Upload File

powerpoint presentation · filter manager virus scanner kernel system library system library...

  • Home
  • Documents
  • PowerPoint Presentation · Filter Manager Virus Scanner Kernel System Library System Library SuperFetch (root cause) Kernel Mode User Mode Note: user stack capture isn’t supported
77

Upload: others

Post on 17-Jan-2020

11 views

Category:

Documents


0 download

Report

TRANSCRIPT

Page 1: PowerPoint Presentation · Filter Manager Virus Scanner Kernel System Library System Library SuperFetch (root cause) Kernel Mode User Mode Note: user stack capture isn’t supported
Page 2: PowerPoint Presentation · Filter Manager Virus Scanner Kernel System Library System Library SuperFetch (root cause) Kernel Mode User Mode Note: user stack capture isn’t supported
Page 3: PowerPoint Presentation · Filter Manager Virus Scanner Kernel System Library System Library SuperFetch (root cause) Kernel Mode User Mode Note: user stack capture isn’t supported
Page 4: PowerPoint Presentation · Filter Manager Virus Scanner Kernel System Library System Library SuperFetch (root cause) Kernel Mode User Mode Note: user stack capture isn’t supported
Page 5: PowerPoint Presentation · Filter Manager Virus Scanner Kernel System Library System Library SuperFetch (root cause) Kernel Mode User Mode Note: user stack capture isn’t supported
Page 6: PowerPoint Presentation · Filter Manager Virus Scanner Kernel System Library System Library SuperFetch (root cause) Kernel Mode User Mode Note: user stack capture isn’t supported
Page 7: PowerPoint Presentation · Filter Manager Virus Scanner Kernel System Library System Library SuperFetch (root cause) Kernel Mode User Mode Note: user stack capture isn’t supported
Page 8: PowerPoint Presentation · Filter Manager Virus Scanner Kernel System Library System Library SuperFetch (root cause) Kernel Mode User Mode Note: user stack capture isn’t supported
Page 9: PowerPoint Presentation · Filter Manager Virus Scanner Kernel System Library System Library SuperFetch (root cause) Kernel Mode User Mode Note: user stack capture isn’t supported
Page 10: PowerPoint Presentation · Filter Manager Virus Scanner Kernel System Library System Library SuperFetch (root cause) Kernel Mode User Mode Note: user stack capture isn’t supported
Page 11: PowerPoint Presentation · Filter Manager Virus Scanner Kernel System Library System Library SuperFetch (root cause) Kernel Mode User Mode Note: user stack capture isn’t supported
Page 12: PowerPoint Presentation · Filter Manager Virus Scanner Kernel System Library System Library SuperFetch (root cause) Kernel Mode User Mode Note: user stack capture isn’t supported
Page 13: PowerPoint Presentation · Filter Manager Virus Scanner Kernel System Library System Library SuperFetch (root cause) Kernel Mode User Mode Note: user stack capture isn’t supported
Page 14: PowerPoint Presentation · Filter Manager Virus Scanner Kernel System Library System Library SuperFetch (root cause) Kernel Mode User Mode Note: user stack capture isn’t supported
Page 15: PowerPoint Presentation · Filter Manager Virus Scanner Kernel System Library System Library SuperFetch (root cause) Kernel Mode User Mode Note: user stack capture isn’t supported
Page 16: PowerPoint Presentation · Filter Manager Virus Scanner Kernel System Library System Library SuperFetch (root cause) Kernel Mode User Mode Note: user stack capture isn’t supported
Page 17: PowerPoint Presentation · Filter Manager Virus Scanner Kernel System Library System Library SuperFetch (root cause) Kernel Mode User Mode Note: user stack capture isn’t supported
Page 18: PowerPoint Presentation · Filter Manager Virus Scanner Kernel System Library System Library SuperFetch (root cause) Kernel Mode User Mode Note: user stack capture isn’t supported
Page 19: PowerPoint Presentation · Filter Manager Virus Scanner Kernel System Library System Library SuperFetch (root cause) Kernel Mode User Mode Note: user stack capture isn’t supported

