nganhkhoa/mether049-malware
1
0
Fork 0
mirror of https://github.com/nganhkhoa/malware.git synced 2024-06-10 21:32:07 +07:00
Code Issues Projects Releases Wiki Activity

Update malware-analysis_ref_and_memo.md

Browse Source
This commit is contained in:
mether049 2020-06-21 13:56:28 +09:00 committed by GitHub
parent dc4cfe7ec1
commit 06888b9370
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 7 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
malware-analysis_ref_and_memo.md
View File

@ -534,13 +534,13 @@ Injecition/Hollowingされたプロセスの自動検出<br>
- DLLをロードする流れやメモリからロードするツールについて
### Win32API
|API|dll|header file|arg|return|overview|
|:-|:-|:-|:-|:-|:-|
|[GetModuleHandle](https://docs.microsoft.com/en-us/windows/win32/api/libloaderapi/nf-libloaderapi-getmodulehandlea)|kernel32|libloaderapi.h (include Windows.h)|PCSTR lpModuleName(モジュール名)|Success:a handle to the specified module<br>Fail:NULL|指定したモジュールへのハンドルを取得|
|[ReadProcessMemory](https://docs.microsoft.com/ja-jp/windows/win32/api/memoryapi/nf-memoryapi-readprocessmemory)|kernel32|memoryapi.h (include Windows.h)|1.HANDLE hProcess<br>2.LPCVOID lpBaseAddress<br>3.LPVOID lpBuffer><br>4.SIZE_T nSize<br>5.SIZE_T \*lpNumberOfBytesRead|Success:non zero<br>Fail:zero(0)|特定のプロセスの指定したアドレスからメモリの内容を読み取る|
|[CreateRemoteThread](https://docs.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-createremotethread)|kernel32|processthreadsapi.h (include Windows.h)|1.HANDLE hProcess<br>2.LPSECURITY_ATTRIBUTES lpThreadAttributes<br>3.SIZE_T dwStackSize<br>4.LPTHREAD_START_ROUTINE lpStartAddress<br>5.LPVOID lpParameter<br>DWORD dwCreationFlags<br>6.LPDWORD lpThreadId|Success:a handle to the new thread<br>Fail:Null|別プロセス上に対してスレッドを作成|
|[InitializeCriticalSection](https://docs.microsoft.comクリティカルセクションオブジェクトを使うと、1 つのプロセスの複数のスレッド間で相互排他の同期/ja-jp/windows/win32/api/synchapi/nf-synchapi-initializecriticalsection)|kernel32|synchapi.h (include Windows.h)|LPCRITICAL_SECTION lpCriticalSection|-|クリティカルセクションを初期化,クリティカルセクションオブジェクトにより1つのプロセスの複数スレッド間で相互排他の同期が行える|
|[CreateMutex](https://docs.microsoft.com/en-us/windows/win32/api/synchapi/nf-synchapi-createmutexa)|kernel32|synchapi.h (include Windows.h)|1.LPSECURITY_ATTRIBUTES lpMutexAttributes<br>2.BOOL bInitialOwner<br>3.LPCSTR lpName|Success:a handle to the newly created mutex object<br>Fail:Null|Mutexを作成|
|API|dll/header file|arg|return|overview|
|:-|:-|:-|:-|:-|
|[GetModuleHandle](https://docs.microsoft.com/en-us/windows/win32/api/libloaderapi/nf-libloaderapi-getmodulehandlea)|kernel32/libloaderapi.h (include Windows.h)|PCSTR lpModuleName(モジュール名)|Success:a handle to the specified module<br>Fail:NULL|指定したモジュールへのハンドルを取得|
|[ReadProcessMemory](https://docs.microsoft.com/ja-jp/windows/win32/api/memoryapi/nf-memoryapi-readprocessmemory)|kernel32/memoryapi.h (include Windows.h)|1.HANDLE hProcess<br>2.LPCVOID lpBaseAddress<br>3.LPVOID lpBuffer><br>4.SIZE_T nSize<br>5.SIZE_T \*lpNumberOfBytesRead|Success:non zero<br>Fail:zero(0)|特定のプロセスの指定したアドレスからメモリの内容を読み取る|
|[CreateRemoteThread](https://docs.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-createremotethread)|kernel32/processthreadsapi.h (include Windows.h)|1.HANDLE hProcess<br>2.LPSECURITY_ATTRIBUTES lpThreadAttributes<br>3.SIZE_T dwStackSize<br>4.LPTHREAD_START_ROUTINE lpStartAddress<br>5.LPVOID lpParameter<br>DWORD dwCreationFlags<br>6.LPDWORD lpThreadId|Success:a handle to the new thread<br>Fail:Null|別プロセス上に対してスレッドを作成|
|[InitializeCriticalSection](https://docs.microsoft.com/ja-jp/windows/win32/api/synchapi/nf-synchapi-initializecriticalsection)|kernel32/synchapi.h (include Windows.h)|LPCRITICAL_SECTION lpCriticalSection|-|クリティカルセクションを初期化,クリティカルセクションオブジェクトにより1つのプロセスの複数スレッド間で相互排他の同期が行える|
|[CreateMutex](https://docs.microsoft.com/en-us/windows/win32/api/synchapi/nf-synchapi-createmutexa)|kernel32/synchapi.h (include Windows.h)|1.LPSECURITY_ATTRIBUTES lpMutexAttributes<br>2.BOOL bInitialOwner<br>3.LPCSTR lpName|Success:a handle to the newly created mutex object<br>Fail:Null|Mutexを作成|
### Deobfuscation
- バイナリの難読化解除に関するブログ