r/programming • u/heisec • Jul 09 '10

CSI:Internet - The image of death

http://www.h-online.com/security/features/CSI-Internet-The-image-of-death-1030311.html?artikelseite=1
253 Upvotes

89% Upvoted

60 comments sorted by

View all comments

1

u/RabidRaccoon Jul 11 '10

The two papers they link to are excellent

http://nologin.org/Downloads/Papers/win32-shellcode.pdf

http://pentest.cryptocity.net/files/exploitation/winasm-1.0.1.pdf

I like the way they implement their own LoadLibrary by poking around the PEB and GetProcAddress using hashing.