SlideShare une entreprise Scribd logo

201403 microsoft mvp com camp 2014-한주성

•Télécharger en tant que PPTX, PDF•
•
주성 한
주성 한

리버스 엔지니어링 - Handle

Technologie
1  sur  23
How am i?
How am i?
What is Reverse Engineering 목표 준비 분해분석 도출
What is Reverse Engineering • Software Reverse Engineering(SRE) 소스코드나 관련 문서가 없는 프로그램에서 설계나 구현 내용을 알 아내는 작업 보안, 소프트웨어 개발(백신, 드라이버?) • Dynamic Analysis, Static Analysis 시스템 기반인지, 코드 기반인지에 따라 구분 • Why many engineer to develop Kernel Debugging? 더 빠르고 쉽게 문제를 해결 하기 위해
What is Reverse Engineering
Handle??
View is Different 관리자 리버서 개발자 일반인 쉽게!!
SE(Security Engineer)
Developer • 자원 포인터!! HANDLE h = CreateFile(L"C:unicode.txt", GENERIC_WRITE, 0, NULL, CREATE_ALWAYS, 0, 0);
Developer
Reverser • Object  Desktop Heap • EPROCESS  OBJECTTABLE = _HANDLE_TABLE • _HANDLE_TABLE  HANDEL_TABLE_ENTRY • OBJECT  _OBJECT_HEADER • _FILE_OBJECT  _PRIVATE_CACHE_MAP, _SECTION_OBJECT_POINTERS
Reverser - Object
Reverser – Desktop heap Desktop Heap Monitor Version 8.1(dheapmon) http://www.microsoft.com/download/en/details.aspx?displaylang=en&id=17782
Reverser – EPROCESS • lkd> dt nt!_EPROCESS 850a33d0 • ……….중략! • +0x0f0 ExceptionPortValue : 0x8624a278 • +0x0f0 ExceptionPortState : 0y000 • +0x0f4 ObjectTable : 0xadde2388 _HANDLE_TABLE • ……….중략! • lkd> dt _HANDLE_TABLE 0xadde2388 • nt!_HANDLE_TABLE • +0x000 TableCode : 0xb1e8f000 • +0x004 QuotaProcess : 0x850a33d0 _EPROCESS • ……….중략!
Reverser – HANDLE(WIN7) • lkd> dt _HANDLE_TABLE_ENTRY 84e343d0 • nt!_HANDLE_TABLE_ENTRY • +0x000 Object : 0x84884171 Void • +0x000 ObAttributes : 0x84884171 • +0x000 InfoTable : 0x84884171 _HANDLE_TABLE_ENTRY_INFO • +0x000 Value : 0x84884171 • ----------------------------------------------- • +0x004 GrantedAccess : 0xf00ff • +0x004 GrantedAccessIndex : 0xff • +0x006 CreatorBackTraceIndex : 0xf • +0x004 NextFreeTableEntry : 0xf00ff • lkd> .formats 0x84884171 • Binary: 10000100 10001000 01000001 01110001
Reverser – HANDLE(WIN8) • lkd> dt _HANDLE_TABLE_ENTRY ffffc000`0d45d0f0 • ntdll!_HANDLE_TABLE_ENTRY • +0x000 VolatileLowValue : 0n-2305842090310893567 • +0x000 LowValue : 0n-2305842090310893567 • +0x000 InfoTable : 0xe00000d5`f2e00001 _HANDLE_TABLE_ENTRY_INFO • +0x000 Unlocked : 0y1 • +0x000 RefCnt : 0y0000000000000000 (0) • +0x000 Attributes : 0y000 • +0x000 ObjectPointerBits : 0y11100000000000000000000011010101111100101110 (0xe00000d5f2e) lkd> dt _OBJECT_HEADER 0xe00000d5f2e0+ffff000000000000 … +0x030 Body : _QUAD lkd> dt _FILE_OBJECT 0xe00000d5f2e0+ffff000000000000+30
Reverser • 핸들 테이블과 파일 개체의 구조
Reverser • 파일 개체의 캐시 메모리
Reverser • lkd> dt _SECTION_OBJECT_POINTERS 0xffffe000`03ee2768 • ntdll!_SECTION_OBJECT_POINTERS • +0x000 DataSectionObject : 0xffffe000`010ffcd0 Void • +0x008 SharedCacheMap : 0xffffe000`02e44b10 Void • +0x010 ImageSectionObject : (null) • lkd> dt nt!_SHARED_CACHE_MAP 0xffffe000`02e44b10 • +0x000 NodeTypeCode : 0n767 • +0x002 NodeByteSize : 0n520 • +0x004 OpenCount : 1 • +0x008 FileSize : _LARGE_INTEGER 0x296043 • +0x010 BcbList : _LIST_ENTRY [ 0xffffe000`02e44b20 - 0xffffe000`02e44b20 ] • +0x020 SectionSize : _LARGE_INTEGER 0x400000 • +0x028 ValidDataLength : _LARGE_INTEGER 0x0 • +0x030 ValidDataGoal : _LARGE_INTEGER 0x296043 • +0x038 InitialVacbs : [4] (null) • +0x058 Vacbs : 0xffffe000`03cdd5f0 -> (null) • lkd> dt _VACB 0xffffe000`003010f0
Easy to way • !process • !handle • !filecache • !object • !fileobj • !ca
Software Reverse Engineering Tech Flow 운영체제 멜웨어, 루트킷, 안티, 디버깅 침해사고, 포랜식
http://itka.kr allmnet@naver.com

