![慢性代孕炎如何根治代孕糜烂 慢性代课件_第1页](http://file4.renrendoc.com/view/52b726d6461358f2c71df2905362fcd7/52b726d6461358f2c71df2905362fcd71.gif)
![慢性代孕炎如何根治代孕糜烂 慢性代课件_第2页](http://file4.renrendoc.com/view/52b726d6461358f2c71df2905362fcd7/52b726d6461358f2c71df2905362fcd72.gif)
![慢性代孕炎如何根治代孕糜烂 慢性代课件_第3页](http://file4.renrendoc.com/view/52b726d6461358f2c71df2905362fcd7/52b726d6461358f2c71df2905362fcd73.gif)
![慢性代孕炎如何根治代孕糜烂 慢性代课件_第4页](http://file4.renrendoc.com/view/52b726d6461358f2c71df2905362fcd7/52b726d6461358f2c71df2905362fcd74.gif)
![慢性代孕炎如何根治代孕糜烂 慢性代课件_第5页](http://file4.renrendoc.com/view/52b726d6461358f2c71df2905362fcd7/52b726d6461358f2c71df2905362fcd75.gif)
版权说明:本文档由用户提供并上传,收益归属内容提供方,若内容存在侵权,请进行举报或认领
文档简介
AuditingClosed-SourceSoftwareUsingreverseengineeringinasecuritycontext©2001byHalVarFlakeSpeechOutline(I):Introductiontothetopic:DifferentapproachestoauditingbinariesReviewofC/C++programmingmistakesandhowtospottheminthebinaryDemonstrationoffindingavulnerabilityinabinaryLegalconsiderationsBreakAuditingClosed-SourceSoftwareUsingreverseengineeringinasecuritycontext©2001byHalVarFlakeSpeechOutline(II):ProblemsencounteredintheOOPworldmanualstructure&classreconstructionautomatedstructure&classreconstructionautomatingtheprocessofscanningforsuspiciousconstructsFreetimetoanswerquestionsanddiscussthetopic©2001byHalVarFlakeLegalconsiderationsTechnically,thereverseengineerbreaksthelicenseagreementbetweenhimandthesoftwarevendor,asheisforcedtoacceptuponinstallationthathewillnotreverseengineertheprogram.Thevendorcouldtheoreticallysuethereverseengineerandrevokethelicense.Dependingonyourlocallaw,therearedifferentwaystodefendyoursituation:©2001byHalVarFlakeLegalconsiderations(USA)USLaw: FinalformofDMCAincludesexceptionsto copyrightfor: Reverseengineeringforinteroperability Encryptionresearch SecuritytestingOneshouldaskhislawyeriftheserightscanbecontractedaway. ©2001HalVarFlakeWhyauditbinaries?Ifyou‘reablackhat:Ifyou‘reawhitehat:Manyinterestingsystems(Firewalls)runclosed-sourcesoftwareNewsecurityvulnerabilitiesareeveryAdministratorsnightmareYoucanannoyvendorsbyfindingproblemsintheircodeYoucangetanideahowsecureaparticularapplication‘scodeis©2001byHalVarFlakeApproachA:StressTestingLongstringsofdataaremoreorlessrandomlygeneratedandsenttotheapplication,usuallytryingtooverfloweverysinglestringthatgetsparsedbyacertainprotocol.Pros: Stresstestingtoolsarere-usableforagivenprotocol Willworkautomaticallywithlittletonosupervision DonotrequirespecializedpersonneltouseCons: Theanalyzedprotocolneedstobeknowninadvance Complexproblemsinvolvingseveralconditionsatonce willbemissed Undocumentedoptionsandbackdoorswillbemissed©2001byHalVarFlakeApproachB:ManualAuditAreverseengineercarefullyreadsthedisassemblyoftheprogram,tediouslyreconstructingtheprogramflowandspottingprogrammingerrors.ThiswastheapproachJoey__demonstratedatBlackHatSingapore.Pros: EventhemostcomplexissuescanbespottedCons: Theprocessinvolvedisincrediblytime-consumingandnearlyinfeasibleforlargeapplications Ahighlyskilledandspecializedauditorisneeded Thedangerisinherentthatanauditorwillburnoutandthusmissobviousproblems©2001byHalVarFlakeSkillstheauditorneeds Agoodunderstandingofassemblylanguage andcompilerinternals GoodknowledgeofC/C++andthecoding mistakesthatleadtosecurityvulnerabilities OnlyagoodC/C++codeauditorcanbea goodbinaryauditor Lotsandlotsofendurance,patienceand time©2001byHalVarFlakestrcpy()andstrcat()Oldnews:Anycalltostrcpy()orstrcat()copyingnon-staticstringswithoutproperboundscheckingbeforehandhastobeconsidereddangerous.C/C++codeauditingrecap©2001byHalVarFlakeThe*scanf()functionfamily
