Breaking Ransomware: Explore ways to find and exploit flaws in a ransomware attack by Jitender Narula & Atul Narula

Breaking Ransomware: Explore ways to find and exploit flaws in a ransomware attack by Jitender Narula & Atul Narula

Author:Jitender Narula & Atul Narula [Narula, Jitender & Narula, Atul]
Language: eng
Format: epub
ISBN: 9789355513625
Publisher: BPB Publications
Published: 2023-06-15T00:00:00+00:00


Figure 8.23: ImportSampleDLL code

The resulting executable (ImportSampleDLL.exe) will list our SampleDLL.dll in Import Directory.

Import Directory is an array of the IMAGE_IMPORT_DESCRIPTOR structure. Each structure is 20 bytes in size and contains information about a DLL imported in our application. For every DLL imported, we will have the IMAGE_IMPORT_DESCRIPTOR structure. Our application is importing functions from four different DLLs, so we have four IMAGE_IMPORT_DESCRIPTOR structures in array. There is no field that indicates the length of an array or the number of IMAGE_IMPORT_DESCRIPTOR structures in an array. Instead, the final IMAGE_IMPORT_DESCRIPTOR structure in an array is filled with zeros.

The structure of the IMAGE_IMPORT_DESCRIPTOR structure is defined in WinNT.h is shown in Figure 8.24:



Download



Copyright Disclaimer:
This site does not store any files on its server. We only index and link to content provided by other sites. Please contact the content providers to delete copyright contents if any and email us, we'll remove relevant links or contents immediately.