Process Hollowing is the technique in which we can modify the process before it starts executing.
By starting the process in
Suspendedmode using the CreateProcess API.
CreateProcess API will do 3 things before starting the execution of the binary
- 1.It will allocate the virtual memory space for the new process
- 2.It will allocate the stack along with TEB (Thread Environment Block) and PEB (Process Environment Block)
- 3.It will loads the DLLs and the EXE to the memory.
- 1.zwqueryinformationprocess : It is a winapi call which can be used to retrieve information about the process.
NTSTATUS WINAPI ZwQueryInformationProcess(
_In_ HANDLE ProcessHandle,
_In_ PROCESSINFOCLASS ProcessInformationClass,
_Out_ PVOID ProcessInformation,
_In_ ULONG ProcessInformationLength,
_Out_opt_ PULONG ReturnLength
- ProcessHandle: Handle to the Process
- ProcessInformationClass: Type of information to be retrieved from the process
We need PEB address because we can then find the
base addressof the executable, then it can be parsed in order to find the
Entrypointof the EXE.
ProcessInformationClass --> ProcessBasicInformation --> PEB address --> 0x10 bytes into PEB --> Base Address of Executable Reached
- 1.Now, We have the PEB address but we can not read it, because it's on a remote process. So in order to read it we can use
This will be used to read the contents of the PEB at offset of
After reaching to the base address, we will read
ReadProcessMemory) from the base address.
By analysing these
0x200bytes, we will find the address of
0x3coffset from the base address of executable.
Base Address of Executable Reached --> ReadProcessMemory --> 0x200 bytes --> inspect the 0x200 memory space locally --> 0x3c from base address locally --> e_lfanew reached
- e_lfanew: 4 byte offset which tells us where the PE header is located (offset to PE Header)
- ADD the offset we got from
BaseAddress of executable
e_lfanew offset + base address of executable == PE Header memory address
Now we need to navigate to the
0x28from the PE header location
PE Header memory address --> 0x28 --> AddressofEntryPoint (we got offset as its RVA)
Here we will get the RVA for
Entrypointof the application, and RVA is just an
offsetso it needs to be Added with the base address of the remote proccess to find the absolute virtual memory address.
Base Address of Executable Reached --> ADD RVA in it --> Base address of the entrypoint of application is reached.
Steps before actual calculations
- 1.Start the process in
zwqueryinformationprocessto find the PEB Address
Now Actual Case Study
- we have the PEB Address:
Task: Find the memory address of the entrypoint of the application
- 1.We ADD
0x10in PEB Address == (
0x3004010) -> to find the Base Address of the executable, we read the value of the address above and it comes out as
- Base Address of the Executable ==
- 1.Read the
ReadProcessMemoryfor inspecting locally
- 2.Check the
Base Address of the Executable==
0x7ffff0100003cto find the e_lfanew header
- e_lfanew header at
0x7ffff0100003cwill give the offset to
PE Headerthe offset we got is
- 1.Add the total offset bytes to the
Base Address of the Executable->
- So PE Header is at
- 1.From PE Header, we need to read
0x28ahead in order to find the RVA for
Entrypointof the application
- PE Header memory address +
- RVA memory address found (
- So navigating to this address will lead us to the
Entrypoint of the application
- 1.Add the offset received from RVA to
Base Address of the Executable
PEB Address -> base address of executable (0x10) -> e_lfanew (base address of executable + 0x3c) -> PE Header (offset got from e_lfanew + base address of executable) -> RVA to Application entry point (PE Header + 0x28 bytes)
- 1.Now we just need to overwrite the memory space from this
Base Address of the Executablewith our shellcode to run it