AlexSyScan13

Recommendations

Info

Outline ■ Introduction ■ Motivation ■ Previous Work ■ Baby Steps ■ The Hotpatch API and DLL Injection ■ Bigger Leaps ■ Known DLL Section Object Misdirection and Hijacking ■ Moonshot ■ The Hotpatch CodeInfo API – how to write a real patch ■ How to fail at getting anywhere with it ■ Based Sections to the rescue ■ Defense
What This Talk Is (Not) About ■ A rootkit/malware persistence technique ■ Hidden from the usual HIPS/AV callbacks and mechanisms ■ Usable from kernel and user ■ Require privileged user token -- not a ‘security vulnerability’
Page 1 and 2: Hotpatching the Hotpatcher Stealth
Page 3: Introduction
Page 7 and 8: Previous Work ■ EliCZ “Microsof
Page 9 and 10: What is Hotpatching? ■ First intr
Page 11 and 12: DLL Injection with the Hotpatch API
Page 13 and 14: Bigger Leaps
Page 15 and 16: Known DLL Section Object Misdirecti
Page 17 and 18: Known DLL Section Object Hijacking
Page 19 and 20: Moonshot
Page 21 and 22: Intro to the Hotpatching CodeInfo A
Page 23 and 24: Writing a real patch DLL (continued
Page 25 and 26: …and failing at it ■ Turns out
Page 27 and 28: Why are we failing? ■ What is hap
Page 29 and 30: What’s next? ■ Now the patch wo
Page 31 and 32: DEMO
Page 33 and 34: Key Takeaways ■ The hotpatch API
Page 35: QA ■ Greetz/shouts to: adc, lilho

AlexSyScan13

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?