sigcheck -e -u -s c:\

listdlls -u

Page 20: PowerPoint Presentation · Filter Manager Virus Scanner Kernel System Library System Library SuperFetch (root cause) Kernel Mode User Mode Note: user stack capture isn’t supported

strings <file>

Page 21: PowerPoint Presentation · Filter Manager Virus Scanner Kernel System Library System Library SuperFetch (root cause) Kernel Mode User Mode Note: user stack capture isn’t supported
Page 22: PowerPoint Presentation · Filter Manager Virus Scanner Kernel System Library System Library SuperFetch (root cause) Kernel Mode User Mode Note: user stack capture isn’t supported
Page 23: PowerPoint Presentation · Filter Manager Virus Scanner Kernel System Library System Library SuperFetch (root cause) Kernel Mode User Mode Note: user stack capture isn’t supported
Page 24: PowerPoint Presentation · Filter Manager Virus Scanner Kernel System Library System Library SuperFetch (root cause) Kernel Mode User Mode Note: user stack capture isn’t supported
Page 25: PowerPoint Presentation · Filter Manager Virus Scanner Kernel System Library System Library SuperFetch (root cause) Kernel Mode User Mode Note: user stack capture isn’t supported
Page 26: PowerPoint Presentation · Filter Manager Virus Scanner Kernel System Library System Library SuperFetch (root cause) Kernel Mode User Mode Note: user stack capture isn’t supported
Page 27: PowerPoint Presentation · Filter Manager Virus Scanner Kernel System Library System Library SuperFetch (root cause) Kernel Mode User Mode Note: user stack capture isn’t supported
Page 28: PowerPoint Presentation · Filter Manager Virus Scanner Kernel System Library System Library SuperFetch (root cause) Kernel Mode User Mode Note: user stack capture isn’t supported
Page 29: PowerPoint Presentation · Filter Manager Virus Scanner Kernel System Library System Library SuperFetch (root cause) Kernel Mode User Mode Note: user stack capture isn’t supported
Page 30: PowerPoint Presentation · Filter Manager Virus Scanner Kernel System Library System Library SuperFetch (root cause) Kernel Mode User Mode Note: user stack capture isn’t supported

http://www.e-markettop.com/

http://www.e-markettop.com/
http://www.e-markettop.com/
http://www.e-markettop.com/
Page 31: PowerPoint Presentation · Filter Manager Virus Scanner Kernel System Library System Library SuperFetch (root cause) Kernel Mode User Mode Note: user stack capture isn’t supported
Page 32: PowerPoint Presentation · Filter Manager Virus Scanner Kernel System Library System Library SuperFetch (root cause) Kernel Mode User Mode Note: user stack capture isn’t supported
Page 33: PowerPoint Presentation · Filter Manager Virus Scanner Kernel System Library System Library SuperFetch (root cause) Kernel Mode User Mode Note: user stack capture isn’t supported
Page 34: PowerPoint Presentation · Filter Manager Virus Scanner Kernel System Library System Library SuperFetch (root cause) Kernel Mode User Mode Note: user stack capture isn’t supported
Page 35: PowerPoint Presentation · Filter Manager Virus Scanner Kernel System Library System Library SuperFetch (root cause) Kernel Mode User Mode Note: user stack capture isn’t supported
Page 36: PowerPoint Presentation · Filter Manager Virus Scanner Kernel System Library System Library SuperFetch (root cause) Kernel Mode User Mode Note: user stack capture isn’t supported

