Kernel Memory Dump Analysis

windbg로 커널 메모리 덤프를 분석해야 할 때...

Kernel memory dumps are located in %systemroot%\MEMORY.DMP
(%systemroot%\minidump)

1. Open the MEMORY.DMP file using Windbg.

(Symbol setting : SRV*c:\[path]*http://msdl.microsoft.com/download/symbols)

2. Enter '!analyze -v' without quotes to get detailed debugging information.

KERNEL_DATA_INPAGE_ERROR (7a)
The requested page of kernel data could not be read in. Typically caused by
a bad block in the paging file or disk controller error. Also see
KERNEL_STACK_INPAGE_ERROR.

...

 
SYMBOL_NAME: volmgrx!VMX_NOTIFICATION_QUEUE::CompleteTaskNotifications+42
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: volmgrx
IMAGE_NAME: volmgrx.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 49e01efd
FAILURE_BUCKET_ID: 0x7a_c000000e_volmgrx!


3. What process was calling volmgrx.sys?
kd> !thread

THREAD 9b75f2b0 Cid 18e4.1754 Teb: 7ffdb000 Win32Thread: ffb9f540 RUNNING on processor 1
IRP List:
872f9290: (0006,01d8) Flags: 00060000 Mdl: 00000000
Not impersonating
DeviceMap 8d405780
Owning Process 8abb30e0 Image: vds.exe
Attached Process N/A Image: N/A
Wait Start TickCount 153296998 Ticks: 0
Context Switch Count 205
UserTime 00:00:00.000
KernelTime 00:00:00.171
Win32 Start Address 0x76c70148
Stack Init 8c315000 Current 8c314978 Base 8c315000 Limit 8c312000 Call 0
Priority 10 BasePriority 8 PriorityDecrement 0 IoPriority 2 PagePriority 5
...

4. Confirm that vds.exe process called the volmgrx.sys...
kd> !process 8abb30e0 0

PROCESS 8abb30e0 SessionId: 0 Cid: 18e4 Peb: 7ffd6000 ParentCid: 0294
DirBase: bff34bc0 ObjectTable: 9a5556f0 HandleCount: 193.
Image: vds.exe
...

RuCTF 2013 quals - Forensic 100

task.docx

--------------------------------------------------------------------------------------

Hi, kid!

That 8-symbol password, we were talking about recently, is exactly the same as the text on the T-shirt of that guy.

--------------------------------------------------------------------------------------



First let'ts  scan the extracted OLE structures. Then you can see two image files although there is only one image in task.docx.

Finally, just take the image2.jpg to solve this challenge~.

IPv6 in Wireshark

IPv6 address beginning with fe80::.. is used for local network.

http://en.wikipedia.org/wiki/IPv6_address

fe80::/10 — Addresses in the link-local prefix are only valid and unique on a single link. Within this prefix only one subnet is allocated (54 zero bits), yielding an effective format of fe80::/64. The least significant 64 bits are usually chosen as the interface hardware address constructed in modified EUI-64 format. A link-local address is required on every IPv6-enabled interface—in other words, applications may rely on the existence of a link-local address even when there is no IPv6 routing. These addresses are comparable to the auto-configuration addresses 169.254.0.0/16 of IPv4.

You will see strange packets when you open IPv6 pcap files.

Just decode it

1. Decode AS...

2. select 'Network' tap and then IPv6

3. Now we have IPv6's packet streams

 

 

[qemu #2] debugging ARM

Launch qemu..

Then connect to qemu (ARM based system) through an ssh tunnel.

ssh User@IP Address -p [port number]

 Now you can debug with gdb~

[Essay] malcolm gladwell - Outliers '10000 hours rule'

오늘 강연 중에 좋은 말들이 있어서 몇 가지 남겨두려고 한다.

#1 mannerism

많이 들어본 단어인데, 매너리즘... 매너리즘... 위키에서 정의한
매너리즘의 뜻은 아래와 같다.

Mannerism

http://en.wikipedia.org/wiki/Mannerism

그러니깐 매너리즘은 현상 유지하는 상태, 발전이 없는 상태,
, 노력도 하지 않고, 전혀 새로울 게 없는 상태...

이럴 때 우리는 "매너리즘에 빠졌다"라고 말한다.


#2  꿈..?!

George Clooney가 주연한 "Up in the Air"라는 영화,

조지 클루니가 해고 전문가로 등장하는데,
가족을 위해 헌신한 중견 간부를 해고시키는 과정에서 던진 말...

"자신의 꿈을 포기한 대가로 얼마나 벌었습니까?"

'업 인 디 에어' 요거 챙겨봐야지

#3 '10000 hours rule' by malcolm gladwell

한 3년 전쯤 읽었나,,
아직도 기억난다 이 책은,, 아마 집으로 돌아가는 버스 안에서 봤었다
뒷쪽 하차하는 문 바로 뒤에 자리에 앉아서....
이상하게도 기억이 생생하다.

'만 시간의 법칙'
하루 세 시간씩 10년을 하면 만 시간이다
일년은 8,760 시간.. 내 생각엔 매일할 수는 없으니 하루 4시간 씩,
일주일에 적어도 5일 이상은 꾸준히 해야하는 수준일 듯 하다.
이정도면 어느 분야에서건 전문가라는 소리를 듣지 않을까?

Practice makes perfect.

[qemu #1] installing on ubuntu 12.04

You can download qemu from the following URL.

http://wiki.qemu.org/Download

extract the package

$ tar -jxvf qemu-1.3.1.tar.bz2

$ tar -jxvf qemu-1.2.0.tar.bz2

* note
First, I downloaded and installed qemu-1.3.1 in Ubuntu 12.04.
It doesn't work.

 (cd /home/.../qemu-1.3.1/pixman; autoreconf -v --install)
/bin/sh: 1: autoreconf: not found
make: *** [/home/.../qemu-1.3.1/pixman/configure] Error 127

http://stackoverflow.com/questions/14814889/cant-install-qemu-1-3-1-in-ubuntu-12-10
$ sudo apt-get build-dep qemu

$ ./configure --target-list=arm-softmmu

$ make

$ make install

will be continued

codegate 2012 prequal network 100

자, 패킷 포맷을 제대로 이해했다면 이제 실전에 적용해 보자.

실전에 적용해 보기 위해 아주 좋은 예제가 있다.

코드게이트 2012년 prequal 네트워크 100 문제~

파일 이름은 10_Floor.pcap으로 명명했다.

See on the link below to refer to pcap file format.

http://n20kim.blogspot.kr/2013/02/pcap-file-format.html

Wireshark can't open the pcap file.

If you understand pcap file format, you could notice what is weird.
Yeah, right!
pcap has global header at the beginning of the pcap. :)

# recover the pcap's global header.

1.make global header to add global header to the pcap.
   To make this, I made this code. It's simple but entering line by line is a little bit annoying

import binascii
binary=binascii.unhexlify("d4c3b2a1020004000000000000000000ffff000001000000")
f=open('header.pcap','w')
f.write(binary)
f.close()

2. add global header to the pcap

But an error still occurs because of size. phew...

Fix it again!

3. Did you notice something? The problem is size... and 22nd packet is normal.
   So you can infer that 23rd packet is probably abnormal.
   22nd packet byte streams is following:

4. The last line from 0x0038 is "16 d0 e3 42 ... "
    Find that byte streams in the 10_Floor.pcap
    23rd packet starts with "3e ec 60 ..".
    Packet header has 16bytes as you know.
    You can see "GET .." instead of packet header bytes. weird...

 

 

5. The final task is removing 23rd packet. Then you can open the pcap.