Qiling FrameworkIntroduction Cross platform and multi arch ultra lightweight emulator. Supported OS: Linux, MacOS, Windows, FreeBSD, DOS and UEFI. Support Arch: x86(16/32/64), ARM(64) MIPS, EVM and WASM. 2023-08-04
UEFIアプリケーションã®ã¯ã˜ã‚ã‹ãŸ
UEFI Advent Calender 12日目ã ã£ãŸoruminã§ã™ 盛大ã«é…刻ã‹ã¾ã—ã¦ã‚‚ã¯ã‚„é…刻ã¨ã•ãˆè¨€ãˆãªã„æ„Ÿã˜ã§ã™ã€‚ UEFIã®ã‚¢ãƒ—リケーションã€ã¾ãšã©ã†ä½œã‚‹ã‹ã‚ã‹ã‚‰ãªã„方も多ã„ã‹ã¨æ€ã„ã¾ã™ã€‚ ã¾ãšã€UEFIãŒå®Ÿè¡Œã§ãる実行形å¼ã«ã¤ã„ã¦ã€ã“ã‚Œã¯Windowsã¨åŒã˜PEãƒã‚¤ãƒŠãƒªã§ã™ã€‚ ã¾ãŸã€EDKã®ã‚ˆã†ãªãƒ„ールã‚ットを用ã„ã‚‹å¿…è¦ãŒã‚ã‚Šã¾ã™ãŒã€ 今回ã¯gnu-efiã§èª¬æ˜Žã—ã¾ã™ã€‚ gnu-efiã¨ã¯ã€BSDLãªEFIアプリケーション開発用ライブラリã§ã™ã€‚ Linuxã‚„BSDã§ã®é–‹ç™ºã«è¦ªå’Œæ€§ãŒé«˜ã„ã¨æ€ã‚ã‚Œã¾ã™ã€‚ ã“ã‚Œã¯æœ€è¿‘ã ã¨aptã‚„pacmanã§ãã®ã¾ã¾ãƒã‚¤ãƒŠãƒªã‚¤ãƒ³ã‚¹ãƒˆãƒ¼ãƒ«ãŒå¯èƒ½ã§ã™ã€‚ ãã—ã¦ã€æ¬¡ã«ã“ã®ã‚ˆã†ãªãƒ•ã‚¡ã‚¤ãƒ«ã‚’用æ„ã—ã¾ã™ å‰è€…ãŒUEFIã§ã®Hello, World!ã§ã™ã€‚efi_mainãŒã‚¨ãƒ³ãƒˆãƒªãƒã‚¤ãƒ³ãƒˆã€ ImageHandleã‚‚SystemTableã‚‚UEFIã®API(P
Private Presentation
Private content!This content has been marked as private by the uploader.
APASEC 2013 - ROP/JIT を使ã‚ãšã« DEP/ASLR を回é¿ã™ã‚‹æ‰‹æ³•ã‚’見ã¦ã¿ãŸã€‚
8. DEP (データ実行防æ¢) 詳ã—ã書ã㨠： ï‚ x86_64 版 Windows + x86_64 環境用ã®å®Ÿè¡Œãƒ•ã‚¡ã‚¤ãƒ« ï‚ å…¨ã¦ã«é©ç”¨ã•ã‚Œã‚‹ã€‚ (AlwaysOn) BCD ã«ã¦ nx = AlwaysOff ã¨æŒ‡å®šã™ã‚Œã°å¤–れる。 ï‚ ã‚¹ãƒ¬ãƒƒãƒ‰ã‚¹ã‚¿ãƒƒã‚¯ (Kernel,User), ãƒšãƒ¼ã‚¸é ˜åŸŸ (User), Paged pool (Kernel), Session Pool (Kernel) ãŒå¯¾è±¡ã€‚ ï‚ x86 版 Windows or x86 環境用ã®å®Ÿè¡Œãƒ•ã‚¡ã‚¤ãƒ« ï‚ é‡è¦ãªã‚‚ã®ã®ã¿ã«åŽŸå‰‡é©ç”¨ã€‚ (OutIn) ãŸã ã—ã€ã‚µãƒ¼ãƒç”¨OS ã§ã¯åŽŸå‰‡å…¨ã¦ (OptOut) ï‚ ãªãŠã€PAE (Physical Address Extension) ãŒæœ‰åŠ¹ãªç’°å¢ƒã§ãªã„ã¨ã€ãƒãƒ¼ãƒ‰ã‚¦ã‚§ã‚¢ DEP ãŒæœ‰åŠ¹ã«ãªã‚‰ãªã„。 ï‚ ã‚¹ãƒ¬ãƒƒãƒ‰ã‚¹ã‚¿ãƒƒã‚¯ (User), ãƒšãƒ¼ã‚¸é ˜åŸŸ (User) å‚照元：
ASLR回é¿æŠ€è¡“ã¨Chromeã®sandboxã®çªç ´exploit | Scene Research Station
