trustworthy computing reverse engineers agree on that
play

Trustworthy Computing * Reverse engineers agree on that! - PowerPoint PPT Presentation

Trustworthy Computing * Reverse engineers agree on that! Trustworthy Computing Trustworthy Computing Trustworthy Computing Trustworthy Computing Trustworthy Computing Trustworthy Computing *


  1. Trustworthy Computing

  2. * Reverse engineers agree on that! Trustworthy Computing

  3. Trustworthy Computing

  4. Trustworthy Computing

  5. Trustworthy Computing

  6. Trustworthy Computing

  7. Trustworthy Computing

  8. * http://technet.microsoft.com/en-us/library/dd837644(v=WS.10).aspx Trustworthy Computing

  9. Trustworthy Computing

  10. Trustworthy Computing

  11. SetProcessDEPPolicy Trustworthy Computing

  12. Trustworthy Computing

  13. ntdll!NtMapViewOfSection Trustworthy Computing

  14. Trustworthy Computing

  15. Trustworthy Computing

  16. Trustworthy Computing

  17. Trustworthy Computing

  18. Trustworthy Computing

  19. Trustworthy Computing

  20. Trustworthy Computing

  21. Trustworthy Computing

  22. * https://code.google.com/p/ropguard/ Trustworthy Computing

  23. Note: EMET 4.0 implements ROP mitigations for 32-bit processes only Trustworthy Computing

  24. Trustworthy Computing

  25. Trustworthy Computing

  26. Trustworthy Computing

  27. * http://research.microsoft.com/en-us/projects/detours/ Trustworthy Computing

  28. Trustworthy Computing

  29. Trustworthy Computing

  30. kernel32!VirtualAllocEx() Trustworthy Computing

  31. Trustworthy Computing

  32. Trustworthy Computing

  33. Trustworthy Computing

  34. Trustworthy Computing

  35. Trustworthy Computing

  36. Trustworthy Computing

  37. CALL kernel32!VirtualAlloc ; <- target Trustworthy Computing

  38. RET RET Trustworthy Computing

  39. Trustworthy Computing

  40. Trustworthy Computing

  41. Trustworthy Computing

  42. Trustworthy Computing

  43. Trustworthy Computing

  44. Trustworthy Computing

  45. Trustworthy Computing

  46. Trustworthy Computing

  47. API call to VirtualAlloc() happens at 0x6D970A6A thus triggering EXEC flow simulation Trustworthy Computing

  48. Trustworthy Computing

  49. Trustworthy Computing

  50. Trustworthy Computing

  51. Load library checks Trustworthy Computing

  52. Memory protection change Trustworthy Computing

  53. Trustworthy Computing

  54. 1. 2. 3. Trustworthy Computing

  55. Trustworthy Computing

  56. Trustworthy Computing

  57. Trustworthy Computing

  58. * http://msdn.microsoft.com/en-us/library/windows/desktop/aa382405(v=vs.85).aspx Trustworthy Computing

  59. http://blogs.technet.com/b/srd/archive/2013/ 05/08/emet-4-0-s-certificate-trust- feature.aspx http://blogs.technet.com/b/srd/archive/2013/ 04/18/introducing-emet-v4-beta.aspx Trustworthy Computing

  60. Trustworthy Computing

  61. emet_feedback@microsoft.com Trustworthy Computing

  62. Trustworthy Computing

Recommend


More recommend