Search icon
Arrow left icon
All Products
Best Sellers
New Releases
Books
Videos
Audiobooks
Learning Hub
Newsletters
Free Learning
Arrow right icon
Windows APT Warfare

You're reading from  Windows APT Warfare

Product type Book
Published in Mar 2023
Publisher Packt
ISBN-13 9781804618110
Pages 258 pages
Edition 1st Edition
Languages
Author (1):
Sheng-Hao Ma Sheng-Hao Ma
Profile icon Sheng-Hao Ma

Table of Contents (17) Chapters

Preface 1. Part 1 – Modern Windows Compiler
2. Chapter 1: From Source to Binaries – The Journey of a C Program 3. Chapter 2: Process Memory – File Mapping, PE Parser, tinyLinker, and Hollowing 4. Chapter 3: Dynamic API Calling – Thread, Process, and Environment Information 5. Part 2 – Windows Process Internals
6. Chapter 4: Shellcode Technique – Exported Function Parsing 7. Chapter 5: Application Loader Design 8. Chapter 6: PE Module Relocation 9. Part 3 – Abuse System Design and Red Team Tips
10. Chapter 7: PE to Shellcode – Transforming PE Files into Shellcode 11. Chapter 8: Software Packer Design 12. Chapter 9: Digital Signature – Authenticode Verification 13. Chapter 10: Reversing User Account Control and Bypassing Tricks 14. Index 15. Other Books You May Enjoy Appendix – NTFS, Paths, and Symbols

Authenticode digital signatures

Authenticode is a code-signing technology developed by Microsoft that helps users to check the publisher who signed the program. It also ensures that the signed program has not been tampered with by attackers during transport. Additionally, the signature used to sign must be verified by trusted certificate authorities (CAs) to ensure that the file being signed actually comes from the publisher.

For more information, please refer to Microsoft’s public document Authenticode Digital Signatures https://learn.microsoft.com/en-us/windows-hardware/drivers/install/authenticode. This introduction states that Microsoft has designed the Authenticode specification to provide a digital signature mechanism that allows users to verify the code’s integrity. This integrity proves that the program has not been tampered with by hackers or backdoors, but rather that the original program content has been obtained from a trusted company without forgery.

...
lock icon The rest of the chapter is locked
Register for a free Packt account to unlock a world of extra content!
A free Packt account unlocks extra newsletters, articles, discounted offers, and much more. Start advancing your knowledge today.
Unlock this book and the full library FREE for 7 days
Get unlimited access to 7000+ expert-authored eBooks and videos courses covering every tech area you can think of
Renews at €14.99/month. Cancel anytime}