Recommandé

JavaScript Obfuscation
JavaScript ObfuscationJavaScript Obfuscation
JavaScript Obfuscationn|u - The Open Security Community
 
Introduction to jQuery
Introduction to jQueryIntroduction to jQuery
Introduction to jQuerySeble Nigussie
 
অনন্তের পথে যাত্রা
অনন্তের পথে যাত্রাঅনন্তের পথে যাত্রা
অনন্তের পথে যাত্রাQuran Sunnahr Alo
 
Lightning Talk #9: How UX and Data Storytelling Can Shape Policy by Mika Aldaba
Lightning Talk #9: How UX and Data Storytelling Can Shape Policy by Mika AldabaLightning Talk #9: How UX and Data Storytelling Can Shape Policy by Mika Aldaba
Lightning Talk #9: How UX and Data Storytelling Can Shape Policy by Mika Aldabaux singapore
 
Succession “Losers”: What Happens to Executives Passed Over for the CEO Job?
Succession “Losers”: What Happens to Executives Passed Over for the CEO Job? Succession “Losers”: What Happens to Executives Passed Over for the CEO Job?
Succession “Losers”: What Happens to Executives Passed Over for the CEO Job? Stanford GSB Corporate Governance Research Initiative
 
SEO: Getting Personal
SEO: Getting PersonalSEO: Getting Personal
SEO: Getting PersonalKirsty Hulse
 
The Six Highest Performing B2B Blog Post Formats
The Six Highest Performing B2B Blog Post FormatsThe Six Highest Performing B2B Blog Post Formats
The Six Highest Performing B2B Blog Post FormatsBarry Feldman
 
The Outcome Economy
The Outcome EconomyThe Outcome Economy
The Outcome EconomyHelge Tennø
 

Recommandé

JavaScript Obfuscation
JavaScript ObfuscationJavaScript Obfuscation
JavaScript Obfuscationn|u - The Open Security Community
 
Introduction to jQuery
Introduction to jQueryIntroduction to jQuery
Introduction to jQuerySeble Nigussie
 
অনন্তের পথে যাত্রা
অনন্তের পথে যাত্রাঅনন্তের পথে যাত্রা
অনন্তের পথে যাত্রাQuran Sunnahr Alo
 
Lightning Talk #9: How UX and Data Storytelling Can Shape Policy by Mika Aldaba
Lightning Talk #9: How UX and Data Storytelling Can Shape Policy by Mika AldabaLightning Talk #9: How UX and Data Storytelling Can Shape Policy by Mika Aldaba
Lightning Talk #9: How UX and Data Storytelling Can Shape Policy by Mika Aldabaux singapore
 
Succession “Losers”: What Happens to Executives Passed Over for the CEO Job?
Succession “Losers”: What Happens to Executives Passed Over for the CEO Job? Succession “Losers”: What Happens to Executives Passed Over for the CEO Job?
Succession “Losers”: What Happens to Executives Passed Over for the CEO Job? Stanford GSB Corporate Governance Research Initiative
 
SEO: Getting Personal
SEO: Getting PersonalSEO: Getting Personal
SEO: Getting PersonalKirsty Hulse
 
The Six Highest Performing B2B Blog Post Formats
The Six Highest Performing B2B Blog Post FormatsThe Six Highest Performing B2B Blog Post Formats
The Six Highest Performing B2B Blog Post FormatsBarry Feldman
 
