Tuesday, July 23, 2013

Create an image file and Autopsy...

If you want to get a hard image attaced to the slave, do as follows:

dd if=\\?\Device\Harddisk1\Partition0 of=IMAGE001.img bs=512

Load the image file by Autopsy.

Analyze the image~









슬레이브로 붙인 하드 이미지를 뜨고 싶으면 아래와 같이 하면 된다.

dd if=\\?\Device\Harddisk1\Partition0 of=IMAGE001.img bs=512

그럼 이 이미지 파일을 오토시(autopsy)에 불러들여
포렌식 분석을 하시면 된다.


 

Thursday, July 11, 2013

[Tips] Load Symbol

Case 1. code snippet

symPath[] = "symsrv*symsrv.dll*c:\symbol*http://msdl.microsoft.com/download/symbols";
SymInitialize(hProcess, &symPath, TRUE);

BOOL WINAPI SymInitialize(
  _In_      HANDLE hProcess,
  _In_opt_  PCTSTR UserSearchPath,
  _In_      BOOL fInvadeProcess
);

http://msdn.microsoft.com/en-us/library/windows/desktop/ms681351(v=vs.85).aspx






Case 2. Using Windbg 1

[File] - [Symbol File Path ...]

enter the symbol

srv*c:\symbol*http://msdl.microsoft.com/download/symbols

Then open an executable or ...


Setting Symbol and Executable Image Paths in WinDbg

http://msdn.microsoft.com/en-us/library/windows/hardware/hh439335(v=vs.85).aspx







Case 3. Using Windbg 2

open an executable or attach ...

(d4.7f0): Break instruction exception - code 80000003 (first chance)
eax=001a1eb4 ebx=7ffdc000 ecx=00000000 edx=00000001 esi=001a1f48 edi=001a1eb4
eip=7c90120e esp=0007fb20 ebp=0007fc94 iopl=0         nv up ei pl nz na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000202
ntdll!DbgBreakPoint:
7c90120e cc              int     3
0:000> .sympath srv*c:\syms*http://msdl.microsoft.com/download/symbols
Symbol search path is: srv*c:\syms*http://msdl.microsoft.com/download/symbols
Expanded Symbol search path is: srv*c:\syms*http://msdl.microsoft.com/download/symbols
0:000> .reload /f *



심볼 설정할 때 코드로 짜기도 하고 windbg 로 설정하기도 한다.
상황에 맞게 적절히 사용~

Friday, July 5, 2013

[Threat] Android Defender


SymantecAndroid.Fakedefender
https://www.virustotal.com/en/file/bc4ce565800614fa46907781da8ea3272c87ee9131f5b4dd273a3c9c86ab8c35/analysis/


Permissions





Activate Device Administrator
- Erase all data
- Change the screen-unlock password
- Set password rules
- Monitor screen-unlock attempts
- Lock the screen


 
 
 
안드로이드용 악성코드 중 재미있는 가짜백신이 발견되었는데
랜섬웨어(ransomware)이며 조치가 까다롭다.