When we run a packed malware it will unpack the code in dynamically allocated heap memory and heap can be kept non executable and I find no purpose to make heap executable. So, how the malware eventually runs the packed binary?

  • 1
    Are you asking how to set execute permissions on a memory region? – 5gon12eder Jan 13 '17 at 19:48
  • No, but how the malware is able to execute the unpacked binary from memory? – Ajay Choudhary Jan 17 '17 at 15:23
  • Well, it makes that memory region executable beforehand. Either by performing the relevant syscalls directly or – if it has only insufficient permissions – by tricking some other code into doing it on its behalf. Only in rare cases I expect bugs in the operating system to be exploited to execute code out of memory regions without execute permissions set. – 5gon12eder Jan 17 '17 at 17:01

Packed malware has a an unpacking stub that will decrypt the obfuscated code and save it to another region. Then it will change that region to executable permissions and then adjust the instruction pointer or jump to the start of the newly written executable code region.

So in order to execute the malware it's basically the equivalent of a jump in assembly to a new like of code or a go to statement to another line or a function call in a higher level language to another area of code.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.