From: Brett Moore (brett.moore@security-assessment.com)
Date: Mon Apr 11 2005 - 17:29:00 EDT
Bugger The Debugger
- Pre Interaction Debugger Code Execution
The use of debuggers to analyse malicious or otherwise unknown binaries
has become a requirement for reverse engineering executables to help
determine their purpose.
While researchers in places such as anti-virus laboratories have always
done this, with the availability of free and easy to use debuggers it has
also become popular with corporate security officers and home users.
One of the main purposes of a debugger is to allow the user to control
the execution of a binary in such a way as to determine what instructions
or commands the binary is executing. During malware analysis the user
can modify what the binary is trying to execute, or prevent it all together.
This paper will demonstrate methods that may be used by malware to
execute code, simply by being loaded into a debugging session.
The paper can be downloaded from the whitepapers section of our website.
http://www.security-assessment.com
Brett Moore
Network Intrusion Specialist, CTO
Security-Assessment.com
######################################################################
CONFIDENTIALITY NOTICE:
This message and any attachment(s) are confidential and proprietary.
They may also be privileged or otherwise protected from disclosure. If
you are not the intended recipient, advise the sender and delete this
message and any attachment from your system. If you are not the
intended recipient, you are not authorised to use or copy this message
or attachment or disclose the contents to any other person. Views
expressed are not necessarily endorsed by Security-Assessment.com
Limited. Please note that this communication does not designate an
information system for the purposes of the New Zealand Electronic
Transactions Act 2003.
######################################################################
This archive was generated by hypermail 2.1.7 : Sat Apr 12 2008 - 10:54:19 EDT