Thursday, July 11, 2013

[Tips] Load Symbol

Case 1. code snippet

symPath[] = "symsrv*symsrv.dll*c:\symbol*http://msdl.microsoft.com/download/symbols";
SymInitialize(hProcess, &symPath, TRUE);

BOOL WINAPI SymInitialize(
  _In_      HANDLE hProcess,
  _In_opt_  PCTSTR UserSearchPath,
  _In_      BOOL fInvadeProcess
);

http://msdn.microsoft.com/en-us/library/windows/desktop/ms681351(v=vs.85).aspx






Case 2. Using Windbg 1

[File] - [Symbol File Path ...]

enter the symbol

srv*c:\symbol*http://msdl.microsoft.com/download/symbols

Then open an executable or ...


Setting Symbol and Executable Image Paths in WinDbg

http://msdn.microsoft.com/en-us/library/windows/hardware/hh439335(v=vs.85).aspx







Case 3. Using Windbg 2

open an executable or attach ...

(d4.7f0): Break instruction exception - code 80000003 (first chance)
eax=001a1eb4 ebx=7ffdc000 ecx=00000000 edx=00000001 esi=001a1f48 edi=001a1eb4
eip=7c90120e esp=0007fb20 ebp=0007fc94 iopl=0         nv up ei pl nz na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000202
ntdll!DbgBreakPoint:
7c90120e cc              int     3
0:000> .sympath srv*c:\syms*http://msdl.microsoft.com/download/symbols
Symbol search path is: srv*c:\syms*http://msdl.microsoft.com/download/symbols
Expanded Symbol search path is: srv*c:\syms*http://msdl.microsoft.com/download/symbols
0:000> .reload /f *



심볼 설정할 때 코드로 짜기도 하고 windbg 로 설정하기도 한다.
상황에 맞게 적절히 사용~

Friday, July 5, 2013

[Threat] Android Defender


SymantecAndroid.Fakedefender
https://www.virustotal.com/en/file/bc4ce565800614fa46907781da8ea3272c87ee9131f5b4dd273a3c9c86ab8c35/analysis/


Permissions





Activate Device Administrator
- Erase all data
- Change the screen-unlock password
- Set password rules
- Monitor screen-unlock attempts
- Lock the screen


 
 
 
안드로이드용 악성코드 중 재미있는 가짜백신이 발견되었는데
랜섬웨어(ransomware)이며 조치가 까다롭다.
 

Tuesday, June 25, 2013

[DEV] [TIP] Visual Studio :: Character set error




error C2664: '_stricmp' : cannot convert parameter 1 from 'LPCTSTR' to 'const char *'


This error is caused by Character set. The default character value is "Unicode" running VS 2005 or later

To solve this, change the "character set" field to multibyte

=> project property -> property -> configuration property




비주얼 스튜디오 컴파일할 때 문자열 셋팅 때문에 에러가 나는 경우가 있다.
2005 이상부터는 unicode 문자열로 셋팅되어 있어서 멀티바이트로 셋팅해 주어야
컴파일이 된다.

Thursday, May 30, 2013

MS13-034 [CVE- 2013-1347]

http://blogs.technet.com/b/msrc/archive/2013/05/03/microsoft-releases-security-advisory-2847140.aspx

http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1347

 Microsoft Internet Explorer 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that was not properly allocated or is deleted, as exploited in the wild in May 2013.

한국의 대부분 사용자들이 IE를 사용하는데 IE 취약점이라 위험성이 크고
이를 이용해 정보유출을 시도하는 케이스들이 발견되고 있으니
반드시 패치를 하시길!



Obfuscated javascript


Decoded javascript























MS IE 8 Vulnerability

Wednesday, May 29, 2013

Sunday, April 14, 2013

Kernel Memory Dump Analysis

windbg로 커널 메모리 덤프를 분석해야 할 때...

Kernel memory dumps are located in %systemroot%\MEMORY.DMP
(%systemroot%\minidump)

1. Open the MEMORY.DMP file using Windbg.

(Symbol setting : SRV*c:\[path]*http://msdl.microsoft.com/download/symbols)

2. Enter '!analyze -v' without quotes to get detailed debugging information.

KERNEL_DATA_INPAGE_ERROR (7a)
The requested page of kernel data could not be read in. Typically caused by
a bad block in the paging file or disk controller error. Also see
KERNEL_STACK_INPAGE_ERROR.


...

 
SYMBOL_NAME: volmgrx!VMX_NOTIFICATION_QUEUE::CompleteTaskNotifications+42
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: volmgrx
IMAGE_NAME: volmgrx.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 49e01efd
FAILURE_BUCKET_ID: 0x7a_c000000e_volmgrx!


3. What process was calling volmgrx.sys?
kd> !thread

THREAD 9b75f2b0 Cid 18e4.1754 Teb: 7ffdb000 Win32Thread: ffb9f540 RUNNING on processor 1
IRP List:
872f9290: (0006,01d8) Flags: 00060000 Mdl: 00000000
Not impersonating
DeviceMap 8d405780
Owning Process 8abb30e0 Image: vds.exe
Attached Process N/A Image: N/A
Wait Start TickCount 153296998 Ticks: 0
Context Switch Count 205
UserTime 00:00:00.000
KernelTime 00:00:00.171
Win32 Start Address 0x76c70148
Stack Init 8c315000 Current 8c314978 Base 8c315000 Limit 8c312000 Call 0
Priority 10 BasePriority 8 PriorityDecrement 0 IoPriority 2 PagePriority 5
...

4. Confirm that vds.exe process called the volmgrx.sys...
kd> !process 8abb30e0 0

PROCESS 8abb30e0 SessionId: 0 Cid: 18e4 Peb: 7ffd6000 ParentCid: 0294
DirBase: bff34bc0 ObjectTable: 9a5556f0 HandleCount: 193.
Image: vds.exe
...

Monday, March 11, 2013

RuCTF 2013 quals - Forensic 100


task.docx

--------------------------------------------------------------------------------------
Hi, kid!

That 8-symbol password, we were talking about recently, is exactly the same as the text on the T-shirt of that guy.
--------------------------------------------------------------------------------------



First let'ts  scan the extracted OLE structures. Then you can see two image files although there is only one image in task.docx.



Finally, just take the image2.jpg to solve this challenge~.