Process Memory – File Mapping, PE Parser, tinyLinker, and Hollowing

In Chapter 1, From Source to Binaries – The Journey of a C Program, we learned how C/C++ can be packaged as an executable in the operating system. In this chapter, we will explain the file mapping process, build a compact compiler, attach malware to system services, and infect game programs.

In this chapter, we’re going to cover the following main topics:

• The memory of the static contents of PE files
• PE Parser example
• Dynamic file mapping
• PE infection (PE Patcher) example
• tinyLinker example
• Examples of process hollowing
• PE files to HTML

Sample programs

The sample programs mentioned in this chapter are available on GitHub, where you can download the exercises: https://github.com/PacktPublishing/Windows-APT-Warfare/tree/main/chapter%2302.

The memory of the static contents of PE files

In Chapter 1, From Source to Binaries – The Journey of a C Program, we mentioned the process by which the compiler produces a complete executable program. It is clear that the C/C++ source code, after being compiled, is mainly split into blocks and saved. These blocks must be placed on the correct address during dynamic execution. Then, we can start figuring out what the linker would produce as an executable file. Figure 2.1 shows a simplified PE static structure that you need to understand:

Figure 2.1 – Simplified PE static structure

The author has listed some of the key fields to which the application loader will refer. First, the entire memory arrangement starts with the DOS Header area (IMAGE_DOS_HEADER), where.e_magic must always be equal to the MZ string (that is, IMAGE_DOS_SIGNATURE), which is a valid DOS Header. Most of the fields in the DOS structure are no longer used in the current...

PE Parser example

This example is from the PE Parser project. It can be found in the Chapter#2 folder of this book’s GitHub project, which is publicly available. To save space, we only extracted the highlighted code; you should refer to the complete source code of the project for more details.

This is a simple tool written in C/C++ that can read any EXE content into memory with fopen and fread and save it in the ptrToBinary pointer, as shown in Figure 2.4:

Figure 2.4 – Example of PE Parser code

Let’s take a look at the preceding code in more detail:

• Lines 2-7: DOS Header must be present at the beginning of the program. We can get the NT Header offset from its e_lfanew field, and then add this offset to the base address of the entire binary. Therefore, we have successfully obtained the DOS and NT Headers.
• Line 4: We check whether the magic number of the DOS Header is MZ and the magic number of the NT Headers is PE\x00...

Dynamic file mapping

In this section, we will discuss how the PE static file is created as a new process and how the program file is mapped and mounted into its dynamic memory. Figure 2.6 shows a simplified process for mapping a static PE program into memory:

Figure 2.6 – File mapping process

The left-hand side of Figure 2.6 shows a container for memory contents, while the right-hand side shows a static PE file that has not been executed yet and is located in a disk. The following is a systematic explanation of the process by which the operating system mounts its static files into dynamic ones:

1. First, the system checks the ImageBase address of the Optional Header entry in NT Headers (currently 0x400000), which is the address expected to be sprayed in the dynamic during compiling a program. Note that if ASLR protection and the relocation function are enabled at the same time, it may be a random ImageBase.
2. Next, the system checks SizeOfImage...

PE infection (PE Patcher) example

This example looks at the PE_Patcher project. It can be found under the Chapter#2 folder of this book’s GitHub project, which is publicly available. To save space, we only extracted the highlighted code; please refer to the full project to view the full source code.

Given any executable (for example, a game installer) and specific malicious code (shellcode), we can use what we have learned so far to infect the game’s installer so that the gamer thinks they are running the game installer but executes our backdoor instead.

In this section, we will learn how to infect a normal program with shellcode in the form of a worm. The core idea is to put a malicious section in the normal program to hold the malicious code and point the program entry to the malicious code so that the infected program will trigger our malicious code directly after execution.

Figure 2.7 shows common shellcode on the internet, whose function is to pop up a...

tinyLinker example

This example is from the tinyLinker project. It can be found under the Chapter#2 folder of this book’s GitHub project, which is publicly available. To save space, we only extracted the highlighted code; the complete source code should be referred to if you wish to look at the full project for detailed reading.

Now that you have learned how to generate a linker for an executable, next, you need to learn how to generate a PE program linker from scratch. We’ll take a hands-on approach to this in this section:

Figure 2.12 – The main function of tinyLinker

We assume that a simple executable should have at least three structure headers – that is, a DOS Header, NT Headers, and Section Headers, respectively. (Note that the File Header and Optional Header are part of the NT Headers). The contents of this section are appended to the ends of these headers.

In lines 26-31 of the code, the size of the entire program...

Examples of process hollowing

This example is from the RunPE project. It can be found under the Chapter#2 folder of this book’s GitHub project, which is publicly available. To save space, we only extracted the highlighted code; please refer to the complete source code to see all the details of the project.

This section illustrates how file mapping techniques can be maliciously exploited by hackers on the front line. This technique has been used by Ocean Lotus, a Vietnamese national cyber-army organization. This example has been adapted from the open source project RunPE (github.com/Zer0Mem0ry/RunPE) for demonstration purposes.

After understanding the whole process from static mapping to file mapping, you may have thought of the following question: if we run a program signed with digital signatures from known and valid companies (for example, a Microsoft update package, an installer in a large company, and so on), and replace the mounted PE module in the process with a...

PE files to HTML

So far, you should understand that the PE file is simply a package specification that indicates system and application loaders to spray the contents of each expected section during compilation.

However, tinyLinker is a linker that we implemented manually. Those of you who are experienced in this area will know that we don’t need to use all the fields in the PE structure to generate an executable file. This means that an actual executable only takes a few fields in the PE structure to create an executable EXE file, and the system is fully capable of correctly spraying the content of individual sections into the correct dynamic space.

Researcher Osanda Malith (https://osandamalith.com/2020/07/19/hacking-the-world-with-html/) considered a question: since PE files can be only loaded and executed correctly with a few fields, what about the remaining unused space in the PE structure? In Figure 2.22, we can see that the important and indestructible fields in...

Summary

In this chapter, we learned about the simplified PE static structure, including DOS Headers, NT Headers, and Section Headers, and replaced these headers with practical programs to execute malicious programs. This is the first step toward generating malware on your own. In the next chapter, dynamic API calls will be explained in more detail so that you understand how to perform parameter modification and forge dynamic modules.