Table of Contents

• Windows API Function Cheatsheets
  • File Operations
  • Process Management
  • Memory Management
  • Thread Management
  • Dynamic-Link Library (DLL) Management
  • Synchronization
  • Interprocess Communication
  • Windows Hooks
  • Cryptography
  • Debugging
  • Winsock
  • Registry Operations
  • Error Handling
  • Resource Management
  • Unicode String Functions
    • String Length
    • String Copy
    • String Concatenation
    • String Comparison
    • String Search
    • Character Classification and Conversion
  • Win32 Structs Cheat Sheet
    • Common Structs
    • Win32 Sockets Structs Cheat Sheet (winsock.h)
    • Win32 Sockets Structs Cheat Sheet (winsock2.h)
    • Win32 Sockets Structs Cheat Sheet (ws2def.h)
• Code Injection Techniques
  • 1. DLL Injection
  • 2. PE Injection
  • 3. Reflective Injection
  • 4. APC Injection
  • 5. Process Hollowing (Process Replacement)
  • 6. AtomBombing
  • 7. Process Doppelgänging
  • 8. Process Herpaderping
  • 9. Hooking Injection
  • 10. Extra Windows Memory Injection
  • 11. Propagate Injection
  • 12. Heap Spray
  • 13. Thread Execution Hijacking
  • 14. Module Stomping
  • 15. IAT Hooking
  • 16. Inline Hooking
  • 17. Debugger Injection
  • 18. COM Hijacking
  • 19. Phantom DLL Hollowing
  • 20. PROPagate
  • 21. Early Bird Injection
  • 22. Shim-based Injection
  • 23. Mapping Injection
  • 24. KnownDlls Cache Poisoning
• Process Enumeration

Windows API Function Calls

File Operations

CreateFile

HANDLE CreateFile(
  LPCTSTR lpFileName,
  DWORD dwDesiredAccess,
  DWORD dwShareMode,
  LPSECURITY_ATTRIBUTES lpSecurityAttributes,
  DWORD dwCreationDisposition,
  DWORD dwFlagsAndAttributes,
  HANDLE hTemplateFile
); // Opens an existing file or creates a new file.

ReadFile

BOOL ReadFile(
  HANDLE hFile,
  LPVOID lpBuffer,
  DWORD nNumberOfBytesToRead,
  LPDWORD lpNumberOfBytesRead,
  LPOVERLAPPED lpOverlapped
); // Reads data from the specified file.

WriteFile

BOOL WriteFile(
  HANDLE hFile,
  LPCVOID lpBuffer,
  DWORD nNumberOfBytesToWrite,
  LPDWORD lpNumberOfBytesWritten,
  LPOVERLAPPED lpOverlapped
); // Writes data to the specified file.

CloseHandle

BOOL CloseHandle(
  HANDLE hObject
); // Closes an open handle.