# I want to learn more (1)
I knew about Dll Injection&Reflect DLL lnjection,Fileless.it use fixed memory address. As me, I want to change memory address of my malware as real time. it means "float" or "flow" as river in memory.

var unreadAlerts = '1';
Welcome back, purely_cabbage. You last visited: Today, 06:36 AM Log Out
You have one unread private message from dkota titled Welcome to the Forum!
New Reply

Threaded Mode I want to learn more

Simye
Newbie
Posts:
1
Threads:
1
Joined:
Feb 2023
Reputation:
0
Credits: 5€ [Donate]
#1
02-10-2023, 12:09 AM
I knew about Dll Injection&Reflect DLL lnjection,Fileless.it use fixed memory address.
As me, I want to change memory address of my malware as real time. it means "float" or "flow" as river in memory. If Memory was river,malware is small ship.it has not fixed memory address.ofcourse it is fileless .
Totaly,it is Fileless malware and it has not fixed memory.are u ok?..
Could you help me?
PM Rate
Report
MagicByte
Elite
Posts:
57
Threads:
19
Joined:
Feb 2023
Reputation:
35
Credits: 75.7€ [Donate]
View All
#2
02-10-2023, 01:27 PM

> Simye Wrote: I knew about Dll Injection&Reflect DLL lnjection,Fileless.it use fixed memory address.
> As me, I want to change memory address of my malware as real time. it means "float" or "flow" as river in memory. If Memory was river,malware is small ship.it has not fixed memory address.ofcourse it is fileless .
> Totaly,it is Fileless malware and it has not fixed memory.are u ok?..
> Could you help me?

You could try Process Hollowing
Link: https://attack.mitre.org/techniques/T1055/012/
PM Rate
Reply Quote // Report
NexusNoctis
Newbie
Posts:
5
Threads:
1
Joined:
Feb 2023
Reputation:
1
Credits: 5€ [Donate]
#3
02-12-2023, 02:08 AM
take a look at my answer on CryptBB. Let me know if I got the question right and also if you need further assistance or concrete code examples.
PM Rate
Reply Quote // Report
prince97
Administrator
Posts:
145
Threads:
36
Joined:
Feb 2023
Reputation:
49
Credits: 25.6€ [Donate]
View All
#4
02-12-2023, 10:37 AM

> NexusNoctis Wrote: take a look at my answer on CryptBB. Let me know if I got the question right and also if you need further assistance or concrete code examples.

Please don't post answers like this, this does not help anyone and only complicates matters when you reference a different post in a different forum.
It's wiser to either copy-paste the post, or, to write a new one.
If you have any questions, please PM dkota
PM Rate
Reply Quote //
NexusNoctis
Newbie
Posts:
5
Threads:
1
Joined:
Feb 2023
Reputation:
1
Credits: 5€ [Donate]
#5
02-12-2023, 01:41 PM

> prince97 Wrote:

> > NexusNoctis Wrote: take a look at my answer on CryptBB. Let me know if I got the question right and also if you need further assistance or concrete code examples.

> Please don't post answers like this, this does not help anyone and only complicates matters when you reference a different post in a different forum.
> It's wiser to either copy-paste the post, or, to write a new one.

Yes, very true. Sorry about that. I'm often just very lazy. Essentially what I was saying to truly float in memory you need to have kernel level access so you can allocate memory everywhere you want and so on. However, you can easily do things like that in virtual memory by making your program essentially a looping linked list and have each node allocate new executable memory pages for the next node and continue execution there. Has ofc. some challenges to it, but I'm sure one can figure that out with that initial idea.
PM Rate
Reply Quote // Report
MagicByte
Elite
Posts:
57
Threads:
19
Joined:
Feb 2023
Reputation:
35
Credits: 75.7€ [Donate]
View All
#6
02-12-2023, 06:06 PM

> NexusNoctis Wrote:

> > prince97 Wrote:

> > > NexusNoctis Wrote: take a look at my answer on CryptBB. Let me know if I got the question right and also if you need further assistance or concrete code examples.

> > Please don't post answers like this, this does not help anyone and only complicates matters when you reference a different post in a different forum.
> > It's wiser to either copy-paste the post, or, to write a new one.

> Yes, very true. Sorry about that. I'm often just very lazy. Essentially what I was saying to truly float in memory you need to have kernel level access so you can allocate memory everywhere you want and so on. However, you can easily do things like that in virtual memory by making your program essentially a looping linked list and have each node allocate new executable memory pages for the next node and continue execution there. Has ofc. some challenges to it, but I'm sure one can figure that out with that initial idea.

I think the kernel can't just do that right? It would crash the system if it overrides memory addresses on random
PM Rate
Reply Quote // Report
crackedorb
Newbie
Posts:
7
Threads:
1
Joined:
Mar 2023
Reputation:
1
Credits: 5€ [Donate]
#7
03-21-2023, 08:43 AM

> Simye Wrote: As me, I want to change memory address of my malware as real time. it means "float" or "flow" as river in memory. If Memory was river,malware is small ship.it has not fixed memory

very beautiful analogy.
PM Rate
Reply Quote // Report

« Next Oldest | Next Newest »

New Reply

Quick Reply
Message Type your reply to this message here. Signature Disable Smilies | You have selected one or more posts to quote. Quote these posts now or deselect them.

Possibly Related Threads…
Thread | Author | Replies | Views | Last Post
| where can i learn how to use NMAP | zilly | 5 | 38 | Yesterday, 02:14 PM Last Post: mangeky023

- Subscribe to this thread

Users browsing this thread: purely_cabbage
var thread_deleted = "0"; if(thread_deleted == "1") { $("#quick_reply_form, .new_reply_button, .thread_tools, .inline_rating").hide(); $("#moderator_options_selector option.option_mirage").attr("disabled","disabled"); }