Captain Hook

More documents

Recommendations

Info

WHO? Udi Yavo • CTO and Co-Founder, enSilo • Former CTO, Rafael Cyber Security Division • Researcher • Author on BreakingMalware Tomer Bitton • VP Research and Co-Founder, enSilo • Low Level Researcher, Rafael Advanced Defense Systems • Malware Researcher • Author on BreakingMalware
AGENDA • Hooking In a Nutshell • Scope of Research • Inline Hooking – Under the hood - 32-bit function hooking - 64-bit function hooking • Hooking Engine Injection Techniques • The 6 Security Issues of Hooking • Demo – Bypassing exploit mitigations • 3 rd Party Hooking Engines • Affected Products • Research Tools • Summary
Page 1: Captain Hook: Pirating AVS to Bypas
Page 5 and 6: SCOPE OF RESEARCH • Our research
Page 7 and 8: INLINE HOOKING - 32-BIT FUNCTION HO
Page 15 and 16: INLINE HOOKING - RECAP • Inline h
Page 17 and 18: INTRODUCTION - KERNEL-TO-USER CODE
Page 19 and 20: INJECTION METHODS - USER APC Basic
Page 21 and 22: INJECTION METHODS - ENTRY POINT PAT
Page 27 and 28: INJECTION METHODS - IMPORT TABLE PA
Page 29 and 30: INJECTION METHODS - NTDLL.DLL/USER3
Page 31 and 32: INJECTION METHODS - NTDLL.DLL/USER3
Page 33 and 34: INJECTION METHODS - QUICK SUMMARY
Page 35 and 36: #1 - UNSAFE INJECTION Severity: Ver
Page 37 and 38: #3 - PREDICTABLE R-X CODE STUBS Sev
Page 39 and 40: #5 -RWX CODE STUBS Severity: Medium
Page 41 and 42: SECURITY ISSUES OF HOOKING - RECAP
Page 43 and 44: 3 rd Party Hooking Engines
Page 45 and 46: EASYHOOK - OPEN-SOURCE HOOKING ENGI
Page 47 and 48: MADCODEHOOK - POWERFUL COMMERCIAL H
Page 49 and 50: MICROSOFT DETOURS VULNERABILITY - I
Page 51 and 52: AFFECTED PRODUCTS * Patch wasn’t
Page 53 and 54:
Research Tools
Page 55 and 56:
RESEARCH TOOLS - HOOKS SCAN • Too
Page 57:
Contact Us: Udi, udi@ensilo.com Tom
show all

Captain Hook

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?