
Bluetooth [in]security
securityxploded
 
PPTX
Basic malware analysis
securityxploded
 
PPTX
Reverse Engineering Malware
securityxploded
 
PPTX
DLL Preloading Attack
securityxploded
 
PPTX
Partial Homomorphic Encryption
securityxploded
 
PPTX
Return Address – The Silver Bullet
securityxploded
 
PPTX
Defeating public exploit protections (EMET v5.2 and more)
securityxploded
 
PPTX
Hunting Ghost RAT Using Memory Forensics
securityxploded
 
PPTX
Malicious Url Detection Using Machine Learning
securityxploded
 
PPTX
MalwareNet Project
securityxploded
 
PPTX
Reversing and Decrypting the Communications of APT Malware (Etumbot)
securityxploded
 
PPTX
Dissecting BetaBot
securityxploded
 
Fingerprinting healthcare institutions
securityxploded
 
Hollow Process Injection - Reversing and Investigating Malware Evasive Tactics
securityxploded
 
Buffer Overflow Attacks
securityxploded
 
Malicious Client Detection Using Machine Learning
securityxploded
 
Understanding CryptoLocker (Ransomware) with a Case Study
securityxploded
 
Linux Malware Analysis using Limon Sandbox
securityxploded
 
Introduction to SMPC
securityxploded
 
Breaking into hospitals
securityxploded
 
Bluetooth [in]security
securityxploded
 
Basic malware analysis
securityxploded
 
Reverse Engineering Malware
securityxploded
 
DLL Preloading Attack
securityxploded
 
Partial Homomorphic Encryption
securityxploded
 
Return Address – The Silver Bullet
securityxploded
 
Defeating public exploit protections (EMET v5.2 and more)
securityxploded
 
Hunting Ghost RAT Using Memory Forensics
securityxploded
 
Malicious Url Detection Using Machine Learning
securityxploded
 
MalwareNet Project
securityxploded
 
Reversing and Decrypting the Communications of APT Malware (Etumbot)
securityxploded
 
Dissecting BetaBot
securityxploded
 

Recently uploaded (20)

PDF
Advanced methodologies resolving dimensionality complications for autism neur...
IAESIJAI
 
PDF
TokAI - TikTok AI Agent : The First AI Application That Analyzes 10,000+ Vira...
SOFTTECHHUB
 
PDF
NewMind AI Weekly Chronicles - August'25-Week II
NewMind AI
 
PDF
Empathic Computing: Creating Shared Understanding
Mark Billinghurst
 
PDF
Agricultural_Statistics_at_a_Glance_2022_0.pdf
SandeepSingh286037
 
PDF
Getting Started with Data Integration: FME Form 101
Safe Software
 
PDF
MIND Revenue Release Quarter 2 2025 Press Release
MIND CTI
 
PDF
gpt5_lecture_notes_comprehensive_20250812015547.pdf
Chinchu40
 
PDF
Building Integrated photovoltaic BIPV_UPV.pdf
SandeepSingh286037
 
PDF
Unlocking AI with Model Context Protocol (MCP)
Brian McKeiver
 
PDF
Optimiser vos workloads AI/ML sur Amazon EC2 et AWS Graviton
Julien SIMON
 
PPTX
Tartificialntelligence_presentation.pptx
ry7r52mzb4
 
PPTX
SOPHOS-XG Firewall Administrator PPT.pptx
AgnesMunisi
 
PDF
Network Security Unit 5.pdf for BCA BBA.
Serpent6
 
PDF
Blue Purple Modern Animated Computer Science Presentation.pdf.pdf
Akar16
 
PDF
Accuracy of neural networks in brain wave diagnosis of schizophrenia
IAESIJAI
 
PDF
Architecting across the Boundaries of two Complex Domains - Healthcare & Tech...
Peter Tan
 
PPTX
Digital-Transformation-Roadmap-for-Companies.pptx
David Malick Dieng
 
PDF
Build a system with the filesystem maintained by OSTree @ COSCUP 2025
Jian-Hong Pan
 
PDF
Machine learning based COVID-19 study performance prediction
IAESIJAI
 
Advanced methodologies resolving dimensionality complications for autism neur...
IAESIJAI
 
TokAI - TikTok AI Agent : The First AI Application That Analyzes 10,000+ Vira...
SOFTTECHHUB
 
NewMind AI Weekly Chronicles - August'25-Week II
NewMind AI
 
Empathic Computing: Creating Shared Understanding
Mark Billinghurst
 
Agricultural_Statistics_at_a_Glance_2022_0.pdf
SandeepSingh286037
 
Getting Started with Data Integration: FME Form 101
Safe Software
 
MIND Revenue Release Quarter 2 2025 Press Release
MIND CTI
 
gpt5_lecture_notes_comprehensive_20250812015547.pdf
Chinchu40
 
Building Integrated photovoltaic BIPV_UPV.pdf
SandeepSingh286037
 
Unlocking AI with Model Context Protocol (MCP)
Brian McKeiver
 
Optimiser vos workloads AI/ML sur Amazon EC2 et AWS Graviton
Julien SIMON
 
Tartificialntelligence_presentation.pptx
ry7r52mzb4
 
SOPHOS-XG Firewall Administrator PPT.pptx
AgnesMunisi
 
Network Security Unit 5.pdf for BCA BBA.
Serpent6
 
Blue Purple Modern Animated Computer Science Presentation.pdf.pdf
Akar16
 
Accuracy of neural networks in brain wave diagnosis of schizophrenia
IAESIJAI
 
Architecting across the Boundaries of two Complex Domains - Healthcare & Tech...
Peter Tan
 