http://blogs.technet.com/b/markrussinovich/archive/2011/03/14/3412374.aspx

http://blogs.technet.com/b/markrussinovich/archive/2011/03/14/3412374.aspx
Page 37: PowerPoint Presentation · Filter Manager Virus Scanner Kernel System Library System Library SuperFetch (root cause) Kernel Mode User Mode Note: user stack capture isn’t supported
Page 38: PowerPoint Presentation · Filter Manager Virus Scanner Kernel System Library System Library SuperFetch (root cause) Kernel Mode User Mode Note: user stack capture isn’t supported
Page 39: PowerPoint Presentation · Filter Manager Virus Scanner Kernel System Library System Library SuperFetch (root cause) Kernel Mode User Mode Note: user stack capture isn’t supported
Page 40: PowerPoint Presentation · Filter Manager Virus Scanner Kernel System Library System Library SuperFetch (root cause) Kernel Mode User Mode Note: user stack capture isn’t supported
Page 41: PowerPoint Presentation · Filter Manager Virus Scanner Kernel System Library System Library SuperFetch (root cause) Kernel Mode User Mode Note: user stack capture isn’t supported
Page 42: PowerPoint Presentation · Filter Manager Virus Scanner Kernel System Library System Library SuperFetch (root cause) Kernel Mode User Mode Note: user stack capture isn’t supported

User Mode

Kernel Mode

File System

Filter Registry Callback

Kernel

Callouts

Process Monitor UI

Process Monitor Driver TCP/IP Driver ETW

events

Page 43: PowerPoint Presentation · Filter Manager Virus Scanner Kernel System Library System Library SuperFetch (root cause) Kernel Mode User Mode Note: user stack capture isn’t supported
Page 44: PowerPoint Presentation · Filter Manager Virus Scanner Kernel System Library System Library SuperFetch (root cause) Kernel Mode User Mode Note: user stack capture isn’t supported
Page 45: PowerPoint Presentation · Filter Manager Virus Scanner Kernel System Library System Library SuperFetch (root cause) Kernel Mode User Mode Note: user stack capture isn’t supported
Page 46: PowerPoint Presentation · Filter Manager Virus Scanner Kernel System Library System Library SuperFetch (root cause) Kernel Mode User Mode Note: user stack capture isn’t supported
Page 47: PowerPoint Presentation · Filter Manager Virus Scanner Kernel System Library System Library SuperFetch (root cause) Kernel Mode User Mode Note: user stack capture isn’t supported
Page 48: PowerPoint Presentation · Filter Manager Virus Scanner Kernel System Library System Library SuperFetch (root cause) Kernel Mode User Mode Note: user stack capture isn’t supported
Page 49: PowerPoint Presentation · Filter Manager Virus Scanner Kernel System Library System Library SuperFetch (root cause) Kernel Mode User Mode Note: user stack capture isn’t supported

Function 2

Function 1

Function 3

Function 3 Function 2 Function 1

Stack Display

Page 50: PowerPoint Presentation · Filter Manager Virus Scanner Kernel System Library System Library SuperFetch (root cause) Kernel Mode User Mode Note: user stack capture isn’t supported

Filter Manager

Virus Scanner

Kernel

System Library

System Library

SuperFetch

(root cause)

Kernel Mode

User Mode

Note: user stack capture isn’t supported on 64-bit versions of Windows XP/Server 2003

Page 51: PowerPoint Presentation · Filter Manager Virus Scanner Kernel System Library System Library SuperFetch (root cause) Kernel Mode User Mode Note: user stack capture isn’t supported
Page 52: PowerPoint Presentation · Filter Manager Virus Scanner Kernel System Library System Library SuperFetch (root cause) Kernel Mode User Mode Note: user stack capture isn’t supported

“Category is Write”

