Black Hat C

Low-Level Exploitation and Malware Engineering

1. From Buffer Overflows to Rootkits: A Practitioner’s Guide

Introduction

1. How to use this book
2. Ethical note

Chapter 1: The Attacker’s View of Memory and Execution

1. A Minimal Vulnerable Program
2. Process Layout: Text, Data, Heap, Stack
3. ELF Format and Why It Matters
4. x86/x64 Registers and the Call Stack
5. How a Function Call Really Works (Calling Conventions)
6. From Source to Assembly: Tracing One Example
7. Segmentation, Paging, and Virtual Memory
8. Defensive Note: Why You Must Know This

Chapter 2: Buffer Overflows – The Classic Weapon

1. Anatomy of a Stack Buffer Overflow
2. Controlling the Return Address
3. Finding the Offset: Fuzzing with Patterns
4. NOP Sleds and Shellcode Placement
5. A Complete Exploit Walkthrough (Linux, x86)
6. Return-to-libc: Exploitation Without Shellcode
7. Defensive Note: Stack Canaries, ASLR, and Hardening Trade-offs

Chapter 3: Format String Vulnerabilities

1. How printf Parses Its Arguments
2. Leaking the Stack with %x and %p
3. Overwriting Arbitrary Memory with %n
4. A Realistic Exploit Example
5. Chained Format String Attacks
6. Real-World Example: CVE-2024-29510 in Ghostscript
7. Defensive Note: Safe Formatting and Static Analysis

Chapter 4: Heap Exploitation and Use-After-Free

1. How the Heap Is Managed (ptmalloc / glibc Basics)
2. Off-by-One and Heap Overflows
3. Use-After-Free: The Concept
4. Exploiting UAF via Struct Overwrite
5. Fastbin Attacks: A Concrete Walkthrough
6. Defensive Note: Hardened Allocators and Sanitizers

Chapter 5: Shellcoding – Code That Runs Anywhere

1. Constraints of Shellcode (No Null Bytes, No Fixed Addresses)
2. Writing a Simple execve(“/bin/sh”) on Linux (x86)
3. Writing a Simple execve(“/bin/sh”) on Linux (x86_64)
4. Reverse TCP Shellcode: Connecting Back
5. Position-Independent Tricks (Self-Referencing RIP, Syscall Stubs)
6. Encoding and Decoding Payloads
7. Embedding Shellcode in C Exploits
8. Defensive Note: DEP/NX, CFG, and Sandboxing

Chapter 6: Bypassing Protections – ASLR, DEP, Canaries

1. ASLR: How It Works and Where It Leaks
2. Information Leaks via Pointers and CRT
3. ROP Chaining (Return-Oriented Programming)
4. Bypassing DEP with ROP
5. Defeating Stack Canaries (Leak + Reuse)
6. Defensive Note: Full Mitigation Stacks and SECCOMP

Chapter 7: Position-Independent Code and Exploit Engineering

1. Static vs Dynamic Linking
2. Position-Independent Executables (PIE)
3. GOT/PLT Overwrites as an Attack Vector
4. Leveraging libc Offsets in Exploits
5. Combining Leaks, ROP, and GOT Hijacking
6. Defensive Note: RELRO, BindsNow, and Full Hardening

Chapter 8: Anti-Analysis Techniques

1. Detecting Sandboxes and VMs (CPUID, Timing, Artifacts)
2. String Obfuscation and Encrypted Payloads
3. Packed Binaries and Custom Unpackers
4. Anti-Debugging Tricks (PTRACE, Timing, sysenter tricks)
5. Flow Obfuscation and Control Integrity
6. Defensive Note: Dynamic Analysis Strategies

Chapter 9: Rootkits – Hiding in the Kernel

1. Userland vs Kernel Rootkits
2. Inline Hooking System Calls (Linux Example)
3. Modifying the System Call Table (Conceptual)
4. Hiding Processes, Files, and Network Sockets
5. Driver-Based Persistence on Windows (Conceptual)
6. Defensive Note: Integrity Checking, eBPF, and PatchGuard

Chapter 10: Malware Development Patterns

1. Process Injection Techniques (CreateRemoteThread, APC Injection)
2. Reflective DLL Loading
3. Living Off the Land (LOLBins and Scripts)
4. Command and Control (C2) Channel Design
5. Fileless Persistence and Memory-Only Techniques
6. Defensive Note: EDR, Telemetry, and Behavioral Detection

Chapter 11: Putting It All Together – A Controlled Case Study

1. The Lab: Dockerized, Isolated Test Environment
2. Target Service with Multiple Flaws
3. Step-by-Step Exploit Development
4. Adding Evasion and Persistence Layers
5. Post-Exploitation View
6. Defensive Note: How a Hardened System Would Resist This
7. Defensive Note: How a Hardened System Would Resist This

Conclusion

References