SANS Digital Forensics and Incident Response Blog | APT Memory and Malware Challenge Solution | SANS Institute
APT Memory & Malware Challenge Answers The memory image contains real APT malware launched against a test system. Your job? Find it. The object of our challenge is simple: Download the memory image and attempt to answer the 5 questions. To successfully submit for the contest, all answers must be attempted. Each person that correctly answers 3 of the 5 questions will be entered into a drawing to wi
Windows Exploit Development - Part 1: The Basics - Security Sift
Sifting through the world of Information Security, one bit at a time Sift: to examine (something) thoroughly so as to isolate that which is most important -- Oxford Dictionary Overview Welcome to Part 1 of a series of posts on Windows Exploit Development. In this first installment I’ll cover just the basics necessary to understand the content of future posts, including some Assembly syntax, Window
æ怖㮠JVM 大é‡ãƒ¡ãƒ¢ãƒªæ¶ˆè²»ï¼ãƒ¡ãƒ¢ãƒªãƒªãƒ¼ã‚¯ã®è¬Žã‚’追ãˆï¼ï¼ - Cybozu Inside Out | サイボウズエンジニアã®ãƒ–ãƒã‚°
ã“ã‚“ã«ã¡ã¯ã€ãƒŸãƒ‰ãƒ«ã‚¦ã‚§ã‚¢é–‹ç™ºãƒãƒ¼ãƒ ã®é’木(@a_o_k_i_n_g)ã§ã™ã€‚å°†æ¥ã®å¤¢ã¯å·å£æµ©æŽ¢æ¤œéšŠã«å…¥ã‚‹ã“ã¨ã§ã™ã€‚ 先日ã€å¼Šç¤¾ã®ã‚¢ãƒ—リケーションサーãƒãƒ¼ã§å¤§é‡ã«ãƒ¡ãƒ¢ãƒªã‚’消費ã™ã‚‹ã¨ã„ã†ç¾è±¡ã«éé‡ã—ã¾ã—ãŸã€‚ã‚¢ã‚¯ã‚»ã‚¹é »åº¦ã®ä½Žã„サーãƒãƒ¼ãŒãƒ¡ãƒ¢ãƒªã‚’大é‡æ¶ˆè²»ã™ã‚‹ã¨ã„ã†è¬Žæ·±ã„ã‚‚ã®ã§ã—ãŸã€‚ 発生当åˆã®çŠ¶æ³ã¯ã“ã‚“ãªæ„Ÿã˜ã§ã™ã€‚ アプリケーションサーãƒãƒ¼ã§ã¯ Jetty ãŒç¨¼åƒ ç¾è±¡ãŒç™ºç”Ÿã—㟠JVM 㯠5GB 程度ã®ãƒ¡ãƒ¢ãƒªã‚’消費ã—ã¦ãŠã‚Šã€æ˜Žã‚‰ã‹ã«é€šå¸¸ã§ã¯ãªã„é‡ã®ãƒ¡ãƒ¢ãƒªã‚’消費ã—ã¦ã„ã‚‹ 複数å°ã®ã‚µãƒ¼ãƒãƒ¼ã§ç™ºç”Ÿã—ã¦ã„ãŸãŒã€å…¨ã¦ã§ç™ºç”Ÿã—ãŸã‚ã‘ã§ã¯ãªã„。 