What is System Service Descriptor SSDT Table? | RE | Malware Analysis | Interview Questions & Concepts
2021-5-29 07:15:0 Author: www.debasish.in(查看原文) 阅读量:3 收藏

After writing shell code generally we use a C code like this to test our shell code. char code[] = "shell code"; int main(int argc, char **argv) { int (*func)(); func = (int (*)()) code; (int)(*func)(); } In this article I am going to show you, how can we use python and its "ctypes" library to execute a "calc.exe" shell code or any other shell code.ctypes is a foreign function library for Python. It provides C compatible data types, and allows calling functions in DLLs or shared libraries. It can be used to wrap these libraries in pure Python. I will be using six Win32 APIs to execute the shell code. These Win32 apis are very important in dynamic memory management on windows platform. Here ctype will help us to directly interact with these required APIs. The concept is like : 1)   First VirtualAlloc() will allow us to create a new executable memory region and copy our shellcode to it, and after that execute it. 2)   VirtualLock()


文章来源: http://www.debasish.in/2021/05/what-is-system-service-descriptor-ssdt.html
如有侵权请联系:admin#unsafe.sh