MWS 2012 ハンズオン 事前申し込み案内 – IIJ Security Diary
前回のブログでお伝えしたとおり、MWS 2012 でインシデントレスポンスのハンズオンを実施いたします。CSS/MWS 2012 の参加者はどなたでも参加いただけますので、ふるってご参加ください。 ただし、会場やリソースの関係から、参加人数を制限しています。席が空いていれば当日参加も可能ですが、当日の座席も事前申し込みされた方を優先致しますので、下記をご覧いただき、お早めにお申し込みください。 タイトル インシデントレスポンス (フォレンジック調査、マルウェア解析) 日時 2012年11月1日(木) 8:40-11:20 場所 くにびきメッセ（島根県立産業交流会館）会場6 (401会議室) 〒690-0826 島根県松江市学園南1丁目2番1号 会場のレイアウト上、後ろの方の席からはスクリーンが見えにくい可能性があります。また、当日参加の方は、後方の席になる可能性があります。 提供 株式会社
保護モードの昇格ダイアログを理解する
Understanding the Protected Mode Elevation Dialog http://blogs.msdn.com/b/ieinternals/archive/2009/12/01/understanding-internet-explorer-security-protected-mode-elevation-dialog.aspx ずいぶん古い記事になりますが、今まで Windows XP 環境のユーザーが Windows 7 / Windows 8 の環境に更新するケースは今年多そうなので、改めて確認する意味でも意外と知られていない保護モードの動作についての話題を一つ訳してみました。特に「許可しない」をクリックしている限りはこのダイアログが永遠に出続ける、という話は興味深いですね。 以下の文章は EricLaw’s IEInternals の 2009/1
少妇影院_h在线观看免费_亚州成肉网_www.亚洲免费成人
少妇影院,h在线观看免费,亚州成肉网,www.亚洲免费成人,亚洲精品中文字幕天天操资源,成人网站在线操b,我公司将继续坚持以客户需求为己任，客户满意为目标，用好的产品质量服务广大客户。
New Security Assertions in “Windows 8” – Alex Ionescu’s Blog
Alex Ionescu’s Blog Windows Internals, Thoughts on Security, and Reverse Engineering Anyone reversing “Windows 8” will now find a non-familiar piece of code, whenever a list insertion operation is performed on a LIST_ENTRY: .text:00401B65 mov edx, [eax] .text:00401B67 mov ecx, [eax+4] .text:00401B6A cmp [edx+4], eax .text:00401B6D jnz SecurityAssertion .text:00401B73 cmp [ecx], eax .text:00401B75
Inside Microsoft® Windows® 2000, Third Edition
$49.99 To see this book's discounted price, select a reseller below. Chapter 6: Processes, Threads, and Jobs Process Internals Data Structures Kernel Variables Performance Counters Relevant Functions Relevant Tools Flow of CreateProcess Stage 1: Opening the Image to Be Executed Stage 2: Creating the Windows 2000 Executive Process Object Stage 3: Creating the Initial Thread and Its Stack and Contex
What Does the Zw Prefix Mean - Windows drivers
The Windows native system services routines have names that begin with the prefixes Nt and Zw. The Nt prefix is an abbreviation of Windows NT, but the Zw prefix has no meaning. Zw was selected partly to avoid potential naming conflicts with other APIs, and partly to avoid using any potentially useful two-letter prefixes that might be needed in the future. Many of the Windows driver support routine
Corelan ROPdb | Corelan Cybersecurity Research
This page gathers generic/universal ROP chains that are solely based on gadgets taken from a single dll. The main requirements for a ROP chain to be listed here are: it must work on XP, Vista, Windows 7, 2003 and 2008 server. (the dll should not rebase and should not be ASLR enabled). If your ROP chain only works on one of the listed operating systems, it must be based on a commonly used module. t
Security Research by Dan Rosenberg
Windows 8 introduced a number of exploit mitigation features, including hardening of both the userland and kernel heaps, mitigation against kernel-mode NULL pointer dereferences, and protection against abuse of virtual function pointer tables. One feature that stood out to me appears to be designed to help mitigate exploits leveraging return-oriented programming (ROP). Return-Oriented Programming
Subtle information disclosure in WIN32K.SYS syscall return values – j00ru//vx tech blog
Subtle information disclosure in WIN32K.SYS syscall return values While performing some random research related to the WIN32K.SYS driver syscalls a few months ago, I stumbled on an interesting finding – when examining the full 32-bit (or in the case of the original research – 64) return values, some of the services seemed to return unusual numbers, for example 0xfffffa8000ea0000. After investigati
Faster Method to Enumerate Heaps on Windows - www.SecurityXploded.com
This article explains a fast method of enumerating heaps on Windows. Traditional Windows heap enumeration functions are slower and takes lot of time while traversing large number of heap blocks. This article uncovers the reason behind it and shows you a new efficient way of enumerating process heaps based on reverse engineering of Windows heap API functions. Some days back I was doing password str
API Hooking in Python - Source Codes
This uses in process patching and trampolines to hook windows APIs. Thanks to this forum for ideas and example code. [code=python] # patcher.py # handles patching and unpatching of process memory. # public domain code. from ctypes import * from win32api import * from pytcc import pytcc from struct import pack, unpack, calcsize from win32gui import PyGetString, PySetMemory, PySetString from win32co
リリース、障害情報などのサービスのお知らせ
最新の人気エントリーの配信
j次のブックマーク
k前のブックマーク
lあとで読む
eコメント一覧を開く
oページを開く
Finding the weak link in Windows binaries - Source Boston 2012 slides
Chroot-ing in Windows – As Easy as A:, B:, C:… « Just Let It Flow
Refreshed Windows System Call Table (NT/2000/XP/2003/Vista/2008/7/8) released – j00ru//vx tech blog
Google Code Archive - Long-term storage for Google Code Project Hosting.
Windows API リスト: Windows API、Win32 API、Win32API
Kernel Pool Exploitation on Windows 7
http://www.codemachine.com/article_findwskclients.html
http://www.windowswiki.info/2009/02/19/how-to-extract-msumspmsiexe-files-on-the-command-line/
http://msdn.moonsols.com/