Raw Sockets | WinAPI Sockets |
---|---|
socket() | WSAStratup() |
bind() | bind() |
listen() | listen() |
accept() | accept() |
connect() | connect() |
read()/recv() | recv() |
write() | send() |
shutdown() | WSACleanup() |
Registry | File | Service |
---|---|---|
RegCreateKeyEx() | GetTempPath() | OpenSCManager |
RegOpenKeyEx() | CopyFile() | CreateService() |
RegSetValueEx() | CreateFile() | StartServiceCtrlDispatcher() |
RegDeleteKeyEx() | WriteFile() | |
RegGetValue() | ReadFile() |
Name |
---|
WinCrypt |
CryptAcquireContext() |
CryptGenKey() |
CryptDeriveKey() |
CryptDecrypt() |
CryptReleaseContext() |
Function Name | Assembly Instructions |
---|---|
IsDebuggerPresent() | CPUID() |
GetSystemInfo() | IN() |
GlobalMemoryStatusEx() | |
GetVersion() | |
CreateToolhelp32Snapshot [Check if a process is running] | |
CreateFileW/A [Check if a file exist] |
Name | |
---|---|
VirtualAlloc | Alloc memory (packers) |
VirtualProtect | Change memory permission (packer giving execution permission to a section) |
ReadProcessMemory | Injection into external processes |
WriteProcessMemoryA/W | Injection into external processes |
NtWriteVirtualMemory | |
CreateRemoteThread | DLL/Process injection… |
NtUnmapViewOfSection | |
QueueUserAPC | |
CreateProcessInternalA/W |
Function Name |
---|
CreateProcessA/W |
ShellExecute |
WinExec |
ResumeThread |
NtResumeThread |