The usual me

DLL Injection: How viruses hide themselves?

2011-08-26T23:21:00.000-07:00

For a good virus, out of many things, one of the major requirement is to go unnoticed and undetectable. This is achieved by injecting malicious code in the address space of an existing trustworthy process(commonly known as injecting code or DLL). Now, there are two ways to run your code inside a process.

1. Allocate memory in the victim process and write your code in that space and spawn a new thread from that address.

2. Or the better one(and more preferred one too), load a malicious DLL forcibly in the victim process.

I'll discuss more on way 2. The code will be divided into two modules:
1. Malicious DLL : This is the binary containing all code to do specific tasks. Viruses put all code related to replication, hooking, logging etc in this DLL.
2. Injector process: This is the short lived process. The task of this process is just to inject the dll
into the victim process(say explorer.exe) and then it dies out.

In this blog entry, I'll discuss more on Injector process working:

1. Get handle of the victim process: In windows, there are multiple ways to do so. You can either get the handle by using process name or its PID or even process window's title(in case it is a UI process). There are multiple APIs to do so like OpenProcess()

2. Once you get the handle, you need to start a new thread in the victim process and ask this thread to load your DLL. To do this, you need to set starting address of the newly created thread to LoadLibrary and corresponding argument set to the address of wchar string containing name of the DLL. So, before you do this, you need to allocate some memory in victim process and write DLL in it. Once you have written the name and have called Loadlibrary with right argument, you are good to go. OS will do rest of the things for you :)
It will automatically call the DllMain in your DLL and your work is done. You can execute any damn code via that DLL in the address space of the trustworthy process and there is no easy way to detect it.

In the next post, I'll tell you the ways by which you can detect whether any process on your machine has been injected with any DLL.

Disclaimer: The intention of this process(and the other posts following this one) is not to encourage DLL injection but to increase awareness about it so that one can safeguard oneself against these things. I'll restrain myself from posting any directly working codes..

Back...

2011-08-25T08:07:00.000-07:00

This was supposedly a blog to pamper my technical side. But, damn this work life(yeah, I'm good at making excuses :P), I never ever put a single post here in 2 years.. Lazy me seriously... but not anymore..

First post coming soon on Dll injections..

Test vs Development

2008-09-20T07:00:00.000-07:00

With placement session going smoothly(with few bumps, here and there, of course :)) in my college, I found this doubt prevailing in minds of many of my friends that whether to prefer Test or Development jobs? Which is better? Is switching possible later? What are scopes in both profiles further in life? I'll try to discuss few of these issues here based on what I observed in past few months.

Which is better: A Test job or a Development job?

Most of the people think that Test Profile Job is some second tier job given to those people who couldn't manage a development job which is not correct at all. Recruiting company never thinks like that. Most of the companies coming at campus never have this notion of superiority of one profile over the other. They do classification of candidates between both profiles based on the requirements suited for that particular profile eg Yahoo had two sections in its written paper. They had designed these papers in such a way that a person doing well in one particular section was shortlisted for Test profile and another person doing excellent in other section was shortlisted for Development profile. So clearly, it's not like two cutoffs for two different profiles with lower ones for Test profile as most of the people think.

Most of the biggies in software offer (almost) same compensation to both profiles with equal chances of growth. There may be some exceptions here but where arent they?

Which one to prefer: A Test job or a Development job?

The only thing to remember here is that "One should prefer the BEST FITTED job rather than the BEST job." After all, the term "BEST" in itself is relative and depends on one's view point:) There's no point going for a job which one doesnt feel like enjoying. So decide what exactly one is made for and then go for it rather than following one's peer group choice. I have seen people during my internship who were doing Test jobs by their choice and not by their destiny. They had options to switch to so called "coveted" Development Jobs in various stages of their lives but they chose to stick to their Test jobs.

The best strategy to make one's mind is to talk to people working in these profiles in the concerned company and try to find out which job is suited for one more than the other. That's it, no rocket science involved :)

Is switching between the profiles possible later?

The straight answer is "Yes, of course". There are many cases I have seen in recent past. One of my friend who did internship in a company in test profile could convert it into PPO of Development profile. He just conveyed to the recruiter that he's more suited for development job.

Another friend of mine, who also did internship in test profile in the same company later could grab the offer from another excellent company in development profile.

I would like to make this point very clear that they didnt have any inferiority feeling for test profiles. It's just that they were more into dev than test. A personal choice as explained above and nothing else.

When one can switch from a tech job to a totally new area i.e a management job in their careers( you must have seen many examples of this) so what's the problem in switching jobs in the same domain?

So, to sum up, feeling of inferiority of one profile over other is just a false notion and one should first listen to his heart than to one's peers.

P.S. In the whole discussion, I might have sounded like an "anti-dev" person but I only tried to be "pro-test" along with "pro-dev". I am having an offer for dev profile from a good company. So I am not "anti-dev" at all. I invite, all of you, to discuss this issue and put forth your views as this being an open ended question.

