Application Loader Design
In this chapter, we will learn how a simple application loader can execute EXE files in memory without creating a child process. We will learn how to import an address table in a PE structure and write C programs to analyze them. We will then learn how to hijack Windows API calls, replace API behaviors with malicious code, and do DLL side-loading using examples.
In this chapter, we’re going to cover the following main topics:
- Import Address Table in PE
- Import API analyzer example
- Examples of IAT hijack
- DLL side-loading example