The Outcome Economy
The Outcome EconomyThe Outcome Economy
The Outcome EconomyHelge Tennø
 
Jurczyk windows kernel reference count vulnerabilities. case study
Jurczyk windows kernel reference count vulnerabilities. case studyJurczyk windows kernel reference count vulnerabilities. case study
Jurczyk windows kernel reference count vulnerabilities. case studyDefconRussia
 
Beyond PHP - it's not (just) about the code
Beyond PHP - it's not (just) about the codeBeyond PHP - it's not (just) about the code
Beyond PHP - it's not (just) about the codeWim Godden
 
Object Oriented Exploitation: New techniques in Windows mitigation bypass
Object Oriented Exploitation: New techniques in Windows mitigation bypassObject Oriented Exploitation: New techniques in Windows mitigation bypass
Object Oriented Exploitation: New techniques in Windows mitigation bypassSam Thomas
 
Beyond php - it's not (just) about the code
Beyond php - it's not (just) about the codeBeyond php - it's not (just) about the code
Beyond php - it's not (just) about the codeWim Godden
 
Reverse eningeering
Reverse eningeeringReverse eningeering
Reverse eningeeringKent Huang
 
Beyond php - it's not (just) about the code
Beyond php - it's not (just) about the codeBeyond php - it's not (just) about the code
Beyond php - it's not (just) about the codeWim Godden
 
Beyond php - it's not (just) about the code
Beyond php - it's not (just) about the codeBeyond php - it's not (just) about the code
Beyond php - it's not (just) about the codeWim Godden
 
JavaFX - Next Generation Java UI
JavaFX - Next Generation Java UIJavaFX - Next Generation Java UI
JavaFX - Next Generation Java UIYoav Aharoni
 
Memory Corruption: from sandbox to SMM
Memory Corruption: from sandbox to SMMMemory Corruption: from sandbox to SMM
Memory Corruption: from sandbox to SMMPositive Hack Days
 
Vhdl lab manual
Vhdl lab manualVhdl lab manual
Vhdl lab manualMukul Mohal
 
International Burmese democratic forces and friends of Burma who
International Burmese democratic forces and friends of Burma who International Burmese democratic forces and friends of Burma who
International Burmese democratic forces and friends of Burma who Burma Democratic Concern (BDC)
 
Mobile Security Assessment: 101
Mobile Security Assessment: 101Mobile Security Assessment: 101
Mobile Security Assessment: 101wireharbor
 
Beyond php it's not (just) about the code
Beyond php it's not (just) about the codeBeyond php it's not (just) about the code
Beyond php it's not (just) about the codeWim Godden
 
Zeronights 2016 - Automating iOS blackbox security scanning
Zeronights 2016 - Automating iOS blackbox security scanningZeronights 2016 - Automating iOS blackbox security scanning
Zeronights 2016 - Automating iOS blackbox security scanningSynack
 
ZeroNights: Automating iOS blackbox security scanning
ZeroNights: Automating iOS blackbox security scanningZeroNights: Automating iOS blackbox security scanning
ZeroNights: Automating iOS blackbox security scanningMikhail Sosonkin
 
Python na Infraestrutura 
MySQL do Facebook

Python na Infraestrutura 
MySQL do Facebook
Python na Infraestrutura 
MySQL do Facebook

Python na Infraestrutura 
MySQL do Facebook
Artur Rodrigues
 
Cisco IOS shellcode: All-in-one
Cisco IOS shellcode: All-in-oneCisco IOS shellcode: All-in-one
Cisco IOS shellcode: All-in-oneDefconRussia
 
The Departed: Exploit Next Generation® – The Philosophy
The Departed: Exploit Next Generation® – The PhilosophyThe Departed: Exploit Next Generation® – The Philosophy
The Departed: Exploit Next Generation® – The PhilosophyNelson Brito
 
embedded C.pptx
embedded C.pptxembedded C.pptx
embedded C.pptxmohammedahmed539376
 
Reverse engineering20151112
Reverse engineering20151112Reverse engineering20151112
Reverse engineering20151112Bordeaux I
 
E-Vehicle_Hacking_by_Parul Sharma_null_owasp.pptx
E-Vehicle_Hacking_by_Parul Sharma_null_owasp.pptxE-Vehicle_Hacking_by_Parul Sharma_null_owasp.pptx
E-Vehicle_Hacking_by_Parul Sharma_null_owasp.pptxnull - The Open Security Community
 