3 'S' of coding

2008-08-15T08:45:00.001-07:00

Most of us feel that developing algorithm is the main part of whole SDLC(Software Development Life Cycle) which is actually not the case. We, generally, ignore the vital part of coding and do it in our stride. Here, I am mentioning the 3 ‘S’ of coding which one must take care always:

1) Simple: As they say, "Think simple, think better". Keep the design as simple as you can(of course, it should be meeting all functional specifications). One thing worth noting with simplicity is that generally, the first thought that comes to our mind is simple and better. We are the one who make it complex later. So, Believe on your first idea.

2) Scalable: You design should be scalable enough. By scalability, it means “It should be modular enough to accommodate further changes in requirements without modifying much at the base level.” For example, if the logic of your problem demands reading/writing from/to an XML file, you have two ways to do this:

a. Either do normal XML parsing using XMLDocument Class Object(in C#).

b. Use concept of Serialization/Deserialization to derive object out of classes(formed from XML Schema(Xsd)) and populate those object. This will save you at later stage when you need to do some changes in XML. Using this method, you need to just change your schema and voila , you are done! No need to modify hard code.

Clearly, scheme 2 is more scalable. But as you can see, Simplicity and Scalability often contradicts each other. It needs a great combination of experience and expertise to make a balance between two.

3) Standard: This is one of the thing, we ignore the most. But, this is the most important ‘S’ out of 3. Being Standard means following some standard notations, that are followed in industry. This benefits in two ways:

a. Following standards makes the code easy to debug.

b. It also help the followers of your code in easy understanding.

Different languages follow different standards, but common ones are:

i. Identifier Naming: Using camel casing for variable names and Pascal notation for properties and functions. Identifier names should be fully descriptive e.g for a varible which stores the count of old customers in an airline, use variable name as oldCustomerCount rather than using some fundoo names as oldcustcnt or CustmrCnt. Adding few extra characters won’t affect you much in this world of Intellisense and all.. Will it?

ii. Adding Comments: Adding comments to code is also an art. It’s not that you add whatever you want to. It also follows few standard conventions like adding name of the editor, date and time of comment etc.

iii. Indentation and Line Folding: These are generally taken care of automatically in advanced IDEs like Visual Studio, Eclipse etc and need little from side of programmer. Of course, you need to take care if you are using some ancient compilers like Turbo C .:)

iv. Minimal use of Public members: One should use public variables in classes(in C++, C# etc.) as less as possible. Rather use private variables and properties(get and set) derived out of them.

Also, few other things like preferring Asynchronous Callbacks over Continous Polling are also counted as Good programming skills.

So, merely developing algorithm is not enough. You need to implement them by coding and coding well. You will have to do trade-offs among 3 ‘S’ of coding at various stages but that’s how you develop and mature. Isn’t it?

Happy Coding :)

Party Time !!!!

2008-08-02T03:35:00.000-07:00

As N(P)idhi got placed in Adobe( with a very decent package), we all (Interns@MS) could party finally. So we chose yesterday as P-Day. As there was nothing much to do after college registration, we all(Deepank, Mukul, Nidhi and me) left for District Centre. As my bike was the only vehicle we had, I decided to park it at Metro station only so that I can accompany all in Metro(see, how co-operative I am :)). We reached District Centre and had lunch there at Pizza Hut. Then few rounds of strolling and wandering at District Centre and we finally settled down for movie "Jaane Tu ya Jaane Na". Though I had watched it already, but agreed again for common good(Height of co-operation :)). I must say movie was worth watching again. Predictable story line with unpredictable presentation. Music was too cool. Mukul liked the actress "Genelia(Aditi)" for a change. I guess Katrina should work hard ;).

After movie, again some window shopping, eating Ice-Creams, Chuski(especially Wild Cherry for Mukul), chocolate cakes.... I was liking this vellapanti(not very much used to it :)). Reached home at around 7 something. Really enjoyed the day..

After 2 months of extreme hard work, this was required to regain energy and freshness... With college starting from Monday(It's too early:( ), there is much in store for me...

A Journey of Life

2008-07-30T22:43:00.000-07:00

Hi, This is Jitesh Sachdeva. I'm in final year of B.E. at NSIT,COE in Computer Science. I did my summer Internship at Microsoft IDC this year ( got a PPO too :)) and experience was amazing. I rediscovered myself there and found out the software development is the thing I wanted to do always. In short, I have discovered my "Lakshya" and want to strive hard to achieve ultimate s
success.

These days, I 'm living best part of my life. I'm rewinding myself after 2 months of extreme hard work. I have plenty of time to explore other interests these days and hence I'm trying out new things. So, one of the thing I thought is that I should write a blog and here am I... Few other plans to follow: To join a gym and work on my physique and to learn guitar etc.

In this blog, You'll find out stuff related to my experience with life, experiments I did with life, my internship experiences, my future plans and lots of stuff related to computer, technology and philosophy.

So, stay with me and check this blog to experience " A Journey of Life".