CreateMutex
까보면 다나와~
유용한 지식 자료들 (89)

Win32 Thread Information Block (TIB), TEB

Position Length Windows Versions Description
FS:[0x00] 4 Win9x and NT Current Structured Exception Handling (SEH) frame
FS:[0x04] 4 Win9x and NT Top of stack
FS:[0x08] 4 Win9x and NT Current bottom of stack
FS:[0x0C] 4 Unknown - TIB Subsystem?
FS:[0x10] 4 NT Fiber data
FS:[0x14] 4 Win9x and NT Arbitrary data slot
FS:[0x18] 4 Win9x and NT Linear address of TIB
---- End of NT subsystem independent part ----
FS:[0x1C] 4 NT Environment Pointer
FS:[0x20] 4 NT Process ID
FS:[0x24] 4 NT Current thread ID
FS:[0x28] 4 NT Active RPC Handle
FS:[0x2C] 4 Win9x and NT Linear address of the thread-local storage array
FS:[0x30] 4 NT Linear address of Process Environment Block (PEB)
FS:[0x34] 4 NT Last error number
FS:[0x38] 4 NT Count of owned critical sections
FS:[0x3C] 4 NT Address of CSR Client Thread
FS:[0x40] 4 NT Win32 Thread Information

~

FS:[0xF28] 4 NT Thread error mode (RtlSetThreadErrorMode)

http://en.wikipedia.org/wiki/Win32_Thread_Information_Block

 

FS레지스터에 관한 정보,, 빨간색 글자가 많이 쓰임.

 

'유용한 지식 자료들 > 기타' 카테고리의 다른 글

PEB structure  (0) 2012.08.09
TEB structure  (0) 2012.08.09
64비트 인지 아닌지 확인하기  (0) 2012.07.18
Clustering VS Classification  (0) 2012.06.27
Aho Corasick String Matching in Python  (0) 2012.05.17
  Comments,     Trackbacks

ntdll.bsearch

악성코드가 사용하는 꼼수.

 

 

  Comments,     Trackbacks

IRP Dispatch routines

[00] IRP_MJ_CREATE
[01] IRP_MJ_CREATE_NAMED_PIPE
[02] IRP_MJ_CLOSE
[03] IRP_MJ_READ
[04] IRP_MJ_WRITE
[05] IRP_MJ_QUERY_INFORMATION
[06] IRP_MJ_SET_INFORMATION
[07] IRP_MJ_QUERY_EA
[08] IRP_MJ_SET_EA
[09] IRP_MJ_FLUSH_BUFFERS

[0a] IRP_MJ_QUERY_VOLUME_INFORMATION

[0b] IRP_MJ_SET_VOLUME_INFORMATION

[0c] IRP_MJ_DIRECTORY_CONTROL
[0d] IRP_MJ_FILE_SYSTEM_CONTROL
[0e] IRP_MJ_DEVICE_CONTROL #14번, 많이 쓰임
[0f] IRP_MJ_INTERNAL_DEVICE_CONTROL
[10] IRP_MJ_SHUTDOWN
[11] IRP_MJ_LOCK_CONTROL
[12] IRP_MJ_CLEANUP
[13] IRP_MJ_CREATE_MAILSLOT
[14] IRP_MJ_QUERY_SECURITY
[15] IRP_MJ_SET_SECURITY
[16] IRP_MJ_POWER
[17] IRP_MJ_SYSTEM_CONTROL
[18] IRP_MJ_DEVICE_CHANGE
[19] IRP_MJ_QUERY_QUOTA
[1a] IRP_MJ_SET_QUOTA
[1b] IRP_MJ_PNP

  Comments,     Trackbacks

64비트 인지 아닌지 확인하기

http://blog.naver.com/PostView.nhn?blogId=denoil&logNo=30043054121

'유용한 지식 자료들 > 기타' 카테고리의 다른 글

TEB structure  (0) 2012.08.09
Win32 Thread Information Block (TIB), TEB  (0) 2012.08.08
Clustering VS Classification  (0) 2012.06.27
Aho Corasick String Matching in Python  (0) 2012.05.17
리눅스에서 SSD  (0) 2012.05.15
  Comments,     Trackbacks

인터넷에 관련한 레지스트리 설정 정보

Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3

위의 PATH에서 Zone이란 IE 인터넷 옵션에서 보안 탭에 있는 

인터넷, 인트라넷, 신뢰할 수 있는 사이트, 제한된 사이트를 대상으로 한다.