Oldnews:Anycalltoanymemberofthe*scanf()functionfamilywhichusesthe„%s“formatcharacterintheformatstringtoparseuser-supplieddataintoabufferisdangerous.C/C++codeauditingrecap©2001byHalVarFlakeThestrncpy()pitfallC/C++codeauditingrecapWhilestrncpysupportssizechecking,itdoesnotguaranteeNUL-terminationofthedestinationbuffer.Soincaseswherethecodeincludessomethinglike
strncpy(destbuff,srcbuff,sizeof(destbuff));problemswillarise.©2001byHalVarFlakeThestrncpy()pitfallC/C++codeauditingrecapSourcestring\x0dataAftercopyingthesourceintoasmallerbuffer,thedestinationstringisnotproperlyterminatedanymore.Destinationstringdatawitha\x0somewhereAnysubsequentoperationswhichexpectthestringtobeterminatedwillworkonthedatabehindouroriginalstringaswell.©2001byHalVarFlakeThestrncat()pitfallAswithstrncpy(),strncat()supportssizechecking,butguaranteestheproperterminationofthestringafterthelastbytehasbeenwritten.Furthermore,thefactthatstrncat()willusuallyneedtohandlewithdynamicvaluesforlenincreasestheriskforcastscrewups.C/C++codeauditingrecap©2001byHalVarFlakeThestrncat()pitfallConsidercodelikethis: strncat(dest,src,sizeof(dest)-strlen(dest));ThiswillwriteanextraNULbehindtheendofdestifthemaximumsizeisfullyutilized.(so-calledpoison-null-byte)C/C++codeauditingrecapvoidfunc(char*dnslabel){charbuffer[256];char*indx=dnslabel;intcount;count=*indx;buffer[0]='\x00';while(count!=0&&(count+strlen(buffer))<sizeof(buffer)-1){strncat(buffer,indx,count);indx+=count;count=*indx;}}©2001byHalVarFlakeCastScrewupsC/C++codeauditingrecap©2001byHalVarFlakeFormatStringVulnerabilitiesC/C++codeauditingrecapAnycallthatpassesuser-suppliedinputdirectlytoa*printf()-familyfunctionisdangerous.ThesecallscanAlsobeidentifiedbytheirargumentdeficiency.Considerthiscode:
printf(„%s“,userdata);
printf(userdata);Argumentdeficiency©2001byHalVarFlakestrcpy()andstrcat()FindingitinthedisassemblyThiscalltargetsastackbufferThesourceisvariable,notastaticstring©2001byHalVarFlakesprintf()andvsprintf()FindingitinthedisassemblyTargetbufferisastackbufferExpandedstringsarenotstaticandnotfixedinlengthFormatstringcontaining„%s“©2001byHalVarFlakeThestrncpy()/strncat()pitfallFindingitinthedisassemblyIfthesourceislargerthan
n(4000bytes),noNULLwillbeappendedCopyingdataintoastackbufferagain...©2001byHalVarFlakeThestrncpy()/strncat()pitfallFindingitinthedisassemblyThetargetbufferisonlynbyteslong©2001byHalVarFlakeThestrncat()pitfallFindingitinthedisassemblyDangeroushandlingoflenparameter©2001byHalVarFlakeFormatStringVulnerabilitiesFindingitinthedisassemblyArgumentdeficiencyFormatstringisadynamicvariable©2001byHalVarFlakeWhygoafteriWSSHTMLagain?AnExample:iWS4.1SHTML Earlierresearchhasshownthatthe“improved“ SHTMLparsingcodehasnotbeenwrittenwith securityinmind Sinceitwaswrittenbeforethewidepublication offormatstringbugs,ithasprobablynotbeen auditedforityet Ialreadyhadtheandonmy box,disassemblytakeswaytoolong©2001byHalVarFlakeTheINTlog_error()callAnExample:iWS4.1SHTMLprintf()-likeparsingofargumentsMinimumstackcorrectionforadynamicformatstringis0x1C–4=0x18©2001byHalVarFlakeAsuspiciousconstructAnExample:iWS4.1SHTMLTheformatstringisdynamicWehaveanargumentdeficiencyas0x14<0x18©2001byHalVarFlakeCreatingtheformatstring(I)AnExample:iWS4.1SHTMLCreatesthestringpassedtoINTlog_error()©2001byHalVarFlakeCreatingtheformatstring(II)AnExample:iWS4.1SHTMLBingo!Afterwards,user-supplieddataisappendedSomestring-classsizechecking©2001byHalVarFlakeCreatingtheSHTMLfileAnExample:iWS4.1SHTMLAninvalidSSItagtotriggertheerrorloggingroutine©2001byHalVarFlakeThehappyendAnExample:iWS4.1SHTMLExploitableuser-suppliedformatstringbuginiWS4.1SHTMLparsing©2001byHalVarFlakeBREAK©2001byHalVarFlakeAsimplesprintf()-scanningscriptAdvancedtopics:AutomationThingstocheckforinasprintf()-call: Doesthecallexpandastringusing“%s“? Doesthecalltargetastackbuffer? Doesthecallsufferfromanargument deficiency? Ifso,istheformatstringdynamic?