Digital-Transformation-Roadmap-for-Companies.pptx
David Malick Dieng
 
Build a system with the filesystem maintained by OSTree @ COSCUP 2025
Jian-Hong Pan
 
Machine learning based COVID-19 study performance prediction
IAESIJAI
 

Reversing & malware analysis training part 2 introduction to windows internals

  • 2. Disclaimer The Content, Demonstration, Source Code and Programs presented here is "AS IS" without any warranty or conditions of any kind. Also the views/ideas/knowledge expressed here are solely of the trainer’s only and nothing to do with the company or the organization in which the trainer is currently working. However in no circumstances neither the trainer nor SecurityXploded is responsible for any damage or loss caused due to use or misuse of the information presented here. www.SecurityXploded.com
  • 3. Acknowledgement  Special thanks to null & Garage4Hackers community for their extended support and cooperation.  Thanks to all the trainers who have devoted their precious time and countless hours to make it happen. www.SecurityXploded.com
  • 4. Reversing & Malware Analysis Training This presentation is part of our Reverse Engineering & Malware Analysis Training program. Currently it is delivered only during our local meet for FREE of cost. For complete details of this course, visit our Security Training page. www.SecurityXploded.com
  • 5. Who am I #1 Amit Malik (sometimes DouBle_Zer0,DZZ)  Member SecurityXploded & Garage4Hackers  Security Researcher  RE, Exploit Analysis/Development, Malware Analysis  Email: [email protected] www.SecurityXploded.com
  • 6. Who am I #2 Swapnil Pathak  Member SecurityXploded  Security Researcher  RE, Malware Analysis, Network Security  Email: [email protected] www.SecurityXploded.com
  • 7. Windows Architecture www.SecurityXploded.com
  • 8. Memory Management  Virtual Memory - An invisible layer between a software and physical memory - Every process first get loaded into its virtual memory address space - Small units called “pages” are used to do mapping between physical memory and virtual memory.  Paging - Memory management scheme that stores and retrieves data from secondary storage for use in main memory - Uses same size blocks called pages - Page table is used to translate virtual addresses in physical memory addresses www.SecurityXploded.com
  • 9. Memory Management Cont.  User Address Space - Allocated for user mode applications. - All processes execute in their own virtual space. - Use operating system dlls to interact with kernel  Kernel Address Space - Strictly reserved for kernel, device drivers and operating system executive. - No user mode application can directly interact with the kernel. www.SecurityXploded.com
  • 10. Kernel & User Address Space www.SecurityXploded.com
  • 11. Process and Thread  Process - Executing instance of an application. - Isolated address space - PEB data structure store information about process - PEB is an user space data structure  Threads - Multiple threads share the same address space in the process. - Each process has at least a single executing thread. - TEB data structure store information about thread www.SecurityXploded.com
  • 12. PEB (Process Environment Block) An opaque data structure that store information about process in user space www.SecurityXploded.com
  • 13. PEB Cont. www.SecurityXploded.com
  • 14. TEB (Thread Environment Block) TEB is a data structure that store information about thread www.SecurityXploded.com
  • 15. Application Programming Interface  API - Includes functions, classes, data structures and variables - Interface between various software components to communicate with each other. - Windows APIs are used to interact with kernel or other modules.  MSDN - Provides documentation for various API functions.  System Dlls - ntdll.dll, kernel32.dll, user32.dll, advapi32.dll, hal.dll etc www.SecurityXploded.com
  • 16. System Service Dispatching www.SecurityXploded.com
  • 17. System Service Dispatching Cont. www.SecurityXploded.com
  • 18. Important API  File and Directories - CreateFile, GetSystemDirectory, ReadFile, WriteFile etc  Network - socket, send, recv, URLDownloadToFile etc  Registry - RegOpenKey, RegSetValue, RegQueryValue etc www.SecurityXploded.com
  • 19. Important API Cont.  Processes, Threads, Synchronization using mutex, semaphore. - CreateProcess, ReadProcessMemory, WriteProcessMemory,CreateRemoteThread, CreateMutex etc  Memory - VirtualAlloc, VirtualProtect ,HeapAlloc, LocalAlloc etc www.SecurityXploded.com
  • 20. Reference  Complete Reference Guide for Reversing & Malware Analysis Training www.SecurityXploded.com

Editor's Notes

  • #11: Picture is taken from : rootkit arsenal
  • #17: Picture is taken from : RootKit Arsenal (An awesome book)
  • #18: Picture source: http://www.codeproject.com/KB/system/hide-driver/NtCallScheme_small.png