1

I'm studying the source code of malware developed in c++ and I have two questions in the source code below

This is probably code that loads malicious dlls into memory.

typedef BOOL (WINAPI *VirtualFreeT)(
    __in LPVOID lpAddress, 
    __in SIZE_T dwSize, 
    __in DWORD dwFreeType
    );

char dllA[] = {'K','E','R','N','E','L','3','2','.','d','l','l','\0'};
char dllB[] = {'V','i','r','t','u','a','l','F','r','e','e','\0'};

VirtualFreeT pVirtualFree=(VirtualFreeT)GetProcAddress(LoadLibrary(dllA),dllB);

_asm nop;
_asm nop;
_asm nop;
_asm nop;
_asm nop;
_asm nop;
_asm nop;
...
..
.
  1. Why not declare the name of dll as below?
    Is it just a certain insertion of a null char?
char dllA[] = "KERNEL32.dll";
char dllB[] = "VirtualFree";
  1. It doesn't do anything. Why need this code?
_asm nop
3
  • 3
    Is this the original source code, or is this decompiled from a binary?
    – Sjoerd
    Dec 30, 2020 at 10:30
  • @Sjoerd this is original source code
    – useeffect
    Dec 30, 2020 at 15:15
  • maybe there is no reason, in which case, this may not be worth studying, except to see what kind of cargo cult script kiddies are currently using
    – user253751
    Dec 30, 2020 at 16:22

1 Answer 1

2
  1. Why not declare the name of dll as below? Is it just a certain insertion of a null char?

No, these two lines of code create identical null-terminated strings in the resultant binary:

char dllA[] = {'K','E','R','N','E','L','3','2','.','d','l','l','\0'};

and

char dllA[] = "KERNEL32.dll";

Perhaps the malware author believed there was a difference, but more likely, it's a style choice only.

  1. It doesn't do anything. Why need this code?

It's almost certainly a NOP Sled. When placing a buffer overflow, it may be difficult to calculate exactly where the instruction pointer will land. By preceding the meat of the overflow code with a series of No-Op instructions (which do nothing) that instruction pointer can slide smoothly along until it reaches the exploit code, as long as it lands anywhere in the NOP Sled.

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.