Title of Presentation · 04/18/introducing-emet-v4-beta.aspx Trustworthy Computing. Trustworthy Computing. [email protected] Trustworthy Computing. Trustworthy Computing.
Jul 06, 2020
Welcome message from author
This document is posted to help you gain knowledge. Please leave a comment to let me know what you think about it! Share it to your friends and learn new things together.
Transcript
Trustworthy Computing
Trustworthy Computing
* Reverse engineers agree on that!
Trustworthy Computing
Trustworthy Computing
Trustworthy Computing
Trustworthy Computing
Trustworthy Computing
Trustworthy Computing
* http://technet.microsoft.com/en-us/library/dd837644(v=WS.10).aspx
Trustworthy Computing
Trustworthy Computing
Trustworthy Computing
SetProcessDEPPolicy
Trustworthy Computing
ntdll!NtMapViewOfSection
Trustworthy Computing
Trustworthy Computing
Trustworthy Computing
Trustworthy Computing
Trustworthy Computing
Trustworthy Computing
Trustworthy Computing
Trustworthy Computing
Trustworthy Computing
Trustworthy Computing
Note: EMET 4.0 implements ROP mitigations for 32-bit processes only
Trustworthy Computing
Trustworthy Computing
Trustworthy Computing
Trustworthy Computing
* http://research.microsoft.com/en-us/projects/detours/
Trustworthy Computing
Trustworthy Computing
kernel32!VirtualAllocEx()
Trustworthy Computing
Trustworthy Computing
Trustworthy Computing
Trustworthy Computing
Trustworthy Computing
Trustworthy Computing
Trustworthy Computing
CALL kernel32!VirtualAlloc ; <- target
Trustworthy Computing
RET
RET
Trustworthy Computing
Trustworthy Computing
Trustworthy Computing
Trustworthy Computing
Trustworthy Computing
Trustworthy Computing
Trustworthy Computing
Trustworthy Computing
Trustworthy Computing
Trustworthy Computing
API call to VirtualAlloc() happens at
0x6D970A6A thus triggering EXEC flow
simulation
Trustworthy Computing
Trustworthy Computing
Trustworthy Computing
Trustworthy Computing
Load library checks
Trustworthy Computing
Memory protection change
Trustworthy Computing
1.
2.
3.
Trustworthy Computing
Trustworthy Computing
Trustworthy Computing
Trustworthy Computing
Trustworthy Computing
* http://msdn.microsoft.com/en-us/library/windows/desktop/aa382405(v=vs.85).aspx
http://blogs.technet.com/b/srd/archive/2013/05/08/emet-4-0-s-certificate-trust-feature.aspx
http://blogs.technet.com/b/srd/archive/2013/04/18/introducing-emet-v4-beta.aspx
Trustworthy Computing
Trustworthy Computing
Trustworthy Computing
Related Documents
