nganhkhoa/mether049-malware
1
0
Fork 0
mirror of https://github.com/nganhkhoa/malware.git synced 2024-06-10 21:32:07 +07:00
Code Issues Projects Releases Wiki Activity

Update malware-analysis_ref_and_memo.md

Browse Source
This commit is contained in:
mether049 2020-06-21 00:50:44 +09:00 committed by GitHub
parent 215aba95b6
commit 71b96652f8
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
malware-analysis_ref_and_memo.md
View File

@ -536,7 +536,9 @@ Injecition/Hollowingされたプロセスの自動検出<br>
|API|dll|header file|arg|return|overview|
|:-|:-|:-|:-|:-|:-|
|GetModuleHandle|kernel32|libloaderapi.h (include Windows.h)|PCSTR lpModuleName(モジュール名)|Success:a handle to the specified module<br>Fail:NULL|指定したモジュールへのハンドルを取得|
|[GetModuleHandle](https://docs.microsoft.com/en-us/windows/win32/api/libloaderapi/nf-libloaderapi-getmodulehandlea)|kernel32|libloaderapi.h (include Windows.h)|PCSTR lpModuleName(モジュール名)|Success:a handle to the specified module<br>Fail:NULL|指定したモジュールへのハンドルを取得|
|[ReadProcessMemory](https://docs.microsoft.com/ja-jp/windows/win32/api/memoryapi/nf-memoryapi-readprocessmemory)|kernel32|memoryapi.h (include Windows.h)|HANDLE hProcess<br>LPCVOID lpBaseAddress<br>LPVOID lpBuffer><br>SIZE_T nSize<br>SIZE_T \*lpNumberOfBytesRead|Success:non zero<br>Fail:zero(0)|特定のプロセスの指定したアドレスからメモリの内容を読み取る|
|[CreateRemoteThread](https://docs.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-createremotethread)|kernel32|processthreadsapi.h (include Windows.h)|HANDLE hProcess<br>LPSECURITY_ATTRIBUTES lpThreadAttributes<br>SIZE_T dwStackSize<br>LPTHREAD_START_ROUTINE lpStartAddress<br>LPVOID lpParameter<br>DWORD dwCreationFlags<br>LPDWORD lpThreadId|Success:a handle to the new thread<br>Fail:Null|別プロセス上に対してスレッドを作成|
### Deobfuscation
- バイナリの難読化解除に関するブログ