Designing IA for AI - Information Architecture Conference 2024
Designing IA for AI - Information Architecture Conference 2024Designing IA for AI - Information Architecture Conference 2024
Designing IA for AI - Information Architecture Conference 2024Enterprise Knowledge
 

Contenu connexe

Similaire à 201403 microsoft mvp com camp 2014-한주성

Jurczyk windows kernel reference count vulnerabilities. case study
Jurczyk windows kernel reference count vulnerabilities. case studyJurczyk windows kernel reference count vulnerabilities. case study
Jurczyk windows kernel reference count vulnerabilities. case studyDefconRussia
 
Beyond PHP - it's not (just) about the code
Beyond PHP - it's not (just) about the codeBeyond PHP - it's not (just) about the code
Beyond PHP - it's not (just) about the codeWim Godden
 
Object Oriented Exploitation: New techniques in Windows mitigation bypass
Object Oriented Exploitation: New techniques in Windows mitigation bypassObject Oriented Exploitation: New techniques in Windows mitigation bypass
Object Oriented Exploitation: New techniques in Windows mitigation bypassSam Thomas
 
Beyond php - it's not (just) about the code
Beyond php - it's not (just) about the codeBeyond php - it's not (just) about the code
Beyond php - it's not (just) about the codeWim Godden
 
Reverse eningeering
Reverse eningeeringReverse eningeering
Reverse eningeeringKent Huang
 
Beyond php - it's not (just) about the code
Beyond php - it's not (just) about the codeBeyond php - it's not (just) about the code
Beyond php - it's not (just) about the codeWim Godden
 
Beyond php - it's not (just) about the code
Beyond php - it's not (just) about the codeBeyond php - it's not (just) about the code
Beyond php - it's not (just) about the codeWim Godden
 
JavaFX - Next Generation Java UI
JavaFX - Next Generation Java UIJavaFX - Next Generation Java UI
JavaFX - Next Generation Java UIYoav Aharoni
 
Memory Corruption: from sandbox to SMM
Memory Corruption: from sandbox to SMMMemory Corruption: from sandbox to SMM
Memory Corruption: from sandbox to SMMPositive Hack Days
 
International Burmese democratic forces and friends of Burma who
International Burmese democratic forces and friends of Burma who International Burmese democratic forces and friends of Burma who
International Burmese democratic forces and friends of Burma who Burma Democratic Concern (BDC)
 
Mobile Security Assessment: 101
Mobile Security Assessment: 101Mobile Security Assessment: 101
Mobile Security Assessment: 101wireharbor
 
Beyond php it's not (just) about the code
Beyond php it's not (just) about the codeBeyond php it's not (just) about the code
Beyond php it's not (just) about the codeWim Godden
 
Zeronights 2016 - Automating iOS blackbox security scanning
Zeronights 2016 - Automating iOS blackbox security scanningZeronights 2016 - Automating iOS blackbox security scanning
Zeronights 2016 - Automating iOS blackbox security scanningSynack
 
ZeroNights: Automating iOS blackbox security scanning
ZeroNights: Automating iOS blackbox security scanningZeroNights: Automating iOS blackbox security scanning
ZeroNights: Automating iOS blackbox security scanningMikhail Sosonkin
 
Python na Infraestrutura 
MySQL do Facebook

Python na Infraestrutura 
MySQL do Facebook
Python na Infraestrutura 
MySQL do Facebook

Python na Infraestrutura 
MySQL do Facebook
Artur Rodrigues
 
Cisco IOS shellcode: All-in-one
Cisco IOS shellcode: All-in-oneCisco IOS shellcode: All-in-one
Cisco IOS shellcode: All-in-oneDefconRussia
 
The Departed: Exploit Next Generation® – The Philosophy
The Departed: Exploit Next Generation® – The PhilosophyThe Departed: Exploit Next Generation® – The Philosophy
The Departed: Exploit Next Generation® – The PhilosophyNelson Brito
 
Reverse engineering20151112
Reverse engineering20151112Reverse engineering20151112
Reverse engineering20151112Bordeaux I
 

Similaire à 201403 microsoft mvp com camp 2014-한주성 (20)

Jurczyk windows kernel reference count vulnerabilities. case study
Jurczyk windows kernel reference count vulnerabilities. case studyJurczyk windows kernel reference count vulnerabilities. case study
Jurczyk windows kernel reference count vulnerabilities. case study
 
Beyond PHP - it's not (just) about the code
Beyond PHP - it's not (just) about the codeBeyond PHP - it's not (just) about the code
Beyond PHP - it's not (just) about the code
 
