[TOC]
# Malware Development - Windows
## Process
![圖片](https://hackmd.io/_uploads/H1wuTAY5p.png)
Processes don't know each other. Each process has its own virtual address.
Chrome.exe consists of multiple processes working together.
### VA (Virtual Address) spaces
![image](https://hackmd.io/_uploads/r1wN0CXvC.png)
### Memory Map
![圖片](https://hackmd.io/_uploads/H1M1C0tc6.png)
### Process Type
#### 1.Application Process
Processes spawned in the task manager that can be terminated by the user.
#### 2.Background Process
Processes running in the background; they don't require user interaction and start automatically.
e.g.
Update Software
Monitor - AV (Anti-Virus)
Index files
#### 3.Windows Process (Systems Process)
Windows processes perform critical tasks during the system's startup.
Examples:
Memory Management
Security
Drivers
### Process Priority
![image](https://hackmd.io/_uploads/H1YnCC7DA.png)
CPU time is just a measure of the amount of time the CPU spends processing instructions for a specific task or process.
Six Priority Ratings:
Real-Time (Notice)
High
Normal (Default) (Notice)
Below Low
Low (Notice)
input, keyboard, disk cache. (Have High Priority!)
IF we set the priority class of a CPU-intensive program(Minecraft.exe XD) to real-time, It will stuck up our computer.
![圖片](https://hackmd.io/_uploads/Hk1xPkqcT.png)
### Threads
Each process starts with a single thread, often called the primary or main thread.
![圖片](https://hackmd.io/_uploads/H1vpVecqa.png)
Processes and threads are both units of execution.
Process is independent of each other
Threads are interdependent and share memory with the process, just like the process has an ID and handle.
## Handler
Handler is a generic unit of identification
Handle is 32-bit or 64 bit integer, It like a resource identifier
Handle is a pointer (var)
We can passing the handle's name to another process to invoke the resource
![圖片](https://hackmd.io/_uploads/BkSXcxqqp.png)
It allows our program or code to interact with it without Access the it to Memory(DMA)
>DMA is a technique allow the I/O device director access the main memory without CPU engagement to speed up the memory operation
We won't use these handlers ourselves; instead we're going to pass them through to some function then will use them in order to accomplish the goal
![image](https://hackmd.io/_uploads/B12sBkEvR.png)
### type of handle
win32 API
#### Handle to Process (and Threads etc..)
The notation of Handle
Handle to Thread -> hThread
Handle to Process-> hProcess
```
HANDLE hThread, hProcess;
```
#### Handle to Module
Handle to Module -> hModule
```
HANDLE hMoudle;
```
#### Handle to Windows
```
HWND myWindows;
```
Supose the function call GetProcessInfo();
we need to pass 'handle to the process' to getProcessInfo() function
Handles are system-wide.
If we have Process A and Process B:
If Process A finds out its process handle, it can send the handle value to Process B.
![image](https://hackmd.io/_uploads/S1kBY1VDC.png)
### Inherit the handle
inherit the handle is mean when the process spawns the new process, the new process will inherit the handle's value
if inherit the handle is enable,
Parent and child process are the same handle's value.
# [Win32API](/4ZXPUaeVQrSLIfHY0PQ7zg)
# [Process Injection](/BcZuF3kgSp-V579c5t2NeA)
# [DLL Injection](/BAP2C10TRuqike0p0GfjhA)
# [Native API](/is95OecaQ06475OlHFwaGQ)
# Systems Call
![圖片](https://hackmd.io/_uploads/HyV9boHFA.png)
Owner:侯智晟
Gmail:meowheckerouo@gmail.com
# Reference:
https://www.youtube.com/watch?v=aNEqC-U5tHM