ã¾ãŸã€ç™ºç”Ÿã—ãŸã‚µãƒ¼ãƒãƒ¼ã¯ã„ãšã‚Œã‚‚ã‚¢ã‚¯ã‚»ã‚¹é »åº¦ãŒå°‘ãªã„サーãƒãƒ¼ã ã£ãŸã€‚ ヒープã€ãƒ‘ーマãƒãƒ³ãƒˆã€ã‚¹ã‚¿ãƒƒã‚¯ ã²ã¨ã¾ãšã€JVM ã§ãƒˆãƒ©ãƒ–ルãŒç™ºç”Ÿã—ãŸæ™‚ã¯ä½•ã¯ã¨ã‚‚ã‚れヒープダンプã¨ã‚¹ãƒ¬ãƒƒãƒ‰ãƒ€ãƒ³ãƒ—を見るã«é™ã‚Šã¾ã™ã€‚å„ç¨®æƒ…å ±ã®å–得をインフラ部隊ã¸ä¾é ¼ã—ã€å¾—られãŸãƒ’ープを解æžã™ã‚‹ã¨ã€
ã©ã†ã—ã¦ãƒ¡ãƒ¢ãƒªã¯ã‚¹ãƒ¯ãƒƒãƒ—ã™ã‚‹ã®ã‹ï¼ï¼Ÿ
ã“ã‚“ã«ã¡ã¯ã€‚æ–Žè—¤ã§ã™ã€‚ 最近ã€æ–°ã—ã„スã‚ーæ¿ãŒæ¬²ã—ã„ãªã¨æ€ã£ã¦ã„ã¾ã™ã€‚ç¾åœ¨ä½¿ã£ã¦ã„ã‚‹OGASAKAã®æ¿ã¯5å¹´ç›®ã«å…¥ã‚Šã€ãƒ¡ãƒ¼ã‚«ãƒ¼ã‹ã‚‰ã“れ以上ã¯ãƒãƒ¥ãƒ¼ãƒ³ãƒŠãƒƒãƒ—(メンテナンス)ã¯ã§ããªã„よã€ã¨è¨€ã‚ã‚Œã¦ã—ã¾ã„ã¾ã—ãŸã€‚ã‚‚ã—ã€æ¬¡ã«è²·ã†ãªã‚‰ã€ã‚¹ãƒŽãƒ¼ãƒœãƒ¼ãƒ€ãƒ¼ã®äººã¨ä¸€ç·’ã«ãƒ‘ウダーã«é£›ã³è¾¼ã¿ã‚„ã™ã„セミファットタイプãŒè‰¯ã„ã®ã‹ãªã¨è€ƒãˆã¦ã„ã¾ã™ã€‚皆ã•ã‚“ã®ã‚ªã‚¹ã‚¹ãƒ¡ã€ãœã²æ•™ãˆã¦ãã ã•ã„。 ã•ã¦ã€ä»Šæ—¥ã¯Linux Kernel上ã§ã®ãƒ¡ãƒ¢ãƒªç®¡ç†ã€ç‰¹ã«ãƒšãƒ¼ã‚¸å›žåŽ(Page Reclaim)ã¨ã‚¹ãƒ¯ãƒƒãƒ—ã«çµžã‚Šã€ã€Œã‚¹ãƒ¯ãƒƒãƒ—ã®ç†ç”±ã€ã€Œãƒšãƒ¼ã‚¸ã‚’回åŽã™ã‚‹ä»•çµ„ã¿ã€ãã—ã¦ã€Œã‚¹ãƒ¯ãƒƒãƒ—ã®æ§˜åを観察ã™ã‚‹ã€ã®3点ã«åˆ†ã‘ã¦ãŠè©±ã—ã—ã¾ã™ã€‚「スワップã™ã‚‹ã®ãŒæ°—æŒã¡æ‚ªã„ã€ã¨è€ƒãˆã¦ã„ã‚‹æ–¹ã¯å°‘ãªããªã„ã¨æ€ã„ã¾ã™ã—ã€ç§ã‚‚ãã†è€ƒãˆã¦ã„ãŸæ™‚期ãŒã‚ã‚Šã¾ã—ãŸã€‚ã—ã‹ã—ã€ãã‚Œã¯æœ¬å½“ã«æ‚ªã„事ãªã®ã‹ã€ä»Šå›žæŽ˜ã‚Šä¸‹ã’ã¦è¡Œãã¾ã™ã€‚ ※主ãªå¯¾è±¡Kernelã¯2.6.32(Red Ha
一時ファイルã¨dentry cacheã¨ãƒ¡ãƒ¢ãƒª - blog.nomadscafe.jp
ã‚ã‚Šã¨é•·ã„é–“æ‚©ã‚“ã§ã„ãŸã‚“ã ã‘ã©ã€æœ€è¿‘解決ã—ãŸã®ã§ãƒ¡ãƒ¢ã€‚ サービスã§åˆ©ç”¨ã—ã¦ã„ã‚‹smalllightã®ç”»åƒå¤‰æ›ã‚µãƒ¼ãƒãŒã€ApacheãŒä½¿ã£ã¦ã„るメモリ以上ã®ãƒ¡ãƒ¢ãƒªã‚’使用ã—ã€Swapã—ãŸã‚Šãƒ¡ãƒ¢ãƒªæž¯æ¸‡ã§ã‚µãƒ¼ãƒãŒãƒ€ã‚¦ãƒ³ã™ã‚‹ãªã©ã®ã“ã¨ãŒä½•åº¦ã‹ã‚ã‚Šã¾ã—ãŸã€‚ ↑メモリã®å‹•ãã¯ã“ã‚“ãªæ„Ÿã˜ ã„ã‚ã„ã‚調ã¹ãŸçµæžœã€Œdentry cacheã€ãªã‚‹ã‚‚ã®ãŒãƒ¡ãƒ¢ãƒªå¤šãã‚’å ã‚ã¦ã„ã‚‹ã“ã¨ãŒã‚ã‹ã‚Šã¾ã—ãŸã€‚dentry cacheã¯ãƒ‡ã‚£ãƒ¬ã‚¯ãƒˆãƒªã‚„ファイルåã¨inodeã¨ã‚’çµã³ã¤ã‘ã«ä½¿ã‚れるã‚ャッシュã§ã™ã€‚smalllightã§ã¯ç”»åƒã‚’変æ›ã™ã‚‹éš›ã«ä¸€æ™‚ファイルを作æˆã™ã‚‹ã®ã§ã€ãã®æƒ…å ±ãŒæ®‹ã‚‹ã‚ˆã†ã§ã™ã€‚ 手元ã§å†ç¾ã•ã›ã‚‹ 本番ã§ä½¿ã£ã¦ã„るサーãƒã¯CentOS5ç³»ã§ã™ãŒã€æ‰‹å…ƒã®Vagrant上ã®CentOS6(ファイルシステムã¯ext4)ã§ã€å†ç¾ã•ã›ã¦ã¿ã¾ã—ãŸã€‚ use Parallel::Prefork; use File::Tem
Objective-C Automatic Reference Counting (ARC) — Clang 20.0.0git documentation
Objective-C Automatic Reference Counting (ARC)¶ About this document¶ Purpose¶ The first and primary purpose of this document is to serve as a complete technical specification of Automatic Reference Counting. Given a core Objective-C compiler and runtime, it should be possible to write a compiler and runtime which implements these new semantics. The secondary purpose is to act as a rationale for wh
iOSアプリ開発ã®ãƒ¡ãƒ¢ãƒªç®¡ç†ã§æ°—ã‚’ã¤ã‘ã‚‹ã“㨠- A Day In The Life
Objective-C ã§ã®é–‹ç™ºã«ã ã„ã¶æ…£ã‚Œã¦ããŸã®ã§ã™ãŒã€ã„ã¾ã メモリ管ç†ã¾ã‚ã‚Šã§ãƒãƒžã‚‹ã“ã¨ãŒå¤šã„ã®ã§ã¾ã¨ã‚ã¦ã¿ã¾ã—ãŸã€‚ メモリを確ä¿ã—ã¦ã‹ã‚‰è§£æ”¾ã™ã‚‹ã¾ã§ã®æµã‚Œ メモリを確ä¿ã—ã¦ã‹ã‚‰è§£æ”¾ã™ã‚‹ã¾ã§ã®æµã‚Œã¯ä»¥ä¸‹ã®å›³ã®ã‚ˆã†ã«ãªã‚Šã¾ã™(図ã¯ã‚¢ãƒƒãƒ—ルã®ã‚µã‚¤ãƒˆã‹ã‚‰å¼•ç”¨)。 alloc ã¾ãŸã¯ init ã™ã‚‹ã¨å‚照カウントãŒ1ã«ãªã‚Šã¾ã™ alloc ã¾ãŸã¯ init 系メソッドを呼ã¶ã¨å‚照カウントãŒ1ã«ãªã‚Šã¾ã™ã€‚ ã“ã®ã‚ˆã†ã«æ›¸ã„ãŸã®ã¯ã€ã‚¯ãƒ©ã‚¹ã®ä»•æ§˜ã«ã‚ˆã£ã¦ alloc メソッド㧠retainCount ãŒ1ã«ãªã‚‹ã‚ªãƒ–ジェクト㨠init ç³»ã®ãƒ¡ã‚½ãƒƒãƒ‰ã§ retainCount ãŒ1ã«ãªã‚‹ã‚ªãƒ–ジェクトãŒã‚ã‚‹ãŸã‚ã§ã™ã€‚alloc 㨠init ã¯ã‚»ãƒƒãƒˆã§å‘¼ã°ã‚Œã‚‹ã“ã¨ãŒã»ã¨ã‚“ã©ãªã®ã§ã“ã®é•ã„ãŒå•é¡Œã«ãªã‚‹ã“ã¨ã¯ãªã„ã¨æ€ã„ã¾ã™ãŒå¿µã®ãŸã‚。 int main() { /* allocã§å‚照カウント1 */ NS