Object Oriented Exploitation: New techniques in Windows mitigation bypass
Object Oriented Exploitation: New techniques in Windows mitigation bypassObject Oriented Exploitation: New techniques in Windows mitigation bypass
Object Oriented Exploitation: New techniques in Windows mitigation bypass
 
Beyond php - it's not (just) about the code
Beyond php - it's not (just) about the codeBeyond php - it's not (just) about the code
Beyond php - it's not (just) about the code
 
Reverse eningeering
Reverse eningeeringReverse eningeering
Reverse eningeering
 
Beyond php - it's not (just) about the code
Beyond php - it's not (just) about the codeBeyond php - it's not (just) about the code
Beyond php - it's not (just) about the code
 
Beyond php - it's not (just) about the code
Beyond php - it's not (just) about the codeBeyond php - it's not (just) about the code
Beyond php - it's not (just) about the code
 
JavaFX - Next Generation Java UI
JavaFX - Next Generation Java UIJavaFX - Next Generation Java UI
JavaFX - Next Generation Java UI
 
Memory Corruption: from sandbox to SMM
Memory Corruption: from sandbox to SMMMemory Corruption: from sandbox to SMM
Memory Corruption: from sandbox to SMM
 
Vhdl lab manual
Vhdl lab manualVhdl lab manual
Vhdl lab manual
 
International Burmese democratic forces and friends of Burma who
International Burmese democratic forces and friends of Burma who International Burmese democratic forces and friends of Burma who
International Burmese democratic forces and friends of Burma who
 
Mobile Security Assessment: 101
Mobile Security Assessment: 101Mobile Security Assessment: 101
Mobile Security Assessment: 101
 
Beyond php it's not (just) about the code
Beyond php it's not (just) about the codeBeyond php it's not (just) about the code
Beyond php it's not (just) about the code
 
Zeronights 2016 - Automating iOS blackbox security scanning
Zeronights 2016 - Automating iOS blackbox security scanningZeronights 2016 - Automating iOS blackbox security scanning
Zeronights 2016 - Automating iOS blackbox security scanning
 
ZeroNights: Automating iOS blackbox security scanning
ZeroNights: Automating iOS blackbox security scanningZeroNights: Automating iOS blackbox security scanning
ZeroNights: Automating iOS blackbox security scanning
 
Python na Infraestrutura 
MySQL do Facebook

Python na Infraestrutura 
MySQL do Facebook
Python na Infraestrutura 
MySQL do Facebook

Python na Infraestrutura 
MySQL do Facebook

 
Cisco IOS shellcode: All-in-one
Cisco IOS shellcode: All-in-oneCisco IOS shellcode: All-in-one
Cisco IOS shellcode: All-in-one
 
The Departed: Exploit Next Generation® – The Philosophy
The Departed: Exploit Next Generation® – The PhilosophyThe Departed: Exploit Next Generation® – The Philosophy
The Departed: Exploit Next Generation® – The Philosophy
 
embedded C.pptx
embedded C.pptxembedded C.pptx
embedded C.pptx
 
Reverse engineering20151112
Reverse engineering20151112Reverse engineering20151112
Reverse engineering20151112
 

Dernier

Designing IA for AI - Information Architecture Conference 2024
Designing IA for AI - Information Architecture Conference 2024Designing IA for AI - Information Architecture Conference 2024
Designing IA for AI - Information Architecture Conference 2024Enterprise Knowledge
 
Unraveling Multimodality with Large Language Models.pdf
Unraveling Multimodality with Large Language Models.pdfUnraveling Multimodality with Large Language Models.pdf
Unraveling Multimodality with Large Language Models.pdfAlex Barbosa Coqueiro
 
"Federated learning: out of reach no matter how close",Oleksandr Lapshyn
"Federated learning: out of reach no matter how close",Oleksandr Lapshyn"Federated learning: out of reach no matter how close",Oleksandr Lapshyn
"Federated learning: out of reach no matter how close",Oleksandr LapshynFwdays
 
Artificial intelligence in cctv survelliance.pptx
Artificial intelligence in cctv survelliance.pptxArtificial intelligence in cctv survelliance.pptx
Artificial intelligence in cctv survelliance.pptxhariprasad279825
 
WordPress Websites for Engineers: Elevate Your Brand
WordPress Websites for Engineers: Elevate Your BrandWordPress Websites for Engineers: Elevate Your Brand
WordPress Websites for Engineers: Elevate Your Brandgvaughan
 
