'공부/Reversing'에 해당되는 글 5건

  1. 2013.03.08 Android-Trojan/FakeInst
  2. 2013.03.06 Win-Trojan/Scar.109568.U
  3. 2013.03.06 Win32/Aimbot.worm.15872
  4. 2013.02.08 MUP 강좌 페이지 링크 모음 1
  5. 2012.08.12 Windows Kernel Debugger(VirtualKD) 1

Android-Trojan/FakeInst

공부/Reversing 2013. 3. 8. 14:17 |

첫 안드로이드 악성코드 분석


배우지도 않은 자바를 배우게되네


http://www.popstar1.com으로 유포되는 042.apk에 관한 분석 보고서입니다.



042apk_Report.pdf



저작자표시 비영리 변경금지

'공부 > Reversing' 카테고리의 다른 글

Win-Trojan/Scar.109568.U  (0) 2013.03.06
Win32/Aimbot.worm.15872  (0) 2013.03.06
MUP 강좌 페이지 링크 모음  (1) 2013.02.08
Windows Kernel Debugger(VirtualKD)  (1) 2012.08.12
Posted by extr
:

Win-Trojan/Scar.109568.U

공부/Reversing 2013. 3. 6. 00:30 |


Win-Trojan/Scar.109568.U 분석


5d25e3f2a9dfb7a032089cf1dfccfa8f분석.pdf



저작자표시 비영리 변경금지

'공부 > Reversing' 카테고리의 다른 글

Android-Trojan/FakeInst  (0) 2013.03.08
Win32/Aimbot.worm.15872  (0) 2013.03.06
MUP 강좌 페이지 링크 모음  (1) 2013.02.08
Windows Kernel Debugger(VirtualKD)  (1) 2012.08.12
Posted by extr
:

Win32/Aimbot.worm.15872

공부/Reversing 2013. 3. 6. 00:28 |

Win32/Aimbot.worm.15872 분석

(일명 2090바이러스)


2090분석.pdf


저작자표시 비영리 변경금지

'공부 > Reversing' 카테고리의 다른 글

Android-Trojan/FakeInst  (0) 2013.03.08
Win-Trojan/Scar.109568.U  (0) 2013.03.06
MUP 강좌 페이지 링크 모음  (1) 2013.02.08
Windows Kernel Debugger(VirtualKD)  (1) 2012.08.12
Posted by extr
:

MUP 강좌 페이지 링크 모음

공부/Reversing 2013. 2. 8. 21:20 |

Manual Unpacking 에 대한 해외 자료 입니다.

 