MongoDBã¨ãƒ¡ãƒ¢ãƒªä½¿ç”¨é‡
ã¯ã˜ã‚ã« WAF「Scutum（スã‚ュータム）ã€ã§ã¯ã‚µãƒ¼ãƒ“ス開始時よりã€ãƒ‡ãƒ¼ã‚¿ã‚¹ãƒˆã‚¢ã¨ã—ã¦memcachedã¨pgpool II+PostgreSQLを利用ã—ã¦ã„ã¾ã™ã€‚ã“れらã¯ã©ã‚Œã‚‚安定ã—ã¦å‹•ã„ã¦ãŠã‚Šæº€è¶³ã—ã¦ã„ã‚‹ã®ã§ã™ãŒã€æœ€è¿‘ã«ãªã£ã¦ã‚ˆã‚ŠæŸ”軟ã«ãƒ‡ãƒ¼ã‚¿ã‚’å–ã£ã¦ã„ããŸã„ã¨ã„ã†ãƒ‹ãƒ¼ã‚ºãŒé«˜ããªã£ã¦ããŸãŸã‚ã€MongoDBã®å°Žå…¥ã‚’è¡Œã„ã¾ã—ãŸã€‚ã¾ã 完全ãªãƒªãƒ—レースã¾ã§ã¯è‡³ã£ã¦ã„ã¾ã›ã‚“ãŒã€å…ƒã€…ã®ãƒ‡ãƒ¼ã‚¿ãƒ™ãƒ¼ã‚¹ã®ã‚¹ã‚ãƒ¼ãƒžæ§‹é€ ãŒã‚·ãƒ³ãƒ—ルã§ã‚ã‚‹ã“ã¨ã‚‚ã‚ã‚Šã€æ•°ãƒ¶æœˆä»¥å†…ã«ã¯pgpool II+PostgreSQLã®éƒ¨åˆ†ã‚’MongoDB（Replica Sets）ã§ç½®ãæ›ãˆã‚‹ã“ã¨ãŒã§ãã‚‹ã®ã§ã¯ãªã„ã‹ã¨æ€ã£ã¦ã„ã¾ã™ã€‚ MongoDBã«ã¨ã£ã¦ã®ã€Œãƒ¡ãƒ¢ãƒªä½¿ç”¨é‡ã€ MongoDBã‚’å°Žå…¥ã™ã‚‹ã«ã‚ãŸã‚Šã€Linux(X86_64）上ã§MongoDBを動作ã•ã›ãŸã¨ãã®ãƒ¡ãƒ¢ãƒªã®æ¶ˆè²»ã«ã¤ã„ã¦ã€ç°¡å˜ã«ã§ã™ãŒèª¿ã¹ã¦ã¿ã¾ã—ãŸã€‚ã¾ãšå‚考ã«ã—ãŸã®
ãƒ¡ãƒ¢ãƒªç ´å£Šã®ç¾å ´ã‚’見ã¤ã‘ã‚‹Tips - I am Cruby!
RubyAdventJP, GC, Ruby（ã“ã®è¨˜äº‹ã¯Ruby Advent Calendar jp: 2009 : ATNDã®4日目ã§ã™ã€‚å‰æ—¥ã¯mrknã•ã‚“ã§ã—ãŸï¼‰ã€€å¥å…¨ãªã‚‹Rubyistã§ã‚ã‚Œã°ã€Rubyã®GCã‚’ã„ã˜ã‚‹ã“ã¨ãŒé€±ã«ä¸€åº¦ã¯ã‚ã‚‹ã§ã—ょã†ã€‚ãã®ã¨ãã«å›°ã‚‹ã®ãŒã€GCã‚’ã„ã˜ã£ã¦ã—ã¾ã£ãŸã“ã¨ã«ã‚ˆã‚‹ãƒã‚°ã®ä¿®æ£ã§ã™ã€‚GCã‚’ã„ã˜ã‚‹ã¨ã„ã†ã®ã¯æƒ³åƒä»¥ä¸Šã«é›£ã—ãã€å°‘ã—ã§ã‚‚書ãé–“é•ãˆã‚‹ã¨ãƒ¡ãƒ¢ãƒªç ´å£ŠãŒç™ºç”Ÿã—ã¾ã™ã€‚ãã®ã¨ãã«ä½¿ãˆã‚‹Tipsã‚’ã“ã®è¨˜äº‹ã§æ›¸ãã“ã¨ã«ã—ã¾ã™ã€‚　ã¿ãªã•ã‚“ã”å˜ã˜ã®é€šã‚Šã€ãƒ¡ãƒ¢ãƒªç ´å£Šã¨ã„ã†ã®ã¯åŽŸå› を特定ã™ã‚‹ã®ãŒå›°é›£ã§ã™ã€‚ã“ã‚Œã¯å•é¡ŒãŒç™ºè¦šã™ã‚‹å ´æ‰€ã¨ãƒ¡ãƒ¢ãƒªç ´å£ŠãŒèµ·ã“ã£ãŸç¾å ´ãŒä½ç½®çš„ã«é ã„ã“ã¨ã«èµ·å› ã—ã¦ã„ã¾ã™ã€‚å‰å¤§ãªã‚‹ãƒãƒƒã‚«ãƒ¼ã®ã¾ã¤ã‚‚ã¨ã•ã‚“ã§ã™ã‚‰ã€ãã®ç™ºè¦‹ã¯å›°é›£ã§ã™ã€‚　[ruby-dev:38628] Re: [BUG: trunk] called on terminated objec