Vertex AI Gemini Prompt Engineering Tips
Vertex AI Gemini Prompt Engineering TipsVertex AI Gemini Prompt Engineering Tips
Vertex AI Gemini Prompt Engineering TipsMiki Katsuragi
 
AI as an Interface for Commercial Buildings
AI as an Interface for Commercial BuildingsAI as an Interface for Commercial Buildings
AI as an Interface for Commercial BuildingsMemoori
 
Commit 2024 - Secret Management made easy
Commit 2024 - Secret Management made easyCommit 2024 - Secret Management made easy
Commit 2024 - Secret Management made easyAlfredo García Lavilla
 
Story boards and shot lists for my a level piece
Story boards and shot lists for my a level pieceStory boards and shot lists for my a level piece
Story boards and shot lists for my a level piececharlottematthew16
 
Advanced Test Driven-Development @ php[tek] 2024
Advanced Test Driven-Development @ php[tek] 2024Advanced Test Driven-Development @ php[tek] 2024
Advanced Test Driven-Development @ php[tek] 2024Scott Keck-Warren
 
"LLMs for Python Engineers: Advanced Data Analysis and Semantic Kernel",Oleks...
"LLMs for Python Engineers: Advanced Data Analysis and Semantic Kernel",Oleks..."LLMs for Python Engineers: Advanced Data Analysis and Semantic Kernel",Oleks...
"LLMs for Python Engineers: Advanced Data Analysis and Semantic Kernel",Oleks...Fwdays
 
Scanning the Internet for External Cloud Exposures via SSL Certs
Scanning the Internet for External Cloud Exposures via SSL CertsScanning the Internet for External Cloud Exposures via SSL Certs
Scanning the Internet for External Cloud Exposures via SSL CertsRizwan Syed
 
Install Stable Diffusion in windows machine
Install Stable Diffusion in windows machineInstall Stable Diffusion in windows machine
Install Stable Diffusion in windows machinePadma Pradeep
 
Training state-of-the-art general text embedding
Training state-of-the-art general text embeddingTraining state-of-the-art general text embedding
Training state-of-the-art general text embeddingZilliz
 
Nell’iperspazio con Rocket: il Framework Web di Rust!
Nell’iperspazio con Rocket: il Framework Web di Rust!Nell’iperspazio con Rocket: il Framework Web di Rust!
Nell’iperspazio con Rocket: il Framework Web di Rust!Commit University
 
Powerpoint exploring the locations used in television show Time Clash
Powerpoint exploring the locations used in television show Time ClashPowerpoint exploring the locations used in television show Time Clash
Powerpoint exploring the locations used in television show Time Clashcharlottematthew16
 
Integration and Automation in Practice: CI/CD in Mule Integration and Automat...
Integration and Automation in Practice: CI/CD in Mule Integration and Automat...Integration and Automation in Practice: CI/CD in Mule Integration and Automat...
Integration and Automation in Practice: CI/CD in Mule Integration and Automat...Patryk Bandurski
 
Vector Databases 101 - An introduction to the world of Vector Databases
Vector Databases 101 - An introduction to the world of Vector DatabasesVector Databases 101 - An introduction to the world of Vector Databases
Vector Databases 101 - An introduction to the world of Vector DatabasesZilliz
 

Dernier (20)

E-Vehicle_Hacking_by_Parul Sharma_null_owasp.pptx
E-Vehicle_Hacking_by_Parul Sharma_null_owasp.pptxE-Vehicle_Hacking_by_Parul Sharma_null_owasp.pptx
E-Vehicle_Hacking_by_Parul Sharma_null_owasp.pptx
 
Designing IA for AI - Information Architecture Conference 2024
Designing IA for AI - Information Architecture Conference 2024Designing IA for AI - Information Architecture Conference 2024
Designing IA for AI - Information Architecture Conference 2024
 
Unraveling Multimodality with Large Language Models.pdf
Unraveling Multimodality with Large Language Models.pdfUnraveling Multimodality with Large Language Models.pdf
Unraveling Multimodality with Large Language Models.pdf
 
"Federated learning: out of reach no matter how close",Oleksandr Lapshyn
"Federated learning: out of reach no matter how close",Oleksandr Lapshyn"Federated learning: out of reach no matter how close",Oleksandr Lapshyn
"Federated learning: out of reach no matter how close",Oleksandr Lapshyn
 
Artificial intelligence in cctv survelliance.pptx
Artificial intelligence in cctv survelliance.pptxArtificial intelligence in cctv survelliance.pptx
Artificial intelligence in cctv survelliance.pptx
 