  • ASProtect 1.23 RC4 - 1.3.08.24 with CloneCD.htm
  • ASProtect 1.23 RC4 - 1.3.08.24 with CloneCD_files/
  • ASProtect_2.x_SKE_inline_patching_tutorial_by_ThunderPwr_trans.htm
  • ASProtect_2.x_SKE_inline_patching_tutorial_by_ThunderPwr_trans_files/
  • Amardillo 4.xx-Patching Hardware Fingerprint (HWID).htm
  • Amardillo 4.xx-Patching Hardware Fingerprint (HWID)_files/
  • AntiTracks_Arm 4.xx-Code Splicing.htm
  • AntiTracks_Arm 4.xx-Code Splicing_files/
  • AoA DVD Ripper.htm
  • AoA DVD Ripper_files/
  • Armadillo & Macromedia Games.htm
  • Armadillo & Macromedia Games_files/
  • Armadillo 3.70_IAT elimination_Code splicing_Standard.htm
  • Armadillo 3.70_IAT elimination_Code splicing_Standard_files/
  • Armadillo 4.xx- Code Splicing (Other Method).htm
  • Armadillo 4.xx- Code Splicing (Other Method)_files/
  • Armadillo 5.x Dll - Visual.Assist.X.V10.4.1640 Build 2008.05.22.htm
  • Armadillo 5.x Dll - Visual.Assist.X.V10.4.1640 Build 2008.05.22_files/
  • Armadillo DLL – Unpacking and MORE.htm
  • Armadillo DLL – Unpacking and MORE_files/
  • Armadillo Exact Version Location Tutorial.htm
  • Armadillo Exact Version Location Tutorial_files/
  • Armadillo v3.xx Manual Unpacking.htm
  • Armadillo v3.xx Manual Unpacking_files/
  • Armadillo_tut_serie1.htm
  • Armadillo_tut_serie1_files/
  • Armadillo_tut_serie1_fixed.htm
  • Armadillo_tut_serie1_fixed_files/
  • Armadillo_tut_serie2.htm
  • Armadillo_tut_serie2_files/
  • Armadillo_tut_serie3.htm
  • Armadillo_tut_serie3_files/
  • Armadillo_tut_serie4.htm
  • Armadillo_tut_serie4_files/
  • Armadillo_tut_serie5.htm
  • Armadillo_tut_serie5_files/
  • Armdillo_tut_serie6.htm
  • Armdillo_tut_serie6_files/
  • Asprotect20beta.htm
  • Asprotect20beta_files/
  • AutoPlayMediaStudio6_Arm 4.xx - Standard Protection+IAT Elimination.htm
  • AutoPlayMediaStudio6_Arm 4.xx - Standard Protection+IAT Elimination_files/
  • Basic Steps to Unpack.htm
  • Basic Steps to Unpack_files/
  • Bypass Registration EncryptPE V2.2007.htm
  • Bypass Registration EncryptPE V2.2007_files/
  • Cach khac de defeat debugBlocker.htm
  • Cach khac de defeat debugBlocker_files/
  • Code_Splicing_Evil_Method.htm
  • Code_Splicing_Evil_Method_files/
  • DOC_Regenerator211_Debug Blocker+ Hardware Finger Print.htm
  • DOC_Regenerator211_Debug Blocker+ Hardware Finger Print_files/
  • Debugblocker + Nanomites.htm
  • Debugblocker + Nanomites_files/
  • DiaryOne 5.6.htm
  • DiaryOne 5.6_files/
  • ExeCryptor_2.2.x_2.3.x.htm
  • ExeCryptor_2.2.x_2.3.x_files/
  • Game Editor 1.3.2.htm
  • Game Editor 1.3.2_files/
  • GetRight60beta_Arm 4.xx Full Protections.htm
  • GetRight60beta_Arm 4.xx Full Protections_files/
  • GetRight_5_0_Final_Arm 2.xx-3.xx - Debug Blocker+CopyMem.htm
  • GetRight_5_0_Final_Arm 2.xx-3.xx - Debug Blocker+CopyMem_files/
  • How to unpack AHTeam EP Protector 0.3.htm
  • How to unpack AHTeam EP Protector 0.3_files/
  • How to unpack ASPack 2.12_dqtln.htm
  • How to unpack ASPack 2.12_dqtln_files/