IEã®è„†å¼±æ€§ã¨Use-After-Free ã¨ã„ã†ãƒ¡ãƒ¢ã‚’書ã„ã¦è‰²ã€…調ã¹ã¦ã„ãŸã‚‰ã€é¢ç™½ã„記事を見ã¤ã‘ãŸã€‚ ASLR Bypass Apocalypse in Recent Zero-Day Exploits http://www.fireeye.com/blog/technical/cyber-exploits/2013/10/aslr-bypass-apocalypse-in-lately-zero-day-exploits.html ã©ã†ã‚„ら最近ã¯ASLRも回é¿ã™ã‚‹æ–¹æ³•ãŒç¢ºç«‹ã•ã‚Œã¤ã¤ã‚るらã—ã„。 リンク先ã§å¹¾ã¤ã‹å›žé¿æ–¹æ³•ãŒç´¹ä»‹ã•ã‚Œã¦ã„ã‚‹ãŒã€ãã®æœ€ã‚‚有力ãªæ‰‹æ³•ãŒArrayオブジェクトã®lengthã®æ›¸ãæ›ãˆã€‚Buffer overflowãªã‚Šuse-after-freeãªã‚Šã§arrayã®lengthã‚’ä¸æ£ã«æ›¸ãæ›ãˆã‚‹ã“ã¨ã§ã€æœ€çµ‚çš„ã«å…¨ãƒ¡ãƒ¢ãƒªã¸ã®ã‚¢ã‚¯ã‚»ã‚¹æ¨©ã‚’スクリプト上ã‹ã‚‰å¾—る。ã“ã†ãªã‚Œã°e
ld -z relro 㧠GOT overwrite attack ã‹ã‚‰èº«ã‚’守る - memologue
GOT overwrite? "GOT overwrite" ã¨ã„ã†ã€(ã“ã“ã§ã¯ç‰¹ã«Linuxã®)プãƒã‚°ãƒ©ãƒ ã«å¯¾ã™ã‚‹æ”»æ’ƒæ–¹æ³•ãŒã‚ã‚Šã¾ã™ã€‚攻撃ãŒæˆåŠŸã™ã‚‹ã¨ã€ãã®ãƒ—ãƒã‚»ã‚¹ã®æ¨©é™ã§ã®ä»»æ„コード実行ç‰ã€æ·±åˆ»ãªè¢«å®³ã‚’å—ã‘ã¾ã™ã€‚最近ã®GNU ld(リンカ)ã®ã‚ªãƒ—ションを用ã„ã‚‹ã¨ã€ã“ã®æ”»æ’ƒã‹ã‚‰èº«ã‚’守るã“ã¨ãŒã§ãã‚‹ãã†ã§ã™ã®ã§ã€ç´¹ä»‹ã—ã¾ã™ã€‚ 最åˆã«ã¾ã¨ã‚ （ã“ã¾ã‹ã„ã“ã¨ã¯ã‚ã¨ã§ï¼‰ GOT overwrite ã‹ã‚‰èº«ã‚’守るã«ã¯ã€gccã§ãƒ—ãƒã‚°ãƒ©ãƒ をリンクã™ã‚‹ã¨ãã«ã€ -Wl,-z,now,-z,relro ã‚’ã¤ã‘ã‚‹ã ã‘ã§ã™ã€‚起動時間ãŒé…ããªã‚‹ã¨ã„ã†ãƒˆãƒ¬ãƒ¼ãƒ‰ã‚ªãƒ•ãŒã‚ã‚Šã¾ã™ãŒã€GOTãŒreadonlyã«ãªã‚Šã¾ã™ã€‚GOTãŒreadonlyãªã‚‰ã€GOT overwrite attack ã‚’å—ã‘ãŸã¨ãã«ã€ãƒ—ãƒã‚»ã‚¹ãŒSEGVã—ã¦ãã‚Œã¾ã™ã®ã§ã€å®‰å…¨æ€§ãŒé«˜ã¾ã‚Šã¾ã™ã€‚プãƒã‚»ã‚¹ã®ãƒ¡ãƒ¢ãƒªãƒžãƒƒãƒ—を確èªã™ã‚‹ã¨ã€ãã¡ã‚“㨠w ãŒè½ã¡ã¦
Runtime Symbol Resolution
9. Build (& Load) Process Usually you just type “gcc foo.c†and it invokes the four sub-processes for you. (text) (text) (text) (ELF) (ELF) (ELF) C code Preprocessed C code Assembly code Executable code Relocatable code Preprocessor Compiler Process Image Assembler Linker Loader DL 10. What's Dynamic Library? Dynamic library is linked at runtime While static library is linked at “compile-time†Sha
1
ランã‚ング
ランã‚ング
ランã‚ング
リリースã€éšœå®³æƒ…å ±ãªã©ã®ã‚µãƒ¼ãƒ“スã®ãŠçŸ¥ã‚‰ã›
最新ã®äººæ°—エントリーã®é…ä¿¡
j次ã®ãƒ–ックマーク
kå‰ã®ãƒ–ックマーク
lã‚ã¨ã§èªã‚€
eコメント一覧を開ã
oページを開ã
ROP Illmatic: Exploring Universal ROP on glibc x86-64 (en)
GitHub - shinh/maloader: mach-o loader for linux
.:Shell-Storm.org:. | Project | ROPgadget tool
{{#tags}}- {{label}}
{{/tags}}