Shellcoding: Hunting for Kernel32 Base Address

Kernel32 is one of the most used dynamic link libraries (DLLs) for application programming interface (API) calls on the Microsoft Windows operating system. Each DLL file contains many functions, and each function has its own memory address once loaded in memory. The API memory address is essential for any API call. In the past, the memory address for each API was fixed to a specific hex value. If an attacker was able to obtain these API addresses on one operating system, it could be used on any other Windows operating system as well. In this paper, we examine two existing methods and propose two novel methods to find kernel32 base address. The objective is to optimally combine all the methods to increase the detection rate of unknown malware, and perform experimental evaluation for malware detection in next-generation communication networks.