Reader small image

You're reading from  Windows APT Warfare

Product typeBook
Published inMar 2023
Reading LevelIntermediate
PublisherPackt
ISBN-139781804618110
Edition1st Edition
Languages
Tools
Right arrow
Author (1)
Sheng-Hao Ma
Sheng-Hao Ma
author image
Sheng-Hao Ma

Sheng-Hao Ma is currently working as a threat researcher at TXOne Networks, specializing in Windows reverse engineering analysis for over 10 years. In addition, he is currently a member of CHROOT, an information security community in Taiwan. He has served as a speaker and instructor for various international conferences and organizations such as Black Hat USA, DEFCON, CODE BLUE, HITB, VXCON, HITCON, ROOTCON, Ministry of National Defense, and Ministry of Education.
Read more about Sheng-Hao Ma

Right arrow

Examples of software packers

We use the well-known open source compiler Yasm to compile our written stub.asm source into COFF format, sub.bin, which contains the stub mechanical code, as shown in Figure 8.18:

Figure 8.18 – Using Yasm to compile stub.asm

Figure 8.18 – Using Yasm to compile stub.asm

Then we can compile our C/C++ packer into a utility program using MinGW, as shown in Figure 8.19:

Figure 8.19 – Compiling our packer

Figure 8.19 – Compiling our packer

Using our compiled packer to pack for an old game, NS-Shaft, our compiled packer will compress the contents of the program and inject stub.bin as the initialization engine to output the packed program, down_protected.exe. Then we double-click to open down_protected.exe.

As shown in Figure 8.20, the game program still runs normally but the static size is successfully compressed from 565 KB to 280 KB, which confirms the feasibility of our compressed packer design:

Figure 8.20 – The result of the packed program

Figure 8.20 – The result of the...

lock icon
The rest of the page is locked
Previous PageNext Page
You have been reading a chapter from
Windows APT Warfare
Published in: Mar 2023Publisher: PacktISBN-13: 9781804618110

Author (1)

author image
Sheng-Hao Ma

Sheng-Hao Ma is currently working as a threat researcher at TXOne Networks, specializing in Windows reverse engineering analysis for over 10 years. In addition, he is currently a member of CHROOT, an information security community in Taiwan. He has served as a speaker and instructor for various international conferences and organizations such as Black Hat USA, DEFCON, CODE BLUE, HITB, VXCON, HITCON, ROOTCON, Ministry of National Defense, and Ministry of Education.
Read more about Sheng-Hao Ma