  • How to unpack ASProtect 1.22-1.23.htm
  • How to unpack ASProtect 1.22-1.23_files/
  • How to unpack ASProtect 1.23 RC4_dqtln.htm
  • How to unpack ASProtect 1.23 RC4_dqtln_files/
  • How to unpack ASProtect.htm
  • How to unpack ASProtect_files/
  • How to unpack AntiCrack Protector 1.0x.htm
  • How to unpack AntiCrack Protector 1.0x_files/
  • How to unpack Asprotect 1.23 rc4 series1.htm
  • How to unpack Asprotect 1.23 rc4 series1_files/
  • How to unpack Asprotect 1.23 rc4 series2.htm
  • How to unpack Asprotect 1.23 rc4 series2_files/
  • How to unpack FSG v1.33.htm
  • How to unpack FSG v1.33_files/
  • How to unpack FSGv2.0.htm
  • How to unpack FSGv2.0_files/
  • How to unpack PELock v1.0x.htm
  • How to unpack PELock v1.0x_files/
  • How to unpack PESpin v0.3.htm
  • How to unpack PESpin v0.3_files/
  • How to unpack Petite 2.2.htm
  • How to unpack Petite 2.2_files/
  • How to unpack exe32packv1.42.htm
  • How to unpack exe32packv1.42_files/
  • HyperSnap-DX_Arm 4.xx - Standard Protection_IAT Elimination_Code Splicing.htm
  • HyperSnap-DX_Arm 4.xx - Standard Protection_IAT Elimination_Code Splicing_files/
  • Inline Patching Ap Document to PDF Converter v3.htm
  • Inline Patching Ap Document to PDF Converter v3_files/
  • Inline_Patching for UPX.htm
  • Inline_Patching for UPX_files/
  • InsaneFIDO UnWrapMe.htm
  • InsaneFIDO UnWrapMe_files/
  • Intro.htm
  • Intro_files/
  • MANUAL UNPACK Software Compress 1.2.htm
  • MANUAL UNPACK Software Compress 1.2_files/
  • MUP Armadillo 3.78_Crack and reduce size of ASFConverter 2.68.htm
  • MUP Armadillo 3.78_Crack and reduce size of ASFConverter 2.68_files/
  • MUP Armadillo v4.64 Small Case.htm
  • MUP Armadillo v4.64 Small Case_files/
  • MUP Armadillo v5.42 Case Study.htm
  • MUP Armadillo v5.42 Case Study_files/
  • MUP Armadillo v600.htm
  • MUP Armadillo v600_files/
  • MUP EXEcryptor v2.2.6 with target_ PowerArchiver 2007.htm
  • MUP EXEcryptor v2.2.6 with target_ PowerArchiver 2007_files/
  • MUP ID Application Protector 1.2.htm
  • MUP ID Application Protector 1.2_files/
  • MUP NTkrnl_Protector_0.1.htm
  • MUP NTkrnl_Protector_0.1_files/
  • MUP_Armadillo_Fraps_Code_Splicing_+_IAT_Elimination.htm
  • MUP_Armadillo_Fraps_Code_Splicing_+_IAT_Elimination_files/
  • Manual unpacking FSG 2.0.htm
  • Manual unpacking FSG 2.0_files/
  • Manual unpacking Petite 2.3.htm
  • Manual unpacking Petite 2.3_files/
  • Manual unpacking Mew 11 SE v1.2.htm
  • Manual unpacking Mew 11 SE v1.2_files/
  • Manual Fixing IAT-NTKRNL Packer.htm
  • Manual Fixing IAT-NTKRNL Packer_files/
  • Manual Removing Visual Protect 3.5.4.htm
  • Manual Removing Visual Protect 3.5.4_files/
  • Manual Unpack ACTIVEMARK 5.31.htm
  • Manual Unpack ACTIVEMARK 5.31_files/
  • Manual Unpack ActiveMark 5.x.htm
  • Manual Unpack ActiveMark 5.x_files/
  • Manual Unpack Armadillo v4.62.htm
  • Manual Unpack Armadillo v4.62_files/
  • Manual Unpack ExeStealth.htm
  • Manual Unpack ExeStealth_files/
  • Manual Unpack PECompact 1.68-1.84.htm