Page 53: PowerPoint Presentation · Filter Manager Virus Scanner Kernel System Library System Library SuperFetch (root cause) Kernel Mode User Mode Note: user stack capture isn’t supported
Page 54: PowerPoint Presentation · Filter Manager Virus Scanner Kernel System Library System Library SuperFetch (root cause) Kernel Mode User Mode Note: user stack capture isn’t supported
Page 55: PowerPoint Presentation · Filter Manager Virus Scanner Kernel System Library System Library SuperFetch (root cause) Kernel Mode User Mode Note: user stack capture isn’t supported
Page 56: PowerPoint Presentation · Filter Manager Virus Scanner Kernel System Library System Library SuperFetch (root cause) Kernel Mode User Mode Note: user stack capture isn’t supported
Page 57: PowerPoint Presentation · Filter Manager Virus Scanner Kernel System Library System Library SuperFetch (root cause) Kernel Mode User Mode Note: user stack capture isn’t supported
Page 58: PowerPoint Presentation · Filter Manager Virus Scanner Kernel System Library System Library SuperFetch (root cause) Kernel Mode User Mode Note: user stack capture isn’t supported

http://blogs.technet.com/b/markrussinovich/archive/2011/03/08/3392087.aspx

http://blogs.technet.com/b/markrussinovich/archive/2011/03/08/3392087.aspx
Page 59: PowerPoint Presentation · Filter Manager Virus Scanner Kernel System Library System Library SuperFetch (root cause) Kernel Mode User Mode Note: user stack capture isn’t supported
Page 60: PowerPoint Presentation · Filter Manager Virus Scanner Kernel System Library System Library SuperFetch (root cause) Kernel Mode User Mode Note: user stack capture isn’t supported
Page 61: PowerPoint Presentation · Filter Manager Virus Scanner Kernel System Library System Library SuperFetch (root cause) Kernel Mode User Mode Note: user stack capture isn’t supported
Page 62: PowerPoint Presentation · Filter Manager Virus Scanner Kernel System Library System Library SuperFetch (root cause) Kernel Mode User Mode Note: user stack capture isn’t supported

http://blogs.technet.com/b/markrussinovich/archive/2011/02/27/3390475.aspx

http://blogs.technet.com/b/markrussinovich/archive/2011/02/27/3390475.aspx
Page 63: PowerPoint Presentation · Filter Manager Virus Scanner Kernel System Library System Library SuperFetch (root cause) Kernel Mode User Mode Note: user stack capture isn’t supported
Page 64: PowerPoint Presentation · Filter Manager Virus Scanner Kernel System Library System Library SuperFetch (root cause) Kernel Mode User Mode Note: user stack capture isn’t supported
Page 65: PowerPoint Presentation · Filter Manager Virus Scanner Kernel System Library System Library SuperFetch (root cause) Kernel Mode User Mode Note: user stack capture isn’t supported
Page 66: PowerPoint Presentation · Filter Manager Virus Scanner Kernel System Library System Library SuperFetch (root cause) Kernel Mode User Mode Note: user stack capture isn’t supported
Page 67: PowerPoint Presentation · Filter Manager Virus Scanner Kernel System Library System Library SuperFetch (root cause) Kernel Mode User Mode Note: user stack capture isn’t supported
Page 68: PowerPoint Presentation · Filter Manager Virus Scanner Kernel System Library System Library SuperFetch (root cause) Kernel Mode User Mode Note: user stack capture isn’t supported
Page 69: PowerPoint Presentation · Filter Manager Virus Scanner Kernel System Library System Library SuperFetch (root cause) Kernel Mode User Mode Note: user stack capture isn’t supported
Page 70: PowerPoint Presentation · Filter Manager Virus Scanner Kernel System Library System Library SuperFetch (root cause) Kernel Mode User Mode Note: user stack capture isn’t supported
Page 71: PowerPoint Presentation · Filter Manager Virus Scanner Kernel System Library System Library SuperFetch (root cause) Kernel Mode User Mode Note: user stack capture isn’t supported

