So in this video, we'll be taking a look at the process hollowing technique, which is also called
injection technique.
In this way, we creating a process in a suspended state.
When the process is suspended, we will replace the legitimate process code with our malicious code.
And then we set the threat to resume the normal execution.
So first we were using the create function to create the process and we need to get the image base of
this process.
So we'll be using antiquated information process to get the PDB address.
And in that process environment, we will at offset of one zero at 16 bytes, we have the image based
address for 64 bit executable.
And then we will remove that this illegitimate process occurred and we will inject our initial, uh,
ex into that process and by getting the trade context.
So this threat context is like a safe state or snapshot of the registers of the, uh, executing thread.
That is the main thread since you are uh, creating the process suspended, suspending the thread,
all of the thread data registers will be saved and we will set the RC register, uh, to point to that
reserve entry point.
So I thought it's a rip instruction point, but it's not, it's uh, RC for that little bit, uh, you
need to set the register to the entry address of entry point.
So let's create the new func, uh, new process.
I have already defined out of this copy from the work.
So let's go and create a process w.
And the first one is the string.
So let's create notepad de thc.
And the second parameter is command line arguments.
So that is that can be null.
And the process attributes.
So we can pass that now.
And the thread that attributes this can also be null.
And inherit handles false.
And
we will be creating this startup info.
So this startup info contains the some properties of the process during the startup like its rectangle
size, etc..
So here you can see this CD defines the size of the structure.
We can say startup info.
Yes.
Equal to new startup info.
You don't need to initialize any of these.
So where we are here.
So we have completed five parameters.
Creation flex.
Let's add this to zero.
And environment.
And the current directory and the reference to startup info and the last one is up to the process information.
So this out is like we don't need to initialize this process information object, we can send that one.
So process information by is cause to new process information.
So you get some process information and it contains the handle to the process and the thread.
So hand over to the process and hand it to the main thread and also we will get the process ID and thread
ID.
So out by.
So at this point, we are creating the process.
And this creation for X is for for the creator spender.
So here we can see zero four for the cricket suspended.
So.
So we can see food and it will be in a suspended mode.
Let's try to run this.
And I have created a function that process image based.
So let's run this and we should see the new process.
So let's close this one.
So let's change this to 0x4.
Now, the process will be in a suspended state.
Let's also run the process as administrator.
Now let's put a breakpoint here.
And if you run this and we should see the notepad.
Notepad that you see in a suspended state.
And we get inside and.
Are.
Just one handle.
It's.
So let's stop this and let's kill this press.
So here you can see at the bottom it.
Now we have created the process in a suspended state.
Now what we want to do is we are going to get the image of this suspended process.
So we can do that using antiquated information process, function.
So the first two parameters, the process handle.
So when we send in the progress end to this function parameter.
That is prog.
And the next one is process information.
So there are different process information classes.
And depending on what number you pass here, it will be we will be getting that type of information.
So the various process information classes are defined by this.
So we'll be using the process basic information.
And depending upon this, you get the structure to this parameter.
So these are pointers.
So
we need to create.
Process.
Basic information PBIS course to new process.
Basic information.
A.P.B.
Well, there is a third one.
So second one is integer and third one is.
Third one is the, uh, old one.
Okay, so next we need to pass the process information then so we can do U.S. Marshal the size of.
They both process basic information.
And the reference the last one is, uh, parameter.
So.
Urine length is equal to zero.
And reference length.
So think this is the point.
So what we are going to do is we can send Peter ten bicycles to we are going to allocate some size.
Martial arts is of type of process, basic information.
So this pointer can hold those many number of uh or decimal number of baits so we can measure that into
the process.
Basic information.
So we can see them.
Now you have the temple pointer.
We can marshal that one as.
Pointer to structure.
We have the temple pointer pointing to the process, basic information structure.
And we can say Piva is equal to this one.
Now we can go and print that address.
So I have already copied this structure from print.
Well, it's basically you can, uh, accept these two members.
Every thing are the pointers, so you get the proper dress.
We are going to print that one.
So let's put breakpoint at this point and let's go and.
Well, call this one.
I have already caught this one.
Get processed, image based prog handle so we can just.
Oh.
Let's run this.
And we should see the output address.
That is the Web address and we can verify that using this.
Doesn't go to notepad and memory.
And here we should see the.
Bob here you can see the pep.
And if you explain this.