  • Manual Unpack PECompact 1.68-1.84_files/
  • Manual Unpack PECompact 2.x.htm
  • Manual Unpack PECompact 2.x_files/
  • Manual Unpack PESpinv0.7 tlandn.htm
  • Manual Unpack PESpinv0.7 tlandn_files/
  • Manual Unpack tElock 0.90.htm
  • Manual Unpack tElock 0.90_files/
  • Manual Unpacking & Cracking ActiveMark 5.xx.htm
  • Manual Unpacking & Cracking ActiveMark 5.xx_files/
  • Manual Unpacking ExeCryptor 2.2.50.htm
  • Manual Unpacking ExeCryptor 2.2.50_files/
  • Manual Unpacking MoleBox v2.5.7 and Serial Fishing.htm
  • Manual Unpacking MoleBox v2.5.7 and Serial Fishing_files/
  • Manual Unpacking PEQuake v0.htm
  • Manual Unpacking PEQuake v0_files/
  • Manual Unpacking SVKP 1.32 Tut 1 - ASM Target.htm
  • Manual Unpacking SVKP 1.32 Tut 1 - ASM Target_files/
  • Manual Unpacking Total Uninstall 3.7.htm
  • Manual Unpacking Total Uninstall 3.7_files/
  • Manual Unpacking Zip Repair Tool 3.2.htm
  • Manual Unpacking Zip Repair Tool 3.2_files/
  • Manual Unpacking hmimys-Packer 1.0.htm
  • Manual Unpacking hmimys-Packer 1.0_files/
  • Manual unpack ASProtect 1.23 RC 4_by hacnho.htm
  • Manual unpack ASProtect 1.23 RC 4_by hacnho_files/
  • Manual unpacking EXE Shield v0.5.htm
  • Manual unpacking EXE Shield v0.5_files/
  • Manual unpacking EZIP 1.0.htm
  • Manual unpacking EZIP 1.0_files/
  • Manual unpacking FSG 1.0.htm
  • Manual unpacking FSG 1.0_files/
  • Manual unpacking FSG 2.0 modified.htm
  • Manual unpacking FSG 2.0 modified_files/
  • Manual unpacking FSG v2.0.htm
  • Manual unpacking FSG v2.0_files/
  • Manual unpacking MEW 11 SE v1.1.htm
  • Manual unpacking MEW 11 SE v1.1_files/
  • Manual unpacking Mew 10 exe-coder 1.0.htm
  • Manual unpacking Mew 10 exe-coder 1.0_files/
  • Manual unpacking Morphine 1.4 - 2.7.htm
  • Manual unpacking Morphine 1.4 - 2.7_files/
  • Manual unpacking PE Diminisher v0.1.htm
  • Manual unpacking PE Diminisher v0.1_files/
  • Manual unpacking PE Lock NT 2.04.htm
  • Manual unpacking PE Lock NT 2.04_files/
  • Manual unpacking PE-SHiELD v0.25.htm
  • Manual unpacking PE-SHiELD v0.25_files/
  • Manual unpacking PECompact 1.84.htm
  • Manual unpacking PECompact 1.84_files/
  • Manual unpacking PECompact 2.0 Final.htm
  • Manual unpacking PECompact 2.0 Final_files/
  • Manual unpacking PECompact v2.38.htm
  • Manual unpacking PECompact v2.38_files/
  • Manual unpacking SPLayer 0.08.htm
  • Manual unpacking SPLayer 0.08_files/
  • Manual unpacking UPX Protector 1.0x.htm
  • Manual unpacking UPX Protector 1.0x_files/
  • Manual unpacking Virogen Crypt v0.75.htm
  • Manual unpacking Virogen Crypt v0.75_files/
  • Manual unpacking WWPack32 1.x.htm
  • Manual unpacking WWPack32 1.x_files/
  • Manual unpacking tElock 0.98b1.htm
  • Manual unpacking tElock 0.98b1_files/
  • Manual unpacking y0da's Crypter v1.2.htm
  • Manual unpacking y0da's Crypter v1.2_files/
  • Movie Collector 4.4_CopyMemII+Nanomites.htm
  • Movie Collector 4.4_CopyMemII+Nanomites_files/
  • Mup Unpack Execryptor 2.x tlandn.htm
  • Mup Unpack Execryptor 2.x tlandn_files/