http://blogs.technet.com/b/markrussinovich/archive/2011/03/30/3416253.aspx

http://blogs.technet.com/b/markrussinovich/archive/2011/03/30/3416253.aspx
Page 72: PowerPoint Presentation · Filter Manager Virus Scanner Kernel System Library System Library SuperFetch (root cause) Kernel Mode User Mode Note: user stack capture isn’t supported
Page 73: PowerPoint Presentation · Filter Manager Virus Scanner Kernel System Library System Library SuperFetch (root cause) Kernel Mode User Mode Note: user stack capture isn’t supported
Page 74: PowerPoint Presentation · Filter Manager Virus Scanner Kernel System Library System Library SuperFetch (root cause) Kernel Mode User Mode Note: user stack capture isn’t supported
Page 75: PowerPoint Presentation · Filter Manager Virus Scanner Kernel System Library System Library SuperFetch (root cause) Kernel Mode User Mode Note: user stack capture isn’t supported

www.zerodaythebook.com

http://www.youtube.com/watch?v=ucyMBYg9RWU

http://www.zerodaythebook.com/
http://www.youtube.com/watch?v=ucyMBYg9RWU
Page 76: PowerPoint Presentation · Filter Manager Virus Scanner Kernel System Library System Library SuperFetch (root cause) Kernel Mode User Mode Note: user stack capture isn’t supported

http://technet.microsoft.com/en-us/sysinternals/hh290819

http://technet.microsoft.com/en-us/sysinternals/hh290819
http://technet.microsoft.com/en-us/sysinternals/hh290819
http://technet.microsoft.com/en-us/sysinternals/hh290819
Page 77: PowerPoint Presentation · Filter Manager Virus Scanner Kernel System Library System Library SuperFetch (root cause) Kernel Mode User Mode Note: user stack capture isn’t supported

http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/w32_stuxnet_dossier.pdf

http://www.wired.com/threatlevel/2011/07/how-digital-detectives-deciphered-stuxnet/

http://www.virusbtn.com/pdf/conference_slides/2010/Johnson-VB2010.pdf

http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/w32_stuxnet_dossier.pdf
http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/w32_stuxnet_dossier.pdf
http://www.wired.com/threatlevel/2011/07/how-digital-detectives-deciphered-stuxnet/
http://www.wired.com/threatlevel/2011/07/how-digital-detectives-deciphered-stuxnet/
http://www.wired.com/threatlevel/2011/07/how-digital-detectives-deciphered-stuxnet/
http://www.wired.com/threatlevel/2011/07/how-digital-detectives-deciphered-stuxnet/
http://www.wired.com/threatlevel/2011/07/how-digital-detectives-deciphered-stuxnet/
http://www.wired.com/threatlevel/2011/07/how-digital-detectives-deciphered-stuxnet/
http://www.wired.com/threatlevel/2011/07/how-digital-detectives-deciphered-stuxnet/
http://www.wired.com/threatlevel/2011/07/how-digital-detectives-deciphered-stuxnet/
http://www.wired.com/threatlevel/2011/07/how-digital-detectives-deciphered-stuxnet/
http://www.virusbtn.com/pdf/conference_slides/2010/Johnson-VB2010.pdf
http://www.virusbtn.com/pdf/conference_slides/2010/Johnson-VB2010.pdf
http://www.virusbtn.com/pdf/conference_slides/2010/Johnson-VB2010.pdf
http://www.virusbtn.com/pdf/conference_slides/2010/Johnson-VB2010.pdf

Quick Shift and Kernel Methods for Mode Seekingvision.cs.ucla.edu/papers/vedaldiS08quick.pdfQuick Shift and Kernel Methods for Mode Seeking Andrea Vedaldi and Stefano Soatto University

Intel Math Kernel Library

Migrating User Mode Linux to Xen and Kernel Based Virtual

~qwertyoruiop@bluehatIL · trigger a kernel-mode privilege escalation or capture some data • Kernel-mode privilege escalation requires a separate kernel info leak (or a vulnerability

Kernel-mode Payloads on Windows - orkspace.net Payloads on... · Chapter 1 Foreword Abstract: This paper discusses the theoretical and practical implementations of kernel-mode payloads

Defeating x64: Modern Trends of Kernel-Mode Rootkits

OSPP: The Kernel Abstraction3 Dual-Mode Operation Modern CPUs have two execution modes: the user mode and the supervisor (or system, kernel, privileged) mode, controlled by a mode

