1. When it's time to write the malicious image inside the hollowed process, apparently the goal is to allocate memory exactly at the image base address of the hollowed process. Why? Why not allocate memory according to the malicious image base address, that way the code already has the correct addresses.

    Example: Notepad.exe -> image base address: 0x00260000 , mal.exe -> iba: 0x00400000. Now, instead allocation space for mal.exe in address 0x00260000(Notepad.exe's memory space) and have all of the instructions and data inside of mal.exe changed from 0x00400000 base to 0x00260000 base, you can just allocate space in 0x00400000 to begin with.

  2. Creating a process from executable demands two things: relocation (if ASLR forces different base address) and Import address table fixing. The IAT of an exectuable image is not filled with correct addresses of the dlls it uses. Only when the loader will load the dlls in the process memory space, it will rewrite the addresses in the process IAT. My question is why nobody issues IAT. They all just copy idata section like nothing needs to be done.

  3. In order to "hollow" there's a use of UnmapViewOfSection. What does UnmapViewOfSection really do? What is considered a section or a view? Is it .text, .data kind of section? If it does why does it even exist?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.