  • My Screen Recorder Pro 2.htm
  • My Screen Recorder Pro 2_files/
  • Obsidium 1.2.5.0 - unpacking.htm
  • Obsidium 1.2.5.0 - unpacking_files/
  • PictureRipper3_Armadillo 4.xx- Import Elimination+Nanomites.htm
  • PictureRipper3_Armadillo 4.xx- Import Elimination+Nanomites_files/
  • ProtectShareware.htm
  • ProtectShareware_files/
  • ProtectionPlus 4.x_takada.htm
  • ProtectionPlus 4.x_takada_files/
  • RLPack 1.19 Research.htm
  • RLPack 1.19 Research_files/
  • Remote System Information 3.2.htm
  • Remote System Information 3.2_files/
  • SWFDecompilerArm 4.xx - Standard Protection.htm
  • SWFDecompilerArm 4.xx - Standard Protection_files/
  • SWFText 1.2 .htm
  • SWFText 1.2 _files/
  • SafeDISC2.x.htm
  • SafeDISC2.x_files/
  • Safedisc-Easy or Hard - Vol 1.htm
  • Safedisc-Easy or Hard - Vol 1_files/
  • Safedisc-Easy or Hard - Vol 2.htm
  • Safedisc-Easy or Hard - Vol 2_files/
  • Safedisc-Easy or Hard - Vol 3.htm
  • Safedisc-Easy or Hard - Vol 3_files/
  • SoftWrap 6.1.1_Loader.htm
  • SoftWrap 6.1.1_Loader_files/
  • Stupid Execryptor-Fixing Dump.htm
  • Stupid Execryptor-Fixing Dump_files/
  • Stupid Execryptor-small trick.htm
  • Stupid Execryptor-small trick_files/
  • Tag&Rename32rc3_Inline Patching ASProtect 2.2 SKE .htm
  • Tag&Rename32rc3_Inline Patching ASProtect 2.2 SKE _files/
  • The Egnima Protector 1.33.htm
  • The Egnima Protector 1.33_files/
  • Themida_Tutorial 6.htm
  • Themida_Tutorial 6_files/
  • Themida_Tutorial1.htm
  • Themida_Tutorial1_files/
  • Themida_Tutorial2.htm
  • Themida_Tutorial2_files/
  • Themida_Tutorial3.htm
  • Themida_Tutorial3_files/
  • Themida_Tutorial4.htm
  • Themida_Tutorial4_files/
  • Themida_Tutorial5.htm
  • Themida_Tutorial5_files/
  • Themida_Tutorial6_exp1.htm
  • Themida_Tutorial6_exp1_files/
  • Themida_Tutorial6_exp2.htm
  • Themida_Tutorial6_exp2_files/
  • TrojanRemover6.4.4_Trojan Remover-DebugBlocker+Nanomites.htm
  • TrojanRemover6.4.4_Trojan Remover-DebugBlocker+Nanomites_files/
  • UNPACKING SLVc0deProtector 1.11 Tut 1_tlandn.htm
  • UNPACKING SLVc0deProtector 1.11 Tut 1_tlandn_files/
  • UNPACKING SLVc0deProtector 1.11 Tut 2_tlandn.htm
  • UNPACKING SLVc0deProtector 1.11 Tut 2_tlandn_files/
  • UnPackMe_Armadillo3.70a.b.htm
  • UnPackMe_Armadillo3.70a.b_files/
  • Unpack PEDiminisher 0.1.htm
  • Unpack PEDiminisher 0.1_files/
  • Unpack ASPack 2.1.htm
  • Unpack ASPack 2.12.htm
  • Unpack ASPack 2.12_files/
  • Unpack ASPack 2.1_files/
  • Unpack ASProtect 1.23 RC4.htm
  • Unpack ASProtect 1.23 RC4_files/
  • Unpack Armadillo - Standard protection only_vietnamese.htm
  • Unpack Armadillo - Standard protection only_vietnamese_files/
  • Unpack Aspack 1.06b_1.061b.htm
  • Unpack Aspack 1.06b_1.061b_files/
  • Unpack Ezip 1.0.htm
  • Unpack Ezip 1.0_files/
  • Unpack Mew 10 exe-coder 1.0.htm
  • Unpack Mew 10 exe-coder 1.0_files/
  • Unpack NeoLite2.htm
  • Unpack NeoLite2_files/
  • Unpack PE Pack v1.0.htm
  • Unpack PE Pack v1.0_files/