Intel® Math Kernel Library 10.3 Windows -

Architecture of the Kernel-Mode Driver Frameworkdownload.microsoft.com/download/9/c/5/9c5b2167-8017-4bae... · Web viewThe kernel-mode driver framework (KMDF) is an infrastructure

C++ in kernel mode

Microsoft Kernel Mode Cryptographic Module - NIST … ·  · 2017-09-07Microsoft Kernel Mode Cryptographic Module FIPS 140 -1 Documentation: ... in Jan 2001. Microsoft Windows XP

PowerPoint Presentationlive.sysinternals.com/Files/SysinternalsMalwareCleaning.pdf · Filter Manager Virus Scanner Kernel System Library System Library SuperFetch (root cause) Kernel

CSCI 350 Ch. 2 - Kernel and User Mode

Interrupt driven I/O. MIPS RISC Exception Mechanism The processor operates in The processor operates in user mode user mode kernel mode kernel mode Access

Linux - Kernel Mode Programming Guide

Dell-CREDANT Cryptographic Kernel Mac Kernel Mode version … · Dell-CREDANT Cryptographic Kernel Mac Kernel Mode version 1.8 Mac User Mode version 1.8 Linux User Mode version 1.8

Kernel Attacks through User-Mode Callbacks

Windows OS Course Supplement Kit: What should be there?Windows Kernel Organization Kernel-mode organized into NTOS (kernel-mode services) ... Windows networking A14. Comparing the

High Performance Kernel Mode Web Server for Windows

L04 Kernel Mode

The Kernel Abstraction€¦ · •Save program counter: where to resume •Save old mode, interruptable bits to status register •Set mode bit to kernel •Set interrupts disabled

VCDC:TheVirtualizedComplicatedDevice Controller - …drops.dagstuhl.de/opus/volltexte/2017/7150/pdf/... · VCDC:TheVirtualizedComplicatedDevice Controller ... Kernel Mode User Mode

Windows Kernel Internals User-mode Heap Manager David B. Probert, Ph.D. Windows Kernel Development Microsoft Corporation

PowerPoint Presentationdownload.sysinternals.com/files/SysinternalsMalwareCleaning.pdf · User Mode Kernel Mode File System Filter Registry Callback Kernel Callouts Process Monitor

ISLab Flash Team Ch 4. Drivers and Kernel-Mode Objects

Merging KGDB KDB and Kernel Mode Setting

KERNEL WARS: KERNEL-EXPLOITATION DEMYSTIFIED · Introduction to kernel-mode vulnerabilities and exploitation • Why exploit kernel level vulnerabilities? – Attacks at the lowest

Intel® Math Kernel Library for Windows* OS User's Guide · 2018. 8. 9. · Introducing the Intel® Math Kernel Library Intel ® Math Kernel Library (Intel MKL) is a computing math

Windows Kernel Mode Components Overview - … Kernel Mode Components 6 Executive • Functions • Global, exported, undocumented and available to user mode • Global, exported, documented

Modern Bootkit Trends: Bypassing Kernel-Mode Signing Policy

CS 311 – Lecture 23 Outline Kernel – Process subsystem Process scheduling Scheduling algorithms User mode and kernel mode Lecture 231CS 311 - Operating

The Kernel - retis.sssup.itretis.sssup.it/luca/KernelProgramming/kernel_intro.pdf · Kernel Programming The Kernel • Switch the CPU from User Level to Supervisor Mode • Enter

Process Management CIS 657. Definitions l Program: process under execution l User mode: “normal” execution mode l Kernel mode: privileged execution mode;

Windows Kernel Internals - Zenk - Security et systemes d.exploitations... · mode kernel mode Windows Kernel-mode Architecture ... Idle processor or ... – Extensible filter-based

Using Undocumented CPU Behaviour to See into Kernel Mode and