14
To be a malware analyst, the minimum knowledge typically needed is:
Assembly language
Operating system internals
Deobfuscation and anti-anti-debugging techniques
Obviously, there are other useful areas of knowledge for malware analysis (like an understanding of network protocols, exploit analysis techniques, knowledge of VB P-code and JavaScript and .NET ...
12
It largely depends on what kind of vulnerability.
This particular one you mentione is in SecurityManager, and you could have found it relatively easily by analyzing the Java source code.
To get some idea of how that process is done, take a look at this and this articles by Esteban Guillardoy of Immunity.
Jduck has also published some research on memory ...
10
The shellcode is unicode escaped. You can convert it to its hex representation using a simple python script.
from binascii import unhexlify as unhx
encoded = open('encoded.txt').read() # The shellcode dump
out = open('shellcode.bin', 'wb')
for s in encoded.split('%'):
if len(s) == 5:
HI_BYTE = s[3:]
LO_BYTE = s[1:3]
out.write(...
8
Well I myself am an exploit developer. The methods of attack/research are:
Reversing the input values. Files, network protocols etc etc.
Building a Fuzzer with this information
Fuzz till crash
Analyse the crash
Build exploit
Another method I commonly use is to reverse points of interests (eg SingleSignOne modules, other login methods, database connections (...
7
The reason the you are unable to locate text1 on the program runtime stack is that during runtime text1 is in the data segment of the process running in virtual memory, not the stack. In order for a reference to text1 to be written to the stack text1 must be passed as an argument to a function which is called.
When a function is called and a new stack frame ...
6
It's a lot of questions, here are a few answers:
How can we write something in memory with a format string vulnerability ?
For this, you need to know two specific features used in the printf format string specifications. First, %n is a format specifier that has the following effect (according to the manual page):
%n The number of characters written so ...
6
Even the free version of IDA Pro is worth having. Finding the general structure of an unknown binary is much easier with it than with anything else. If you have an unknown DLL, it will show you which exports it has, and looking at the assembly code helps you guess the parameters.
In most cases, to debug a .dll, you'll want to write a small program to call ...
5
I would agree with you in that you need to implement some kind of taint tracing, what is tricky statically. Moreover, you need to know whether there are any constraints applied to your controlled values. Also, we land in the symbolic execution domain (warning, there be dragons).
Anyway, maybe this project can be helpful to you. It even has IDA Pro ...
5
The approach to finding security vulnerabilities in games is no different than the approach to finding security vulnerabilities in other applications.
As discussed here, "Most vulnerabilities in closed-source products are found via fuzzing and static reverse engineering... Typically you don't need to analyze the entire program, but only the entrypoints for ...
5
this is how a BSTR represented in memory:
Length Data string Terminator
so an attacker will try to get an aligned heapspray and then trigger a vulnerability that will modify the Length part of a BSTR, it can be:
a heap overflow.
a use after free that crashes on instructions that can modify a controlled memory address (eg AND 0xFFFFFFFF, edi) where edi is ...
4
Lots of Java exploits revolve around bypassing the Java sandbox, the Security Manager in Java parlance. Sami Koivu published a lot of interesting work around Java security and exploits, notably his 3 parts introduction to Java security.
http://slightlyrandombrokenthoughts.blogspot.ca/2009/02/java-se-security-part-i_25.html
http://...
4
When I started with Malware Analyses at some anti-virus vendor. I only had reversed a couple of aspects of video games and created a number of tools to extract graphics etc. I also knew a fair bit of malware culture etc.. Read a lot of Malware source code (vxheavens) and all that jazz.
I however, didn't know about Obfuscation, unpacking, shellcode etc. This ...
4
FROM SANS.ORG
When discussing malware analysis, There is 3 main phases of the process: behavioral analysis, code analysis and memory analysis.
Here's a brief outline of each phase:
Behavioral analysis
examines the malware specimen's interactions with its environment: the file system, the registry (if on Windows), the network, as well as other processes ...
4
WinDbg uses debugging information (pdb/symbol files) for debugging. So ,for example say I get a unknown exe (malicious) can I debug it since I'll not be having its .pdb
Yes. Symbols are one of Windbg's main strength, but it can also debug anything without symbolic information.
Is WinDbg best suited to analyze memory dumps and crash issues only?
Once ...
3
The bug is in update_volume.
pglobal_data -> radio_data.speakers_volume[index] = new_volume;
index is an int, it can take negative values too. Ideally you should not be able to access -ve indices in an array as it gives you read/write over memory area preceding the array. Here we just have a check to limit its max value to 4 but you can use negative ...