DMCC Future of Trade Web3 - Special Edition
DMCC Future of Trade Web3 - Special EditionDMCC Future of Trade Web3 - Special Edition
DMCC Future of Trade Web3 - Special Edition
 
WordPress Websites for Engineers: Elevate Your Brand
WordPress Websites for Engineers: Elevate Your BrandWordPress Websites for Engineers: Elevate Your Brand
WordPress Websites for Engineers: Elevate Your Brand
 
Vertex AI Gemini Prompt Engineering Tips
Vertex AI Gemini Prompt Engineering TipsVertex AI Gemini Prompt Engineering Tips
Vertex AI Gemini Prompt Engineering Tips
 
AI as an Interface for Commercial Buildings
AI as an Interface for Commercial BuildingsAI as an Interface for Commercial Buildings
AI as an Interface for Commercial Buildings
 
Commit 2024 - Secret Management made easy
Commit 2024 - Secret Management made easyCommit 2024 - Secret Management made easy
Commit 2024 - Secret Management made easy
 
Story boards and shot lists for my a level piece
Story boards and shot lists for my a level pieceStory boards and shot lists for my a level piece
Story boards and shot lists for my a level piece
 
Advanced Test Driven-Development @ php[tek] 2024
Advanced Test Driven-Development @ php[tek] 2024Advanced Test Driven-Development @ php[tek] 2024
Advanced Test Driven-Development @ php[tek] 2024
 
"LLMs for Python Engineers: Advanced Data Analysis and Semantic Kernel",Oleks...
"LLMs for Python Engineers: Advanced Data Analysis and Semantic Kernel",Oleks..."LLMs for Python Engineers: Advanced Data Analysis and Semantic Kernel",Oleks...
"LLMs for Python Engineers: Advanced Data Analysis and Semantic Kernel",Oleks...
 
Scanning the Internet for External Cloud Exposures via SSL Certs
Scanning the Internet for External Cloud Exposures via SSL CertsScanning the Internet for External Cloud Exposures via SSL Certs
Scanning the Internet for External Cloud Exposures via SSL Certs
 
Install Stable Diffusion in windows machine
Install Stable Diffusion in windows machineInstall Stable Diffusion in windows machine
Install Stable Diffusion in windows machine
 
Training state-of-the-art general text embedding
Training state-of-the-art general text embeddingTraining state-of-the-art general text embedding
Training state-of-the-art general text embedding
 
Nell’iperspazio con Rocket: il Framework Web di Rust!
Nell’iperspazio con Rocket: il Framework Web di Rust!Nell’iperspazio con Rocket: il Framework Web di Rust!
Nell’iperspazio con Rocket: il Framework Web di Rust!
 
Powerpoint exploring the locations used in television show Time Clash
Powerpoint exploring the locations used in television show Time ClashPowerpoint exploring the locations used in television show Time Clash
Powerpoint exploring the locations used in television show Time Clash
 
Integration and Automation in Practice: CI/CD in Mule Integration and Automat...
Integration and Automation in Practice: CI/CD in Mule Integration and Automat...Integration and Automation in Practice: CI/CD in Mule Integration and Automat...
Integration and Automation in Practice: CI/CD in Mule Integration and Automat...
 
Vector Databases 101 - An introduction to the world of Vector Databases
Vector Databases 101 - An introduction to the world of Vector DatabasesVector Databases 101 - An introduction to the world of Vector Databases
Vector Databases 101 - An introduction to the world of Vector Databases
 