©2001byHalVarFlakeGettingthestackcorrectionAdvancedtopics:AutomationstaticGetStackCorr(lpCall){while((GetMnem(lpCall)!="add")&&(GetOpnd(lpCall,0)!="esp"))lpCall=Rfirst(lpCall);return(xtol(GetOpnd(lpCall,1)));}Tracethecodefurtheruntilan„addesp,somevalue“isfoundConvertthesomevaluetoanumberandreturnitRetrievingastringAdvancedtopics:AutomationstaticGetBinString(eaString){autostrTemp,chr;strTemp="";chr=Byte(eaString);while((chr!=0)&&(chr!=0xFF)){strTemp=form("%s%c",strTemp,chr);eaString=eaString+1;chr=Byte(eaString);}return(strTemp);}ZerothestringGetabyteUntileitheraNULLora0xFFisfound,appendonebyteatatimetothestring,thenreturnthestring.RetrievingargumentnAdvancedtopics:AutomationWemusttakethefollowingstepstoretrieveargumentntoacertainfunctioncall: Locatethen-thpushbeforeacall ifanimmediatevalueispushed,returnthat value(ortheoffset) ifaregisterispush,findwhereitwaslast writtentoandreturnthevalueitwasloaded with.©2001byHalVarFlakestatic GetArg(lpCall,n){auto TempReg;while(n>0){ lpCall=RfirstB(lpCall); if(GetMnem(lpCall)=="push")n=n-1;}if(GetOpType(lpCall,0)==1){TempReg=GetOpnd(lpCall,0);lpCall=RfirstB(lpCall);while(GetOpnd(lpCall,0)!=TempReg)lpCall=RfirstB(lpCall); return(GetOpnd(lpCall,1));}elsereturn(GetOpnd(lpCall,0));}Tracebackuntilthen-thpushisfoundIsthepushedoperandaregister?Findwheretheregisterwaslastaccessed......andreturnthevaluewhichwaspushed...(source)©2001byHalVarFlake(source)static AuditSprintf(lpCall){auto fString,fStrAddr,buffTarget;
buffTarget=GetArg(lpCall,1);fString=GetArg(lpCall,2); if(strstr(fString,"offset")!=-1) fString=substr(fString,7,-1);fStrAddr=LocByName(fString);fString=BinStrGet(fStrAddr);if(GetStackCorr(lpCall)<12)if(strlen(fString)<2) Message("%lx-->FormatStringProblem?\n",lpCall);if(strstr(fString,"%s")!=-1)if(strstr(buffTarget,"var_")!=-1) Message("%lx-->Overflowproblem?\"%s\"\n",lpCall,fString);}CleanuptheargumentsCheckifthetargetisastackvariableCheckforadynamicformatstringCheckforargumentdeficiencyCheckfor„%s“informatstring©2001byHalVarFlake(source)staticmain(){auto FuncAddr,xref;FuncAddr=AskAddr(-1,"Enteraddress:");xref=Rfirst(FuncAddr);while(xref!=-1){if(GetMnem(xref)=="call")AuditSprintf(xref);xref=Rnext(FuncAddr,xref);}xref=DfirstB(FuncAddr);while(xref!=-1){if(GetMnem(xref)=="call")AuditSprintf(xref);xref=DnextB(FuncAddr,xref);}}Askauditortoentertheaddressofthesprintf()Calltheauditingfunctiononceforeachcalltosprintf()Repeatforallindirectcalls©2001byHalVarFlakeAsimplestrncpy()-scanningscriptAdvancedtopics:AutomationThingstocheckforinastrncpy()-call: Isthetargetbufferastackvariable? Isthemaxlenparameterequaltothe estimatedsizeofthetargetbuffer?
