Login or Register :: Home :: Search :: Your Account :: Forums :: Waraxe Advisories :: Tools :: December 3, 2024 Menu Home Logout Discussions Forums Members List IRC chat Tools Base64 coder MD5 hash CRC32 checksum ROT13 coder SHA-1 hash URL-decoder Sql Char Encoder Affiliates y3dips ITsec Md5 Cracker User Manuals AlbumNow Content Content Sections FAQ Top Info Feedback Recommend Us Search Journal Your Account User Info Welcome, Anonymous Nickname Password (Register) Membership: Latest: MichaelSnaRe New Today: 0 New Yesterday: 0 Overall: 9144 People Online: Visitors: 42 Members: 0 Total: 42 Full disclosure Microsoft Warbird and PMP security research - technical doc Access Control in Paxton Net2 software SEC Consult SA-20241127-0 :: Stored Cross-Site Scripting in Omada Identity (CVE-2024-52951) SEC Consult SA-20241125-0 :: Unlocked JTAG interface and buffer overflow in Siemens SM-2558 Protocol Element, Siemens CP-2016 & CP-2019 Re: Local Privilege Escalations in needrestart APPLE-SA-11-19-2024-5 macOS Sequoia 15.1.1 Local Privilege Escalations in needrestart APPLE-SA-11-19-2024-4 iOS 17.7.2 and iPadOS 17.7.2 APPLE-SA-11-19-2024-3 iOS 18.1.1 and iPadOS 18.1.1 APPLE-SA-11-19-2024-2 visionOS 2.1.1 APPLE-SA-11-19-2024-1 Safari 18.1.1 Reflected XSS - fronsetiav1.1 XXE OOB - fronsetiav1.1 St. Poelten UAS | Path Traversal in Korenix JetPort 5601 St. Poelten UAS | Multiple Stored Cross-Site Scripting in SEH utnserver Pro IT Security and Insecurity Portal www.waraxe.us Forum Index -> Disassembling -> Bugger The Debugger - new whitepaper View previous topic :: View next topic Bugger The Debugger - new whitepaper Posted: Tue Apr 12, 2005 12:13 pm waraxe Site admin Joined: May 11, 2004 Posts: 2407 Location: Estonia, Tartu Quote: From: Brett Moore <brett.moore_at_security-assessment.com> Date: Apr 11 2005 Bugger The Debugger - Pre Interaction Debugger Code Execution The use of debuggers to analyse malicious or otherwise unknown binaries has become a requirement for reverse engineering executables to help determine their purpose. While researchers in places such as anti-virus laboratories have always done this, with the availability of free and easy to use debuggers it has also become popular with corporate security officers and home users. One of the main purposes of a debugger is to allow the user to control the execution of a binary in such a way as to determine what instructions or commands the binary is executing. During malware analysis the user can modify what the binary is trying to execute, or prevent it all together. This paper will demonstrate methods that may be used by malware to execute code, simply by being loaded into a debugging session. The paper can be downloaded from the whitepapers section of our website. http://www.security-assessment.com Brett Moore Network Intrusion Specialist, CTO Security-Assessment.com Interesting whitepaper Posted: Tue Apr 12, 2005 12:22 pm shai-tan Valuable expert Joined: Feb 22, 2005 Posts: 477 phpBB.com could do with using some of the code checking tools..... Whats cool with a lot of pro-security tools is they can be used to find holes and exploits for sploiters and also some help the sploiters disgusie themselves when they do what they do best. (Just looking at the tool sections of their site.) _________________ Shai-tan ?In short: just say NO TO DRUGS, and maybe you won?t end up like the Hurd people.? -- Linus Torvalds Posted: Tue Apr 12, 2005 12:24 pm shai-tan Valuable expert Joined: Feb 22, 2005 Posts: 477 Also that site is run and used by a lot of New Zealanders like me. Kiwis - flightless birds lol _________________ Shai-tan ?In short: just say NO TO DRUGS, and maybe you won?t end up like the Hurd people.? -- Linus Torvalds Posted: Tue Apr 12, 2005 5:19 pm erg0t Valuable expert Joined: Apr 08, 2005 Posts: 55 Location: Uruguay I saw the paper, I think the principal problem is the use of ring-3 debuggers, all the tecniques described