Introduction |
|
xxiii | |
|
|
1 | (38) |
|
Register Set and Data Types |
|
|
2 | (1) |
|
|
3 | (8) |
|
|
4 | (1) |
|
|
5 | (6) |
|
|
11 | (6) |
|
|
11 | (2) |
|
Stack Operations and Function Invocation |
|
|
13 | (4) |
|
|
17 | (8) |
|
|
17 | (8) |
|
|
25 | (3) |
|
|
26 | (1) |
|
Interrupts and Exceptions |
|
|
27 | (1) |
|
|
28 | (7) |
|
|
35 | (1) |
|
|
36 | (2) |
|
Register Set and Data Types |
|
|
36 | (1) |
|
|
36 | (1) |
|
|
37 | (1) |
|
|
37 | (1) |
|
|
38 | (1) |
|
|
39 | (48) |
|
|
40 | (3) |
|
|
43 | (2) |
|
System-Level Controls and Settings |
|
|
45 | (1) |
|
Introduction to the Instruction Set |
|
|
46 | (1) |
|
|
47 | (10) |
|
|
47 | (4) |
|
|
51 | (1) |
|
|
52 | (4) |
|
|
56 | (1) |
|
Functions and Function Invocation |
|
|
57 | (3) |
|
|
60 | (1) |
|
Branching and Conditional Execution |
|
|
61 | (6) |
|
|
64 | (1) |
|
|
65 | (2) |
|
|
67 | (4) |
|
Just-in-Time and Self-Modifying Code |
|
|
67 | (1) |
|
Synchronization Primitives |
|
|
67 | (1) |
|
System Services and Mechanisms |
|
|
68 | (2) |
|
|
70 | (1) |
|
|
71 | (6) |
|
|
77 | (1) |
|
|
78 | (9) |
|
Chapter 3 The Windows Kernel |
|
|
87 | (100) |
|
|
88 | (23) |
|
|
88 | (1) |
|
|
89 | (3) |
|
|
92 | (12) |
|
|
104 | (2) |
|
|
106 | (1) |
|
|
106 | (1) |
|
|
107 | (2) |
|
|
109 | (1) |
|
Kernel Synchronization Primitives |
|
|
110 | (1) |
|
|
111 | (17) |
|
|
112 | (7) |
|
|
119 | (4) |
|
|
123 | (5) |
|
Asynchronous and Ad-Hoc Execution |
|
|
128 | (16) |
|
|
128 | (1) |
|
|
129 | (2) |
|
Asynchronous Procedure Calls |
|
|
131 | (4) |
|
|
135 | (5) |
|
|
140 | (2) |
|
Process and Thread Callbacks |
|
|
142 | (1) |
|
|
143 | (1) |
|
|
144 | (2) |
|
|
146 | (9) |
|
|
147 | (2) |
|
Driver and Device Objects |
|
|
149 | (1) |
|
|
150 | (1) |
|
A Common Mechanism for User-Kernel Communication |
|
|
150 | (3) |
|
Miscellaneous System Mechanisms |
|
|
153 | (2) |
|
|
155 | (23) |
|
|
156 | (16) |
|
|
172 | (6) |
|
|
178 | (2) |
|
|
180 | (7) |
|
Building Confidence and Solidifying Your Knowledge |
|
|
180 | (2) |
|
Investigating and Extending Your Knowledge |
|
|
182 | (2) |
|
Analysis of Real-Life Drivers |
|
|
184 | (3) |
|
Chapter 4 Debugging and Automation |
|
|
187 | (80) |
|
The Debugging Tools and Basic Commands |
|
|
188 | (28) |
|
|
189 | (1) |
|
|
189 | (1) |
|
|
190 | (4) |
|
Process Control and Debut Events |
|
|
194 | (4) |
|
Registers, Memory, and Symbols |
|
|
198 | (10) |
|
|
208 | (3) |
|
Inspecting Processes and Modules |
|
|
211 | (3) |
|
|
214 | (2) |
|
Scripting with the Debugging Tools |
|
|
216 | (41) |
|
|
216 | (3) |
|
|
219 | (7) |
|
|
226 | (14) |
|
|
240 | (4) |
|
Using Scripts Like Functions |
|
|
244 | (5) |
|
|
249 | (8) |
|
|
257 | (7) |
|
|
258 | (4) |
|
Writing Debugging Tools Extensions |
|
|
262 | (2) |
|
Useful Extensions, Tools, and Resources |
|
|
264 | (3) |
|
|
267 | (74) |
|
A Survey of Obfuscation Techniques |
|
|
269 | (20) |
|
The Nature of Obfuscation: A Motivating Example |
|
|
269 | (4) |
|
|
273 | (5) |
|
Control-Based Obfuscation |
|
|
278 | (6) |
|
Simultaneous Control-Flow and Data-Flow Obfuscation |
|
|
284 | (4) |
|
Achieving Security by Obscurity |
|
|
288 | (1) |
|
A Survey of Deobfuscation Techniques |
|
|
289 | (39) |
|
The Nature of Deobfuscation: Transformation Inversion |
|
|
289 | (6) |
|
|
295 | (17) |
|
|
312 | (16) |
|
|
328 | (8) |
|
|
328 | (2) |
|
Analyzing Handlers Semantics |
|
|
330 | (3) |
|
|
333 | (1) |
|
|
334 | (2) |
|
|
336 | (1) |
|
|
336 | (5) |
Appendix Sample Names and Corresponding SHA1 Hashes |
|
341 | (2) |
Index |
|
343 | |