Isthesourcebufferanon-staticstring?
©2001byHalVarFlakeEstimatingStackBuffersizeAdvancedtopics:AutomationstaticStckBuffSize(lpCall,cName){autoframeID,ofs,count;frameID=GetFrame(lpCall);
while(strstr(cName,"+")!=-1)cName=substr(cName,strstr(cName,"+")+1,strlen(cName));cName=substr(cName,0,strlen(cName)-1);ofs=GetMemberOffset(frameID,cName);count=ofs+1;while(GetMemberName(frameID,count)=="")count=count+1;count=count-ofs;returncount;}CleanupnameWalkstackframeuntilanothervarisfound©2001byHalVarFlakeTheAudStrncpy()-functionAdvancedtopics:AutomationstaticAudStrncpy(lpCall){autobuffTarget,buffSrc,maxlen;autosrcString;
buffTarget=GetArg(lpCall,1);buffSrc=GetArg(lpCall,2);maxlen=GetArg(lpCall,3);
if(StckBuffSize(lpCall,buffTarget)<=xtol(maxlen)){if(strlen(BinStrGet(LocByName(buffSrc)))<2)Message("Suspiciousstrncpy()at%lx!\n",lpCall);}}RetrieveargumentsCheckstackbuffersizeagainstmaxlenCheckfornon-staticsourcebuffer©2001byHalVarFlakeStructurereconstruction(I)Advancedtopics Frequently,largestructuresontheheap areusedtoholdconnectiondata,error stringsandthelike. IDAcannotyetreconstructthose structures Inordertocheckstrncpy()andsimilarcalls
温馨提示
- 1. 本站所有资源如无特殊说明,都需要本地电脑安装OFFICE2007和PDF阅读器。图纸软件为CAD,CAXA,PROE,UG,SolidWorks等.压缩文件请下载最新的WinRAR软件解压。
- 2. 本站的文档不包含任何第三方提供的附件图纸等,如果需要附件,请联系上传者。文件的所有权益归上传用户所有。
- 3. 本站RAR压缩包中若带图纸,网页内容里面会有图纸预览,若没有图纸预览就没有图纸。
- 4. 未经权益所有人同意不得将文件中的内容挪作商业或盈利用途。
- 5. 人人文库网仅提供信息存储空间,仅对用户上传内容的表现方式做保护处理,对用户上传分享的文档内容本身不做任何修改或编辑,并不能对任何下载内容负责。
- 6. 下载文件中如有侵权或不适当内容,请与我们联系,我们立即纠正。
- 7. 本站不保证下载资源的准确性、安全性和完整性, 同时也不承担用户因使用这些下载资源对自己和他人造成任何形式的伤害或损失。
最新文档
- 范文新学期学习计划模板集合8篇
- 系统机房维护合同(标准版)
- 默示合同概念
- 2024-2025学年新教材高中生物第5章植物生命活动的调节第2节其他植物激素测评含解析新人教版选择性必修第一册
- 山东省德州市2025届高三地理第二次模拟考试试题含解析
- 广东省汕头市潮阳区达标名校2025年初三第六次质量考评数学试题试卷含解析
- 广东省汕头潮阳区2024-2025学年高三下学期3月模拟测试数学试题含解析
- 广东省梅州五华县联考2025年初三5月物理试题检测试题含解析
- 广东省茂名市五校联考2024-2025学年高三高考测试(一)物理试题含解析
- 广东省江门市2024届三年级数学第二学期期末统考试题含解析
- 拌合站建设标准化
- 107预制混凝土构件出厂合格证
- 暗股协议书_0
- 双庙明德学校迎省政府教育督导评估实施方案
- 财务报表审计
- 专利代理机构客户满意度调查问卷
- 农村低压电力技术规程(国标正本)
- 焊烟净化器说明书
- 高中化学必修一教材解读(鲁科版2021)
- 控烟考评奖惩记录表
- 水电站课程设计
评论
0/150
提交评论