Everybody I'm going to part for going a little deeper many modules.
So in this video we're really talking about the API or the Windows API.
So what does an API in general an API in general is an application programming interface.
So it is a way for application developers to interface with something being generic there for this term
of just API in general to interface with some thing or some service to perform some sort of action.
So in Windows case there is a Windows API or when API is it's also called that almost every Windows
application is using to interface with the Windows operating system so Windows has two levels of API.
They've got the win API which is the common one and then they have a native API.
Now the native API is something we're not going to go over in this video.
However feel free to read up on it.
It go.
It is what the application or the the one API uses behind the scenes.
There are only very few applications such as stuff during start up when other libraries have not been
loaded in yet.
Game is when this tends to get used and when you need to run something very specific at a very low level
that's when you would run against the native API.
But in in our case and in most cases you're going to use the wind API so there are a few common libraries
I want to go over.
We're gonna have a specific module on or video on DL LS and exactly what what the structure of them
of them are.
But for this particular case know that a DSL is just a library of functions that can be called to perform
a specific action.
So think of them as just another program that you have to interface in a slightly different way so there's
base services.
So the kernel 32 and kernel base are two deals that provide most of the functionality that you're going
to see for an application such as memory handling files hardware and anything around a common occurrence
of something you're going to see this on almost every executable which again after this short slide
show we're going to go in and actually open up an application and take a look and see how this works
these advanced services.
So this is stuff that the base services doesn't cover such as acts in the registry some system components
managing user accounts all that's done in the ATV API 32
there's a graphic device interface which handles the monitor printers any any output based device
then we have the user interface so anything with a glitch or a graphical user interface.
In most case most applications that you're going to handle on a Windows machine just for example opening
up notepad will have user 30 to DL l included in some way shape or form to allow for buttons the windows
everything around there.
And we have Windows shell which is Shell 32.
This is getting to be able to access functions from the command line and be able to access the command
line area and we have network services.
So this is split up against a few different deals and there's plenty more around there but it provides
all if not most of the network end functions such as creating sockets which will go over in the networking
module.
But think of the socket is just a communication medium between a particular system that you can connect
to to share data so it create implementing stuff such as FCP HDP and I misspelled that.
That'll be fixed in your guises video or the PDR.
That's about the video.
So that's the general base of some of the DL.
Now there are hundreds if not thousands of deals on the Windows system.
So you're not we're not going to go through all of them.
But a quick way if you need to understand what a particular deal does is just google the deal out directly
and then you'll see the link to the Microsoft documentation that is going to be key for this video as
you need to be able to understand how to look up API calls and DL else that you don't recognize through
the windows docs they're going to be your best source for identifying his calls.
I'm sorry.
When does API calls what they do where they're used and even the the parameters and everything that's
being set.
So we're gonna do a quick quick look through at a particular executable.
So I believe in this case we're just going to use either calculator notepad we're going to use something
called dependency Walker.
Now there's a link for this in the description or the links above the video.
So go ahead and download that into your VM.
There is one thing that you're going to want to change because by default Internet Explorer isn't gonna
let you go to very many places.
So to fix that you need to go to the taskbar here.
We need the server part server manager will go up to local server and then you'll see something called
i.e. enhanced security configuration.
You click on that.
Now your should say on here you're going to want to turn it off for administrators only so that means
administrators can go anywhere they want the browser but users are still restricted to only safe sites.
So I just turned mine off so go ahead and turn yours off so you can download the dependency Walker.
So once it's downloaded we'll go ahead and fire it up.
Run so once we're in here we're going to want to open a file.
So in this case I was toying around with these two so we're gonna do a calculator
ignore the error for now.
That's fine.
Minimize these
so we can see here that we've got Shell 32 kernel which is are our standard 1 MSP CRT and the advanced
calls.
Now Shell 32.
So let's take a look let's say if we were investigating this.
This function shell execute W is in is an API call.
So to figure this out so let's say we didn't understand what this was.
So we're gonna go pop up Google to Shell execute W and we'll see the Microsoft docs right here.
So we can see it performs an operation on a specified file.
Now this can be arbitrary.
We don't necessarily know what it's calling unless we loaded it into a debugger and found it out this
way.
Right now we're looking at it to see what API calls this application will have to do so essentially
importing this which will go over in our P files video which is very shortly after this.
We'll go over how this is important what each of these are where things are etc. but understand that
now we know it performs an operation on some sort of file we kind of have the parameters that it goes
in here we have a file parameters then the command there's a few more options.
You kind of get a general idea of what it's about to do.
So let's take another kernel 32 right.
So this is our standard one.
See here we have a quick look for a good one.
Get current process.
So let's take a look at current process.
Get process perfect she's a pseudo handle for the current process.
So think if you guys are familiar with programming.
Think of this as the word this so you're referencing this application.
The current application which is normally normally their functions are pretty self-explanatory.
However it's always good to just double check.
So think of a handle as a reference to something.
So in this case it's a reference to the current process.
So when we refer to other things such as let's see
once they get tick count.
Right.
So getting the ticks that have passed in a certain amount of time let's say we wanted to get it only
from this process so we would pass the handle to this as an example.
So as we looked at Shell execute w right this should have had a handle on it as well
handle to the parent window so we can pass something around there.
So this gives you just a general overview of what CIS calls are where they are.
It's not always straightforward to debug them.
Sometimes it's a little bit of pain in the ass.
I'm not going to lie but in a general sense you can use dependency Walker to find out what will be called
during an application.
Now there are things on Linux such as S. trace that will show you the calls being made live and in that
particular case you can see it happen but for windows there's there's a few applications out there that
will allow you to do it.
However I find this is the quickest way to have a general understanding of what an application is going
to do and what certain calls it is attempting to provide.
Now this is also can can be considered part of static analysis for reversing or identifying malware.
So knowing if you have a random executable and you open this up and you start seeing shell commands
and maybe the a few different things around getting another processes I.D. or hooking into another process
or something around d bugs that could be a lot of issues or if it's getting keyboard input you'll see
a specific API calls for that.
So that's always something to keep an eye out for when you're when you're investigating an executable
or a P binary which is what a C is.
So this has been a quick look at API s now it's there's such a large amount of them that you're going
to you're going to get familiar with a few the naming schemes are going to be very helpful but there's
just some times where there's there's some some weird ones like C execs frame handle or we'd have to
go and we just have to go look that up.
There's not a good way for us to just memorize this.
Off the top of our head unless you can do that and if that's the case great for you I can't.
So go ahead and open up a different binary something that you want to take a look at maybe not something
that is part of Windows.
So go ahead and grab an installer for Java let's say.
Or maybe you have something that you've written as an apple.
As a developer or maybe you scripted a few things or whatever the case is go ahead and open this up
and just try to find out what it's doing from this window instead of what what sort of a server what's
doing but what it can do when it has access to.
And then we can go from there.
Let everybody know on the Facebook group as well we can always have a good chat about a particular binary
that you might be looking at and if it's something publicly available that's not malware obviously we
can always take a quick look all together.