Maldev

Resources

• Techniques
  • Heavens gate : https://black-hat-zig.cx330.tw/Advanced-Malware-Techniques/Process-Injection/Heavens-Gate/heavens_gate/#wow64-architecture || https://sachiel-archangel.medium.com/analysis-of-heavens-gate-part-1-62cca0ace6f0 || https://www.bleepingcomputer.com/news/security/malware-loader-goes-through-heavens-gate-to-avoid-detection/ || http://www.rohitab.com/discuss/topic/43044-heavens-gate-with-bypass-load-64-bit-modules-into-32-bit-process/
  • XOR : https://medium.com/@lsecqt/encrypting-shellcode-with-xor-offensive-coding-in-c-5a42cb978d6e
  • Undocumented Windows Functions : https://www.vergiliusproject.com/
• ShellCoding : https://medium.com/@boxalarm/maldev-101-writing-your-first-shellcode-runner-in-c-3bc861169796
  • Questions :
    • What is DLLs : https://stackoverflow.com/questions/124549/what-exactly-are-dll-files-and-how-do-they-work
    • NTAPI : https://stackoverflow.com/questions/12205803/what-does-void-ntapi-mean-and-where-can-i-find-references-for-it
• Process Injection
  • By vvinoth : https://vvinoth.com/post/threadpools/

Tools

• PE-Bear : https://github.com/hasherezade/pe-bear
• ProcessHacker2 : https://processhacker.sourceforge.io/downloads.php
• x64dbg : https://x64dbg.com/
• TotalPE2 : https://github.com/zodiacon/TotalPE2

Notes

Malware Dev Tip: The Power of .data?

Why does .data? (uninitialized data) exist separately from .data? File size.

If you create a 50 Megabyte empty array in .data using zeros, your compiled .exe on disk will be 50 Megabytes large, which looks highly suspicious.

If you reserve that same 50 Megabytes in .data?, the compiler just writes a tiny note in the PE header that says: “Hey Windows, when you load this into RAM, please carve out 50MB of empty space.” Your .exe file size on disk remains perfectly small, but it inflates in memory at runtime!

Advanced Windows Memory Allocation APIs

Allocation Function	Free Function	Layer	Use Case / Context
CoTaskMemAlloc()	CoTaskMemFree()	COM	Used in COM programming (e.g., Windows Shell, clipboard). Sometimes utilized to interact with COM interfaces under legitimate system processes.
LocalAlloc()	LocalFree()	Legacy Win32	Legacy 16-bit era API (similar to GlobalAlloc). Still functional and occasionally mandatory for older Windows subsystems.
VirtualAllocEx()	VirtualFreeEx()	Virtual Memory	Allocates memory pages directly inside the virtual address space of a different process. Foundational API for inter-process memory management and remote injection.
VirtualAlloc2()	VirtualFree()	Virtual Memory	Modern (Win10+) extension of VirtualAlloc. Allows extended parameters like specifying NUMA nodes or setting advanced memory attributes.
HeapCreate() / HeapAlloc()	HeapFree() / HeapDestroy()	Windows API	Manages private, isolated heaps separate from the default process heap. Useful for segregating sensitive buffers and wiping them in one call via HeapDestroy.
RtlAllocateHeap()	RtlFreeHeap()	NTDLL (Native)	Undocumented, low-level native API that HeapAlloc secretly calls internally. Used in low-level systems programming to bypass user-mode API wrappers.
_aligned_malloc()	_aligned_free()	C Runtime (CRT)	Allocates memory starting on strict byte boundaries. Essential to prevent faults when using SIMD / vector instructions (SSE/AVX).
calloc() / realloc()	free()	C Runtime (CRT)	calloc zeroes out the allocated memory block. realloc resizes an existing buffer, dynamically copying data to a new address if it cannot expand in place.

Nodes

• Programming