ĐẠI HỌC QUỐC GIA TP.
HỒ CHÍ MINH
TRƯỜNG ĐẠI HỌC CÔNG NGHỆ THÔNG TIN
University of Information Technology (UIT), VNU-HCM
Trường ĐH Công nghệ Thông tin –
ĐHQG TP. HCM
Cơ chế hoạt động của mã độc
NT230 – Malware’s Modus Operandi
University of Information Technology (UIT), VNU-HCM
NT230 - Cơ chế hoạt động của
mã độc
Bài giảng lý thuyết – 02.2025
Email: duypt@[Link]
University of Information Technology (UIT), VNU-HCM
EXECUTABLE FILE
FORMAT
WEI WANG – Defense Against the Dark Arts
4 University of Information Technology (UIT), VNU-HCM
Compiler, Linker and Loader
Process [Link]
Execute File:
[Link] Memory:
Source files: Object files: [Link]
source1.c compiler source1.o
linker loader [Link]
source2.s source2.o
[Link] source3.o [Link]
[Link]’s
Shared Library:
code
[Link]
5 University of Information Technology (UIT), VNU-HCM
Compiler, Linker and Loader cont’d
• Compiler transforms source code into binary machine code
(object code)
– Example: gcc, Clang, vc_compilerCTP.exe
• Linker takes object files and libraries files, and combies
them into a single executable file or library file
– Example: GNU ld, lld, [Link]
• Loader load an executable file and libraries into memory to
start a new process (part of OS)
– Executable loader: load executable files
• Example: execve (system call)
– Dynamic linking load: load dynamic libraries
• Example: [Link]
6 University of Information Technology (UIT), VNU-HCM
Compiler, Linker and Loader cont’d
More about Loader
• Brings an executable file and required libraries on disk into
memory to start a new process
• Tasks:
– Copy executable file code (text section) and global variables
(data section) into memory
– Copy arguments and environment variables into memory
– Initialize registers
– Jump to start of program to execute (_start function)
– Load dynamic libraries (map dynamic libraries code into
memory)
7 University of Information Technology (UIT), VNU-HCM
Compiler, Linker and Loader cont’d
• For compiler, linker and loaders to work properly, they have
to agree on the format of object files, executable files and
library files
• The most common formats are:
– ELF on *nix: Executable and Linkable Format
– PE on Windows: Portable Executable
– Mach-O on OS X
8 University of Information Technology (UIT), VNU-HCM
The ELF Format
• Executable and Linkable Format
• Defines format for:
– Executables
– Object files
– Dynamic libraries (shared libraries)
– Core dumps
9 University of Information Technology (UIT), VNU-HCM
ELF Format Examples
• ELF Header: basic
identification information of
this file
• Program header table:
location of text and data
sections
• Text section: the code
• Relocation information: for
relocatable text and data
sections
10 University of Information Technology (UIT), VNU-HCM
ELF Format Examples (cont’d)
• Data sections:
– .rodata: read-only
– .bss: uninitialized global
variables
– .data: initialized global
variables
• Example of other sections:
– .dynamic: dynamic linking
information
– .got: global offset table
– .init: process initialization
code
11 University of Information Technology (UIT), VNU-HCM
ELF Format Examples (cont’d)
• Symbol table: locate
program symbolic
definition (e.g., exported
function name)
• Section header table:
location and information
of each section
12 University of Information Technology (UIT), VNU-HCM
ELF File to Process Memory
ELF Executable
Process Memory
13 University of Information Technology (UIT), VNU-HCM
ELF File to Process Memory cont’d
• Some sections will be directly copied to
memory:
– Example: .text, .data, .init, .dynamic
– The location (memory addresses) of these
sections are defined in the ELF (if not PIC/PIE and
ASLR)
• Some sections will not be copied to memory
– Example: symbol table, debug info
14 University of Information Technology (UIT), VNU-HCM
Analyzing ELF Files
• readelf: Display information about ELF files
– readelf -h executable
• Show ELF header
15 University of Information Technology (UIT), VNU-HCM
Analyzing ELF Files cont’d
• readelf –S executable
– Show section information
16 University of Information Technology (UIT), VNU-HCM
Analyzing ELF Files cont’d
• Each section also has a flag
• In the end of readelf -S output, the flags explained
• The flag bits determine whether a section can be
read, written, executed, etc., NOT the section
name; viruses might modify the flag bits so that a
.text section becomes writable!
17 University of Information Technology (UIT), VNU-HCM
Analyzing ELF Files cont’d
• Each section also has a flag
• In the end of readelf -S output, the flags explained
• The flag bits determine whether a section can be
read, written, executed, etc., NOT the section
name; viruses might modify the flag bits so that a
.text section becomes writable!
18 University of Information Technology (UIT), VNU-HCM
Analyzing ELF Files cont’d
• readelf has many other useful options
– Read the man page for more information
• objdump: the disassembler
• hexdump: raw hexadecimal dump
• file: determine file type
– file executable
• For more information, Google “ELF format specification”
19 University of Information Technology (UIT), VNU-HCM
The PE format
• Portable Executable
• Also called PE32 (because it is 32-bit code); PE32+
is for 64-bit code
• Older formats exist for 16-bit DOS and Windows
3.1
20 University of Information Technology (UIT), VNU-HCM
The PE format cont’d
• Similar to ELF format
– PE header and DOS header
– Text and data sections
– Relocation informations
– Symbol table
– Debug information
– And other sections
• Common sections are .text (for code), .data (read/write
data), .rdata (read-only data, .reloc (relocation data used to
build IATs)
21 University of Information Technology (UIT), VNU-HCM
PE Format Example
22 University of Information Technology (UIT), VNU-HCM
DOS Header
• If a program is invoked within a DOS command prompt
window, it starts executing here
• For most PE32 executables, the DOS header contains a
tiny executable that prints: “This application must be run
from Windows”, then exits
23 University of Information Technology (UIT), VNU-HCM
Dead Space in Executable File Formats
• There are empty spaces in executable files
– The beginning of ELF files
– Empty spaces between functions
– Empty spaces between sections
– Nops in functions
– Some linkers make executable file align to page
boundaries
• Simpilies the loader's job
24 University of Information Technology (UIT), VNU-HCM
Executable File Format and Viruses
• Question: Why do we care about the details of the PE file
format?
• Answer: Because a virus writer will try to infect the PE file in
such a way as to make the virus code execute, while making
the PE file look as it would normally look. The job of anti-
virus software is to find well disguised viruses.
• Dead spaces are perfect locations to hide viruses
– CIH virus break itself into parts and hide in the dead spaces between
PE sections
25 University of Information Technology (UIT), VNU-HCM
Tài liệu tham khảo
• Wei Wang – Defense Against the Dark Arts
26 University of Information Technology (UIT), VNU-HCM
NT230 – Malware’s Modus Operandi
Cơ chế hoạt động của mã độc
Email: inseclab@[Link]
Trường ĐH Công nghệ Thông tin -
ĐHQG TP. HCM
University of Information Technology (UIT), VNU-HCM
© Trường ĐH Công nghệ
Thông tin
Tài liệu giảng dạy môn học
University of Information Technology (UIT), VNU-HCM