can be avoided using a ring-0 debugger like sice. However in mosts cases isn?t necesary because we can use disassemblers and view the code in a dead way. If somebody really needs to debug the code, first may check the file with PEiD or some other PE analizer, and check the imported funcions and librarys. In case some extrange dll was found, can be debugged apart (at least Olly can do it). I found interesting the part about Remote Dll, was pretty short but it gives a link about it. Other way to run code out of the debugger is instaling a SEH pointing to the malicious code and then producing intencionally an exception (will run out the debugger if you configue it to pass exceptions to the program). I don?t know if this metod is used in malware because I never reversed one, but I found it in many packers and comercial protections. Posted: Wed Apr 13, 2005 3:52 am shai-tan Valuable expert Joined: Feb 22, 2005 Posts: 477 I just use the Apache error logs to veiw the errors. But debuging the debug is still a bit beyond me except when it comes to debuging MySql connection errors like in phpBB. _________________ Shai-tan ?In short: just say NO TO DRUGS, and maybe you won?t end up like the Hurd people.? -- Linus Torvalds Posted: Wed Apr 13, 2005 10:05 am waraxe Site admin Joined: May 11, 2004 Posts: 2407 Location: Estonia, Tartu shai-tan wrote: I just use the Apache error logs to veiw the errors. But debuging the debug is still a bit beyond me except when it comes to debuging MySql connection errors like in phpBB. Shai-tan, wtf you are talking about This whitepaper is very far form apache and mysql... Posted: Wed Apr 13, 2005 10:13 am waraxe Site admin Joined: May 11, 2004 Posts: 2407 Location: Estonia, Tartu erg0t wrote: I saw the paper, I think the principal problem is the use of ring-3 debuggers, all the tecniques described can be avoided using a ring-0 debugger like sice. However in mosts cases isn?t necesary because we can use disassemblers and view the code in a dead way. If somebody really needs to debug the code, first may check the file with PEiD or some other PE analizer, and check the imported funcions and librarys. In case some extrange dll was found, can be debugged apart (at least Olly can do it). I found interesting the part about Remote Dll, was pretty short but it gives a link about it. Other way to run code out of the debugger is instaling a SEH pointing to the malicious code and then producing intencionally an exception (will run out the debugger if you configue it to pass exceptions to the program). I don?t know if this metod is used in malware because I never reversed one, but I found it in many packers and comercial protections. Yeah, SoftIce is best of the best in debuggers world and will help with reverse engineering in 99% cases. This exception provoking stuff - once upon a time, some years ago, i was cracking (sorry, software developers) one bitchy win32 product. It was written in Visual Basic 6, price was > $1000 in year, it was implemented some nifty licence managent system through internet, etc .... So i finally cracked it and wrote some "fake" licence server to trick the program, but anyway, thing is that in one cracking phase i bytepatched exe-file with hexedit specially for exceptions provoking. And then saw details of the execution flow, i wanted to see allready many days (by the way, that f***ing program took from me 4 weeks to crack, and needed 29 (!!!!) places in code to pacth (not mention about asprotect defeat and then crc32 fooling) Posted: Wed Apr 13, 2005 11:33 am shai-tan Valuable expert Joined: Feb 22, 2005 Posts: 477 Sorry. Many sleepless nights. That was a my first morning post. I'm not a morning person. It is quite funny though. The more I think about what I said the more I laugh I hardly even remember..... _________________ Shai-tan ?In short: just say NO TO DRUGS, and maybe you won?t end up like the Hurd people.? -- Linus Torvalds