3
Hmm this code will probably not work if optimized because the shared globals are not pointers nor are they marked as volatile. This means that the compiler is free to assume the globals are accessed from one thread only so most likely the
while(!passcode)
will be optimized to always be true and therefore result in an eternal loop. Really should mark this ...
3
There are good answers to your question here. However, I wanted to give you my opinion. Root cause analysis, over all, is best done half-manually. One of the reasons is that techniques like Dynamic Taint Analysis, using SMT solvers, etc... are good tools for small or specific problems but almost unusable for whole projects + real targets, for the average ...
3
Adobe Reader uses the following two methods to determine if another instance is running:
CreateSemaphoreW(NULL, 0, 1, L"Acrobat Viewer") followed by
GetLastError() == ERROR_ALREADY_EXISTS
FindWindowW(L"Acrobat Viewer", NULL) != NULL
So as long as you hook those two functions appropriately or patch the code that performs those checks, you will be able to ...
3
The first thing that comes to my mind is for you to create a class with a few virtual methods, which will be used as the test subject. Then from your ActiveX control you'd expose methods that manipulate the variable, say:
Method #1: Allocate the test object and keep the pointer in a static variable
Method #2: Call the virtual methods provided by the test ...
2
Peach Fuzzer performs automated exploitability analysis. Though I haven't used it myself and can't say whether or not it's any better than !exploitable.
If neither Peach Fuzzer nor !exploitable meets your needs and you can't find anything else, you're best off grouping crashes by exception code and exception address (RVA if the program uses ASLR). Then if ...
2
The best thing you can do is to learn how to read assembly. Start at the crash, see what type of memory is being used, values in registers, and previous instructions. Learn how to use windbg. Taint analysis and smt solving is intended for pure binary data, it sucks for interpreters or abstract state machines. In other words, its great when the ...
2
First of all you should write script to lower the difference between your mutated(fuzzed) file and original in order to know the main byte/bytes that make program crash. This would be a byte by byte compare,change,check to make sure you have the minimal difference needed to crash the app.(It's possible that you found new crashes this way. believe me!)
...
2
First, your platform is very important ( mine is Windows )
In Windows WinDbg + !exploitable is one of fast analyze options.
it is here
Additionally I use WinDbg + !analyze to determine standard name of bug...
it is default WinDbg extension.
Finally, as the nature of bugs is unknown (in your case) it is not an easy way to detect root cause.
2
The only way to know whether you can or cannot use the USB port to have access to the device is by probing the Data pins and trying to sniff any traffic.
A USB connector is composed of 4 pins : USB Vcc (+5V), USB Data-, USB Data+, and GND. If the device is using the Data+ & Data- pins, then you're in business, something must be going on which should ...
2
It doesn't work like that.
As you might know, bugs are worth money. The main reason for tgis is at it requires both skill and time to find these bugs.
Clearly you want to learn this skill, so in the future you might be able to do this.
So, you can't just point a fuzzer at something and find bugs in A-software. You either need to write your own, statebased ...
2
Older Nokia phones use a serial (db-9) cable so if this cable supports flashing it likely includes a usb to serial converter (eg ftdi chip)
2
I guess that you won't be happy if, while analyzing a malware, a certain pattern in the executable binary makes Hex-rays connect to an evil server somewhere in the World with your account and download a payload on your system...
And, yes, there have been some examples where security analysis software have been pinpointed with security threats. The last I ...
2
A common mistake, while programming a server, is to use a fork() to start it and respawn it when it crashes.
The problem with a fork() is that is uses a copy of the memory to start over. Of course, using a copy means that the respawned server will be stuck with the exact same canaries even if it has been crashed and respawn. Somehow, it's memory layout and ...
1
Look at the place where sprintf is called and you should see the arguments being pushed in the correct order.
The variables listed here are local variables of the function manage_request and not its arguments. They're arguments of the sprintf call but the variables themselves can be placed in whatever order the compiler decides in the stack (usually, but ...
1
If there is any chip inside the cable, it will use the 5v line as power supply. So, you have to measure resistance from gnd to 5v and compare it with another cable. Usually, the resistance is so high it's undetectable by a normal tester, and this also means there's nothing more than wire and plastic inside (for sure in any normal device).
Also, make sure to ...
Only top voted, non community-wiki answers of a minimum length are eligible