Table of Contents for

Practical Malware Analysis

G

g (go) command, in WinDbg, Reading from Memory

GCC (GNU Compiler Convention), calling conventions, If Style

GDI32.dll, Exploring Dynamically Linked Functions with Dependency Walker, PotentialKeylogger.exe: An Unpacked Executable

importing from, PotentialKeylogger.exe: An Unpacked Executable

GDT (global descriptor table), Vulnerable Instructions

GDT register (GDTR), Vulnerable Instructions

general registers, Registers, Differences in x64 Architecture

in x64 architecture, Differences in x64 Architecture

GET request, Indications of Malicious Activity, Hiding in Plain Sight, Networking Analysis

and malicious activity, Indications of Malicious Activity

malware construction of, Networking Analysis

GetAdaptersInfo function, Important Windows Functions, Finding Anti-VM Techniques Using Strings

dynamic resolution, Finding Anti-VM Techniques Using Strings

getaddrinfo function, Understanding Surrounding Code

GetAsyncKeyState function, User-Space Keyloggers, Important Windows Functions, Summary, Detailed Analysis

GetCommandLineA function, Finding the OEP Manually, WinUpack

breakpoint on, WinUpack

getContent function, Detailed Analysis

GetCurrentProcessId function, Using the Memory Map to Locate DLLs

GetCurrentThreadId function, Detailed Analysis

GetDC function, Important Windows Functions

GetFileSize function, Detailed Analysis

GetForegroundWindow function, User-Space Keyloggers, Important Windows Functions, Summary, Detailed Analysis, Detailed Analysis

GetHash function, GINA Interception

gethostbyname function, Understanding Surrounding Code, Knowing the Sources of Network Content, Important Windows Functions, Detailed Analysis, Detailed Analysis

gethostname function, Important Windows Functions, Detailed Analysis, Detailed Analysis

GetKeyState function, User-Space Keyloggers, Important Windows Functions

GetModuleBaseNameA function, Detailed Analysis

GetModuleFileName function, Important Windows Functions, Detailed Analysis, Detailed Analysis, Decoding Stack-Formed Strings, Detailed Analysis

GetModuleHandle function, Finding the OEP Manually, WinUpack, Important Windows Functions, Detailed Analysis

breakpoint on, WinUpack

GetProcAddress function, Finding Strings, Portable Executable File Format, Rootkit Analysis in Practice, Hash Dumping, DLL Injection, Loading the Executable, Identifying Packed Programs, Finding the OEP Manually, Using fnstenv, Important Windows Functions, Detailed Analysis

setting breakpoints on, Finding the OEP Manually

unpacking stub import of, Loading the Executable

GetStartupInfo function, Important Windows Functions

GetSystemDefaultLangId function, Important Windows Functions, Detailed Analysis

GetSystemDefaultLCID function, Modifying Program Execution in Practice

GetTempPath function, Important Windows Functions, Detailed Analysis

GetThreadContext function, Important Windows Functions, Detailed Analysis, Detailed Analysis

GetTickCount function, Understanding Surrounding Code, Knowing the Sources of Network Content, Hard-Coded Data vs. Ephemeral Data, Timing Checks, Important Windows Functions, The QueryPerformanceCounter Function

GetVersion function, Finding the OEP Manually

GetVersionEx function, Important Windows Functions

GetWindowsDirectory function, Important Windows Functions

GFI Sandbox, Basic Dynamic Analysis

GINA (Graphical Identification and Authentication) interception, GINA Interception, Short Answers

indications of, Short Answers

global descriptor table (GDT), Vulnerable Instructions

global values in memory, Main Memory

global variables, Recognizing C Code Constructs in Assembly, Using the Memory Map to Locate DLLs, Detailed Analysis

cross-references for, Using the Memory Map to Locate DLLs

vs. local, Recognizing C Code Constructs in Assembly

GlobalAlloc function, Detailed Analysis

globally unique identifiers (GUIDs), The Component Object Model

GNU Compiler Collection (GCC), calling conventions, If Style

gnuunx (GNU C++ UNIX) libraries, Using Named Constants

GrabHash function, Hash Dumping

graph, Searching for High-Entropy Content, Identifying Custom Encoding

from IDA Pro Entropy Plugin, Searching for High-Entropy Content

of encrypted write, Identifying Custom Encoding

graph mode, in IDA Pro, Loading an Executable, Analyzing Functions

Graphical Identification and Authentication (GINA) interception, GINA Interception, Short Answers

indications of, Short Answers

Gray Hat Python (Seitz), Scriptable Debugging

GUI manipulation functions, PotentialKeylogger.exe: An Unpacked Executable

GUI programs, IMAGE_SUBSYSTEM_WINDOWS_GUI value for, Examining PE Files with PEview

GUIDs (globally unique identifiers), The Component Object Model