3이면 평상시 사용하는 인터넷을 말하는 거.

Value Setting

------------------------------

0    My Computer

1    Local Intranet Zone

2    Trusted sites Zone

3    Internet Zone

4    Restricted Sites Zone

그리고 하위 키들은 각정 보안 설정을 할 수 있는 값들이 지정 되어 있는데 

http://support.microsoft.com/kb/182569

위의 MS 사이트에 각 숫자 키 마다 어떤 의미가 있는 지 확인 할 수 있겠다.

한글 보다는 영어 원문으로 보는게 더 직관적임


Zone 3번에 접근해서 하위키 무언가를 수정한다면 대부분 악성행위로 간주해도 되지 않을 까


다음은 다른 참고 사이트

http://seleucos.tistory.com/1041


'유용한 지식 자료들 > 레지스트리' 카테고리의 다른 글

Active Setup이란  (0) 2012.08.28
윈7 레지스트리 정보  (0) 2011.09.06
MUICache 레지스트리  (0) 2011.04.15
Explorer 레지스터를 활용한 악성코드  (0) 2010.05.11
  Comments,     Trackbacks

안드로이드 APK 파일 디컴파일

http://blog.naver.com/alrogia?Redirect=Log&logNo=70128122955

  Comments,     Trackbacks

SDT 후킹의 창과 방패에 대해 쉽게 설명한 글

http://www.imaso.co.kr/?doc=bbs/gnuboard.php&bo_table=article&wr_id=32168


아래는 커널 정보를 알아오는 코드 잘 설명한 글

http://blog.naver.com/PostView.nhn?blogId=autolee2&logNo=110090433672

  Comments,     Trackbacks

Clustering VS Classification

CLUSTERING

- Data is not labeled

- Group points that are "close" to each other

- Identify structure or patterns in data

- Unsupervised learning


CLASSIFICATION

- Labeled data points

- Want a "rule" that assigns labels to new points

- Supervised learning





군집화/분류화 그런 차이? 


  Comments,     Trackbacks

Security Service Disable

Look For Disabled Services
Below are some services the worm disables, if any of these are disabled that you did not disable yourself – you could be infected:

 

wscsvc – Security Center
WinDefend Windows Defender (available in Vista)
wuauserv – Automatic Updates
BITS – Background Intelligent Transfer Service
ERSvc – Error Reporting Service
WerSvc – Windows Error Reporting Service (available in Vista)


Removed Restore Points
The worm removes all system restore points. If you have no system restore points, you may be infected.

 

Removal of Windows Security Center
If the following registry entry is missing, you could be infected: HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\ShellServiceObjects\{FD6905CE-952F-41F1-9A6F-135D9C6622CC}

 

conficker 분석하다가.

  Comments,     Trackbacks

Aho Corasick String Matching in Python

Aho Corasick String Matching in Python

from collections import deque
class State:
    sid = None        ## store the id of state
    value = None      ## stores values of state
    tranList = None    ## used to store the list of next states for transition
    outputSet = None    ## it is set datastructure for storing the outputs at that state
    failState = None

    def __init__(self ,sid, val):
        self.sid = sid
        self.value = val
        self.tranList = []
        self.failState = 0
        self.outputSet = set()

    def getTransition(self, val):
        """ this function gets the next state on input val"""
        for node in self.tranList:
            if node.value == val:
                return node
        return None
   

    def testTransition(self, val):
        """ This checks whether there is transition or not on input val"""
        """ for current state, the transition is always true on any input"""

        if self.sid == 0:    
           return True
        else:
            for nd in self.tranList:
                if nd.value == val:
                    return True
            return False
       
    def addOutput(self, key):
        """This adds the key to the output in the state"""
        self.outputSet = self.outputSet ^ key
       