  • Unpack PECompact 1.68_1.84.htm
  • Unpack PECompact 1.68_1.84_files/
  • Unpack PECompact v1.76.htm
  • Unpack PECompact v1.76_files/
  • Unpack UnpackMe1_by_KLiZMA.htm
  • Unpack UnpackMe1_by_KLiZMA_files/
  • Unpack UpX 0.896_1.02.htm
  • Unpack UpX 0.896_1.02_files/
  • Unpack and Crack Full XP Tools version 4.58.htm
  • Unpack and Crack Full XP Tools version 4.58_files/
  • Unpack manual PECompact version 2.55.htm
  • Unpack manual PECompact version 2.55_files/
  • UnpackMe_CopyMemII_Nanomites.htm
  • UnpackMe_CopyMemII_Nanomites_files/
  • Unpack_Armadillo_01.htm
  • Unpack_Armadillo_01_files/
  • Unpack_Armadillo_02.htm
  • Unpack_Armadillo_02_files/
  • Unpacking & Cracking RAR Repair Tool 3.0.htm
  • Unpacking & Cracking RAR Repair Tool 3.0_files/
  • Unpacking ASProtect 2.3 SKE.htm
  • Unpacking ASProtect 2.3 SKE_files/
  • Unpacking ASProtect 2.XX SKE.htm
  • Unpacking ASProtect 2.XX SKE_files/
  • Unpacking ActiveMark level 2 entry point.htm
  • Unpacking ActiveMark level 2 entry point_files/
  • Unpacking Armadillo 4.xx For Newbie 2.htm
  • Unpacking Armadillo 4.xx For Newbie 2_files/
  • Unpacking EXEcryptor 2.3x.htm
  • Unpacking EXEcryptor 2.3x_files/
  • Unpacking Flash Recovery 2.35.htm
  • Unpacking Flash Recovery 2.35_files/
  • Unpacking SLVc0deProtector 1.1.htm
  • Unpacking SLVc0deProtector 1.1_files/
  • Unpacking Unpackme (ASPack + MSLRH).htm
  • Unpacking Unpackme (ASPack + MSLRH)_files/
  • Unpacking Wrapper used by GameHouse.com_tlandn.htm
  • Unpacking Wrapper used by GameHouse.com_tlandn_files/
  • Unwrapping_Reflexive_Arcade_EvilInvasion.htm
  • Unwrapping_Reflexive_Arcade_EvilInvasion_files/
  • Upack Armadillo 3.70a_VCT5.htm
  • Upack Armadillo 3.70a_VCT5_files/
  • Various Asprotect Loader Tricks.htm
  • Various Asprotect Loader Tricks_files/
  • XTM_Arm 4.xx - Standard Protection+Code Splicing+IAT Elimination.htm
  • XTM_Arm 4.xx - Standard Protection+Code Splicing+IAT Elimination_files/
  • Yoda's protectors v1.02[MUP].htm
  • Yoda's protectors v1.02[MUP]_files/
  • Yoda's protectors v1.03.2 beta3[MUP].htm
  • Yoda's protectors v1.03.2 beta3[MUP]_files/
  • Yoda's protectors v1.03.2[MUP].htm
  • Yoda's protectors v1.03.2[MUP]_files/
  • Yoda's protectors v1.03.3[MUP].htm
  • Yoda's protectors v1.03.3[MUP]_files/
  • [MUP & CRACKING] MoleBox Pro 2.6 Trial -Volume 1.htm
  • [MUP & CRACKING] MoleBox Pro 2.6 Trial -Volume 1_files/
  • armdillo_tuts_6_exp.htm
  • armdillo_tuts_6_exp_files/
  • armdillo_tuts_7.htm
  • armdillo_tuts_7_exp.htm
  • armdillo_tuts_7_exp_files/
  • armdillo_tuts_7_files/
  • armdillo_tuts_8.htm
  • armdillo_tuts_8_files/
  • armdillo_tuts_9.htm
  • armdillo_tuts_9_files/
  • unpack Asprotect 1.2.htm
  • unpack Asprotect 1.2_files/
  • unpack PECompact 1.68 – 1.84.htm
  • unpack PECompact 1.68 – 1.84_files/
  • unpack PECompact 2.x.htm
  • unpack PECompact 2.x_files/
  • unpack UPX Scramble RC 1.x.htm
  • unpack UPX Scramble RC 1.x_files/
  • unpack Yoda Cryptor 1.2.htm
  • unpack Yoda Cryptor 1.2_files/