201403 microsoft mvp com camp 2014-한주성

  • 1.
  • 4. What is Reverse Engineering 목표 준비 분해분석 도출
  • 5. What is Reverse Engineering • Software Reverse Engineering(SRE) 소스코드나 관련 문서가 없는 프로그램에서 설계나 구현 내용을 알 아내는 작업 보안, 소프트웨어 개발(백신, 드라이버?) • Dynamic Analysis, Static Analysis 시스템 기반인지, 코드 기반인지에 따라 구분 • Why many engineer to develop Kernel Debugging? 더 빠르고 쉽게 문제를 해결 하기 위해
  • 6. What is Reverse Engineering
  • 8. View is Different 관리자 리버서 개발자 일반인 쉽게!!
  • 10. Developer • 자원 포인터!! HANDLE h = CreateFile(L"C:unicode.txt", GENERIC_WRITE, 0, NULL, CREATE_ALWAYS, 0, 0);
  • 12. Reverser • Object  Desktop Heap • EPROCESS  OBJECTTABLE = _HANDLE_TABLE • _HANDLE_TABLE  HANDEL_TABLE_ENTRY • OBJECT  _OBJECT_HEADER • _FILE_OBJECT  _PRIVATE_CACHE_MAP, _SECTION_OBJECT_POINTERS
  • 14. Reverser – Desktop heap Desktop Heap Monitor Version 8.1(dheapmon) http://www.microsoft.com/download/en/details.aspx?displaylang=en&id=17782
  • 15. Reverser – EPROCESS • lkd> dt nt!_EPROCESS 850a33d0 • ……….중략! • +0x0f0 ExceptionPortValue : 0x8624a278 • +0x0f0 ExceptionPortState : 0y000 • +0x0f4 ObjectTable : 0xadde2388 _HANDLE_TABLE • ……….중략! • lkd> dt _HANDLE_TABLE 0xadde2388 • nt!_HANDLE_TABLE • +0x000 TableCode : 0xb1e8f000 • +0x004 QuotaProcess : 0x850a33d0 _EPROCESS • ……….중략!
  • 16. Reverser – HANDLE(WIN7) • lkd> dt _HANDLE_TABLE_ENTRY 84e343d0 • nt!_HANDLE_TABLE_ENTRY • +0x000 Object : 0x84884171 Void • +0x000 ObAttributes : 0x84884171 • +0x000 InfoTable : 0x84884171 _HANDLE_TABLE_ENTRY_INFO • +0x000 Value : 0x84884171 • ----------------------------------------------- • +0x004 GrantedAccess : 0xf00ff • +0x004 GrantedAccessIndex : 0xff • +0x006 CreatorBackTraceIndex : 0xf • +0x004 NextFreeTableEntry : 0xf00ff • lkd> .formats 0x84884171 • Binary: 10000100 10001000 01000001 01110001
  • 17. Reverser – HANDLE(WIN8) • lkd> dt _HANDLE_TABLE_ENTRY ffffc000`0d45d0f0 • ntdll!_HANDLE_TABLE_ENTRY • +0x000 VolatileLowValue : 0n-2305842090310893567 • +0x000 LowValue : 0n-2305842090310893567 • +0x000 InfoTable : 0xe00000d5`f2e00001 _HANDLE_TABLE_ENTRY_INFO • +0x000 Unlocked : 0y1 • +0x000 RefCnt : 0y0000000000000000 (0) • +0x000 Attributes : 0y000 • +0x000 ObjectPointerBits : 0y11100000000000000000000011010101111100101110 (0xe00000d5f2e) lkd> dt _OBJECT_HEADER 0xe00000d5f2e0+ffff000000000000 … +0x030 Body : _QUAD lkd> dt _FILE_OBJECT 0xe00000d5f2e0+ffff000000000000+30
  • 18. Reverser • 핸들 테이블과 파일 개체의 구조
  • 19. Reverser • 파일 개체의 캐시 메모리
  • 20. Reverser • lkd> dt _SECTION_OBJECT_POINTERS 0xffffe000`03ee2768 • ntdll!_SECTION_OBJECT_POINTERS • +0x000 DataSectionObject : 0xffffe000`010ffcd0 Void • +0x008 SharedCacheMap : 0xffffe000`02e44b10 Void • +0x010 ImageSectionObject : (null) • lkd> dt nt!_SHARED_CACHE_MAP 0xffffe000`02e44b10 • +0x000 NodeTypeCode : 0n767 • +0x002 NodeByteSize : 0n520 • +0x004 OpenCount : 1 • +0x008 FileSize : _LARGE_INTEGER 0x296043 • +0x010 BcbList : _LIST_ENTRY [ 0xffffe000`02e44b20 - 0xffffe000`02e44b20 ] • +0x020 SectionSize : _LARGE_INTEGER 0x400000 • +0x028 ValidDataLength : _LARGE_INTEGER 0x0 • +0x030 ValidDataGoal : _LARGE_INTEGER 0x296043 • +0x038 InitialVacbs : [4] (null) • +0x058 Vacbs : 0xffffe000`03cdd5f0 -> (null) • lkd> dt _VACB 0xffffe000`003010f0
  • 21. Easy to way • !process • !handle • !filecache • !object • !fileobj • !ca
  • 22. Software Reverse Engineering Tech Flow 운영체제 멜웨어, 루트킷, 안티, 디버깅 침해사고, 포랜식