         
    ##------------------------------------------------------------------------
   

class ahoCorasick:
    root = None
    newstate = None

    def __init__(self):
        self.root = State(0, ' ')
        self.newstate = 0

    def addKeyword(self, keywords):
        """Adds the keyword in the tree"""
   
        for key in keywords.split(' '):
           
            j = 0
            state = 0
            current = self.root
            key = key.upper()

            while j < len(key):
                ch = key[j]
                j = j+ 1
                child = current.getTransition(ch)
                if child != None:
                    current = child
                else:
                    self.newstate = self.newstate +1
                    nd = State(self.newstate, ch)
                    current.tranList.append(nd)
                    current = nd
                    while j < len(key):
                        self.newstate = self.newstate +1
                        nd2 = State(self.newstate, key[j])
                        current.tranList.append(nd2)
                        current = nd2
                        j = j+1
                    break
            current.outputSet.add(key)
       
##-------------------------------------------------------------------
    def setFailTransitions(self):
        """Sets the fail transitions in tree"""
        queue = deque()
        current = self.root
        child = self.root

        for nd in self.root.tranList:
            queue.append(nd)
            nd.failState = self.root

        while len(queue) != 0:
            r = queue.popleft()
            for nd in r.tranList:
                queue.append(nd)
                state = r.failState
                val = nd.value
                current = state
                while True:
                    if current.testTransition(val) == False:
                        current = current.failState
                    else:
                        break
                child = current.getTransition(val)
                if child == None:
                    nd.failState = current
                else:
                    nd.failState = child
            nd.addOutput(nd.failState.outputSet)

##--------------------------------------------------------------------------------------------------
    def findSubstrings(self, findStr):
        """ Finds all substrings of input which are keywords in the tree"""
        for string in findStr.split(' '):
            string = string.upper()
            print "Finding substrings in ", string
            current = self.root
            j = 0
       
            while j < len(string):
                while True:
                    if current.testTransition(string[j]) == False:
                        current = current.failState
                    else:
                        child = current.getTransition(string[j])
##                      print "before break", child.sid
                        break
                if child != None:
##                  print "in none"
                    current = child
                    if len(child.outputSet) != 0:
                        print j
                        itr = iter(child.outputSet)
                        for keyw in itr:
                            print keyw
                j = j + 1   
                   
   
##---------------------------------------------------------
    def displayTree(self):
        """ It is used to display the tree of keywords. Prints ID of node and value of node"""
        queue = deque()
        for nd in self.root.tranList:
            queue.append(nd)

        while len(queue) !=0:
            node = queue.popleft()
            for nd in node.tranList:
                queue.append(nd)
            print node.sid, node.value
           
               
    def displayOutput(self):
        """ This function displays the outputs at a state"""
        queue = deque()
        for nd in self.root.tranList:
            queue.append(nd)

        while len(queue) !=0:
            node = queue.popleft()
            for nd in node.tranList:
                queue.append(nd)
           
            itr = iter(node.outputSet)
            if len(node.outputSet) !=0:
                print node.sid
            for string in itr:
                print string

if (__name__ == "__main__"):
   
    x = ahoCorasick()
    """ Usage: Create object of ahoCorasick
        to enter keywords use addKeyword("string of keywords")
        then call setFailTransitions (fail function)
        to find substrings of string use findSubstrings"""

##    x.addKeyword("he")
##    x.addKeyword("she")
##    x.addKeyword("his")
##    x.addKeyword("hers")
   
##    x.addKeyword("ATC")
##    x.addKeyword("TC")
   
##    x.displayOutput()
   
####    x.enter("help")
####    x.enter("hi")
   
    x.addKeyword("john jane")
  
       
    x.setFailTransitions()
##    x.findSubstrings("ACGATCTCTCGATC")
    x.findSubstrings("johnjane")
  Comments,     Trackbacks