If you open this one.
Uh, this after 16 bites, you have this.
So this you can see the pepper dress is starting pepper dressing 65851210.
So the same pepper dress from here onwards, if you are 16 BATES And this eight BATES is the.
You made this, you can confirm that using this one.
So here you can see seven F, we have six, seven, seven, e, seven.
So if you go to here.
Write, copy, execute and.
Here.
We should have the best address.
So let me quickly search this.
7ff6.
So here you go.
So this one is the environment.
So I got confused about this.
So this is the place address.
So after 16 bytes from the IP address.
So now you can stop this and also terminate this phone.
And what we can do is we can say.
A real process memory.
Blog handle and the best addresses BBA Dot Pepper Dress Press 0x10 and the bed buffer.
So let's create it.
Let's say, bite this new bite of it.
Uh, the size is weight base, not length and the number of bytes read so we can say.
Ah.
This one is in the pointers.
Also not sure.
So let's just say in point by it's written.
Out into Pinter so out by it's written.
So we have successfully.
Read the memory from this address to the 16 bytes.
Now we need to convert these bacteria into the integers so we can use it.
Convert that to into 64.
Baby's starting index is zero.
So this will give you the.
Uh, wrong value so I'm going to convert this image pointer is equals to in the pointer.
So we had our image printer ready that is pointing to the, uh, this process image this.
So I think we are good to go.
Well, now we can put the breakpoint at this one before this process is 64 function.
So this is very similar to the remote IP injection we have seen in the previous videos.
So let's run this and we should see this one as the base address so that we can see this is the same
address as that the previous notepad dot xy.
So that means our model is loading at the same base address because that's empty, I guess.
Click on Notepad and if you go to the pub we have the commit and here you can see the same address.
And if you go to this one, this is the starting image.
This.
So let's go and stop this and also terminate this one.
Now we have everything ready.
Uh, I also forgot to show you.
Uh, let me quickly start this.
Not bad.
And if you go to this one, if you double click on this and here you should see the P file of the notepad,
that dot xy.
You know what they're going to do.
It's similar to what we have done in the remote injection.
So we got the we have the handle to the process and the remote base and the raft.
Is this the file you want to inject?
So it's similar to uh, uh, that size reference getting size and then uh, allocating some size in
our long process to pass the pre locally.
And then we'll be using another function and PE and map U.S. to map this, uh, memory so that we can
write and change the production to the read execute.
So after n mapping, we're allocating the size and we are changing the read, write, execute.
And uh, it's similar to parsing headers and writing into the that process using writer's memory.
So from here onwards it's similar to remote IP injection and then fixing ides and basically locations.
And after fixing everything we need to get the thread the context, using that thread context.
So this will give you the context structure so that we need to.
Do the RC x value to the remote base address press entry point, and we'll be setting that value using
separate context.
So it's a small call.
So that's why, uh, I did not, uh, I'm not writing again, so get red context.
It takes the thread handle and this contextual structure.
So context, structure, it contains all these flags.
Why not search for that threat context?
So we can see we have all these flags.
So make sure you have this third context.
64 one.
And then we will set the trade context using this function to handle and reference the context structure.
So after that we can print the R value and setting this to the remote base address plus and three point.
So let's go and run this one.
So we have set the breakpoint at this process of a function.
And let's start this.
So the same image based.
Now we can see the old, uh, not bad.
Dirty, sexy.
Now, let's go and click on this next.
So.
Process, how the function gets executed.
So.
So let's also put the breakpoint.
Right here.
After that, we use the resume thread to resume the thread, so click on Continue.
So we write our malicious B into the process memory.
Now we need to close this one and again, refresh this.
And here we can see a single private region with the our C latest pillar where you can see this is a
different pillar that is, um, specifying the normal, uh, cm data to see that is, that does not
have any dependencies.
So it should pop up the CM data to see if everything goes, uh, nice.
So it's click on continue and here you can see the cmd, right?
See, so we have successfully hollowed out the notepad dot xy and replace that memory with our malicious
P file.
And we have resumed the threat to resume the execution of the process.
It still says not to exit but executes our cmd c.
So that's how far this process are going.
It's very similar to the remote injection.
We are seeing the previous videos.
If you did not watch the videos, I highly suggest to watch those videos because they are passing file
and fixing ideas and basic locations are the main important thing in this, uh, injection technique
or in any injection technique.