  • 출처 - 네이버카페 (cafe.naver.com/unpackme)

    • 저작자표시 비영리 변경금지

    '공부 > Reversing' 카테고리의 다른 글

    Android-Trojan/FakeInst  (0) 2013.03.08
    Win-Trojan/Scar.109568.U  (0) 2013.03.06
    Win32/Aimbot.worm.15872  (0) 2013.03.06
    Windows Kernel Debugger(VirtualKD)  (1) 2012.08.12
    Posted by extr
    :

    Windows Kernel Debugger(VirtualKD)

    공부/Reversing 2012. 8. 12. 16:12 |

    가상메모리 변환좀 본답시고 윈도우 커널 디버깅을 할려고 했는데


    찾아 보니까 윈도우 커널 디버깅은 가장 잘 알려진 방식이 두 가지가 있더라구요


    첫 번째가 Windbg를 C/S방식으로 VM과 시리얼포트 연결해서 하는 방법이고,


    두 번째가 Windbg와 LiveKD를 이용해서 로컬 커널 디버깅 하는 방식.


    이렇게 나뉘어져 있는데..


    문제는


    제 컴퓨터에선 둘 다 안되더라구요 ㅡㅡ


    첫 번째 방법은 디버그 모드 진입을 해도 WINDBG가 인식을 하질 않고.. 두 번째 방법은 livekd가 모듈 찾을 수 없다고 하고..(이건 제 잘못일지도 모르겠네여)



    그렇게 이틀동안 해결할라꼬 별의 별짓 다하다가 오늘 발견한게 바로 이 VirtualKD!


    VirtualKD는 VM머신과 연동해서 사용할 수 있는 커널 디버깅 프로그램인데요 

    위 두 가지 방식과는 다르게 이건 프로그램 지 혼자서 설정 다해주고 바로바로 할 수가 있는 프로그램임다


    VirtualKD의 다운로드는 여기를 클릭하시면 링크로 이동합니다!



    VirtualKD의 사용 방법은 매우 간단합니다.







    1. target폴더를 대상 VM에다 옮기세요.



    2. vmmon을 분석할 컴퓨터에서 실행하세요(32비트의 경우, vmmon을 실행해주시고 64비트의 경우 vmmon64를 실행해주세요).





    3. VM에서 target 폴더로 들어가셔서 vminstall.exe를 실행시켜주세요.



    이제 준비 끝입니다. 2번에서 vmmon을 실행했는데 한번 볼까여









    VM의 파이프네임을 확인해주시고 선택해주세요.



    아! 그리고 디버거도 선택할 수 있습니다. 저같은 경우엔, Windbg로 디버깅을 할 것이기 때문에 debugger path를 windbg로 설정했구요.



    설정을 완료하신 후에 run debugger를 누르시면 디버거가 실행되며, 정상적으로 커널 디버깅 모드에 진입한 것을 확인할 수 있습니다.



    어휴 이렇게 보니까 진짜 매우 간단하네요 짱쉽져?





    저작자표시 비영리 변경금지

    '공부 > Reversing' 카테고리의 다른 글

    Android-Trojan/FakeInst  (0) 2013.03.08
    Win-Trojan/Scar.109568.U  (0) 2013.03.06
    Win32/Aimbot.worm.15872  (0) 2013.03.06
    MUP 강좌 페이지 링크 모음  (1) 2013.02.08
    Posted by extr
    :

    티스토리툴바