メモリを食ã„ã¾ãるプãƒã‚»ã‚¹ãŒãƒ¡ãƒ¢ãƒªä½¿ç”¨é‡ã«ä¸Žãˆã‚‹å½±éŸ¿ã‚’topã§è¿½ã†
æš´èµ°ã—ã¦ã©ã‚“ã©ã‚“メモリを食ã†ã‚¹ã‚¯ãƒªãƒ—ト㌠OS全体ã®ãƒ¡ãƒ¢ãƒªä½¿ç”¨é‡(CentOS5 ... カーãƒãƒ«ã¯2.6ç³»ã«ãªã‚‹)ã®å‹•ä½œã«ã©ã‚“ãªå½±éŸ¿ã‚’与ãˆã‚‹ã®ã‹ã€€ã£ã¦ã®ã‚’見るãŸã‚ã«ä»¥ä¸‹ã®ã‚ˆã†ãªãƒ†ã‚¹ãƒˆã‚’ã—ã¦ã¿ã¾ã—ãŸã€‚仕組ã¿ã¯ã ã„ãŸã„ç†è§£ã—ã¦ã‚‹ã‘ã©ã€ç´°ã‹ã„数値を追ã£ãŸã“ã¨ã¯ãªã‹ã£ãŸã®ã§ã‚„ã£ã¦ã¿ã¾ã—ãŸã€‚ sshã§ãƒã‚°ã‚¤ãƒ³ã—ã¦ã€topã‚’ç«‹ã¡ä¸Šã’る。プãƒã‚»ã‚¹ã‚’見張る用æ„ã‚’ã—ã¦ãŠã 別ã®sshã‚’ãŸã¡ã‚ã’ã¦ã€ Perlワンライナーã§ä»¥ä¸‹ã®ã‚ˆã†ãªãƒ—ãƒã‚»ã‚¹ã‚’走らã›ã‚‹(ã“ã®ãƒ—ãƒã‚»ã‚¹ã‚’topã§è¦‹å¼µã‚‹) # 1秒ã”ã¨ã«5MBå˜ä½ã§ãƒ¡ãƒ¢ãƒªã‚’食ã†ãƒ—ãƒã‚»ã‚¹ # 数値ã¯ãŠå¥½ã¿ã§ perl -e "while(1){ sleep 1; push @h , 1 x 1024 x 1024 x 5 } " ã¡ãªã¿ã«topã§è¦‹å¼µã‚‹ã¨ã㯠メモリ使用é‡ã§ã‚½ãƒ¼ãƒˆã•ã‚Œã‚‹ã‚ˆã†ã«ã—㦠topèµ·å‹•ä¸ã« shift + o を押ã—㦠n を押ã™ã¨ 実メモリ
1
リリースã€éšœå®³æƒ…å ±ãªã©ã®ã‚µãƒ¼ãƒ“スã®ãŠçŸ¥ã‚‰ã›
最新ã®äººæ°—エントリーã®é…ä¿¡
j次ã®ãƒ–ックマーク
kå‰ã®ãƒ–ックマーク
lã‚ã¨ã§èªã‚€
eコメント一覧を開ã
oページを開ã
GitHub - 504ensicsLabs/LiME: LiME (formerly DMD) is a Loadable Kernel Module (LKM), which allows the acquisition of volatile memory from Linux and Linux-based devices, such as those powered by Android. The tool supports acquiring memory either to the file
hiroyuki ⇔ ıʞnÊŽoɹıɥ on Twitter: "twitterアカウントå–ã£ã¦ã¿ãŸã€‚æ–‡å—ã®è‰²å¤‰ãˆã‚Œã‚‹ã‘ã©ã€è‚心ã®èƒŒæ™¯ãŒç™½ã‹ã‚‰å¤‰æ›´å‡ºæ¥ãªã„ã£ã¦ãƒ»ãƒ»ãƒ»ãªã‚“ã よã“ã‚Œ(笑)"
{{#tags}}- {{label}}
{{/tags}}