Posted: Wed Apr 13, 2005 11:37 am waraxe Site admin Joined: May 11, 2004 Posts: 2407 Location: Estonia, Tartu Ok, no problemo Posted: Wed Apr 13, 2005 11:39 am shai-tan Valuable expert Joined: Feb 22, 2005 Posts: 477 Edited in: Hey you edited too. _________________ Shai-tan ?In short: just say NO TO DRUGS, and maybe you won?t end up like the Hurd people.? -- Linus Torvalds Posted: Wed Apr 13, 2005 11:43 am waraxe Site admin Joined: May 11, 2004 Posts: 2407 Location: Estonia, Tartu I am in not in very good shape too in this morning, you know Posted: Wed Apr 13, 2005 11:48 am shai-tan Valuable expert Joined: Feb 22, 2005 Posts: 477 Yeah thats the life of a night owl..... I'm lucky because if I get pissed, I dont wake up with a hang over, But most of the time when I dont touch alcahol, I do actually wake with one. What do they call it?...... Murphy's Law or something. _________________ Shai-tan ?In short: just say NO TO DRUGS, and maybe you won?t end up like the Hurd people.? -- Linus Torvalds Posted: Wed Apr 13, 2005 7:16 pm erg0t Valuable expert Joined: Apr 08, 2005 Posts: 55 Location: Uruguay waraxe wrote: Yeah, SoftIce is best of the best in debuggers world and will help with reverse engineering in 99% cases. This exception provoking stuff - once upon a time, some years ago, i was cracking (sorry, software developers) one bitchy win32 product. It was written in Visual Basic 6, price was > $1000 in year, it was implemented some nifty licence managent system through internet, etc .... So i finally cracked it and wrote some "fake" licence server to trick the program, but anyway, thing is that in one cracking phase i bytepatched exe-file with hexedit specially for exceptions provoking. And then saw details of the execution flow, i wanted to see allready many days (by the way, that f***ing program took from me 4 weeks to crack, and needed 29 (!!!!) places in code to pacth (not mention about asprotect defeat and then crc32 fooling) Yes, and every year packers are harder, I remeber when all this type of CRC checking, file encryption, etc could be bypased using a loader, now packers create threads an all this kind of shit so is very hard to crack a packed program by hand (without unpackers). Bugger The Debugger - new whitepaper www.waraxe.us Forum Index -> Disassembling You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum All times are GMT Page 1 of 1 All Posts1 Day7 Days2 Weeks1 Month3 Months6 Months1 YearOldest FirstNewest First Select a forumSecurity Research by waraxe----------------General discussionHow to fixMetasploit relatedHash cracking requests----------------MD5 hashesAll other hashesHash related informationhttp://www.waraxe.us portal----------------SuggestionsCooperation proposalsSecurity bugs and issues in general----------------Newbies cornerSql injectionCross-site scripting aka XSSRemote file inclusionFull path disclosureShell commands injectionPhishing and Social EngineeringAll other security holesVarious software----------------PhpNukePostNukePhpBBXMB forumvBulletin BoardInvision Power Boarde107MamboJoomlaXOOPSM$ WindowsLinux worldAll other softwareCoppermine Photo GalleryProgramming languages----------------PhpMySqlPerlJavaJavascriptC and C++Visual BasicBorland Delphi and PascalPythonHTML and XMLAssemblerReverse engineering----------------Newbies cornerDisassemblingPHP script decode requestsMiscellaneous stuff----------------Future of the ITNanotechnologyFun cornerLinksTry2hack sitesProxy databaseDirect Downloads----------------ToolsTutorialsWordlistsRecycle Bin----------------Removed messagesOutdated posts Powered by phpBB © 2001-2008 phpBB Group

Space Raider game for Android, free download - Space Raider gameplay video - Zone Raider mobile games
All logos and trademarks in this site are property of their respective owner. The comments and posts are property of their posters, all the rest (c) 2004-2024 Janek Vind "waraxe"
Page Generation: 0.050 Seconds