ntddk

PS C:\Program Files (x86)\Windows Kits\8.1\Debuggers\x64> ./livekd

LiveKd v5.40 - Execute kd/windbg on a live system
Sysinternals - www.sysinternals.com
Copyright (C) 2000-2015 Mark Russinovich and Ken Johnson

Launching C:\Program Files (x86)\Windows Kits\8.1\Debuggers\x64\kd.exe:

Microsoft (R) Windows Debugger Version 6.3.9600.17336 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.

ntddk

kd> .for(r $t0=0; @$t0<dwo(nt!KiServiceLimit); r $t0=@$t0+1){.printf "%y\n", nt!KiServiceTable+(dwo(nt!KiServiceTable+@$t0*4)>>4)}

*** ERROR: Module load completed but symbols could not be loaded for LiveKdD.SYS
fffff801`ad0f1a20
fffff801`ad0f4878
nt!NtAcceptConnectPort (fffff801`9d4fd8a8)
nt!NtMapUserPhysicalPagesScatter (fffff801`9d6a2b10)
nt!NtWaitForSingleObject (fffff801`9d4325e0)
fffff801`ad14ef90
nt!NtReadFile (fffff801`9d426190)

ntddk

pemu のみに存在: .git
diff -ur qemu-1.5.3/.gitignore pemu/.gitignore
--- qemu-1.5.3/.gitignore	2013-08-28 00:05:28.000000000 +0900
+++ pemu/.gitignore	2015-03-19 02:57:47.725691930 +0900
@@ -106,4 +106,7 @@
 cscope.*
 tags
 TAGS
+build
 *~

ntddk

#include <stdio.h>

__attribute__((constructor)) void constructor(){
  printf("constructor\n");
}

int __libc_start_main(){
  printf("__libc_start_main\n");
  return 0;
}

ntddk

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <string.h>
#include <errno.h>
#include <sys/types.h>

void split(char *buf, char** args, size_t sargs, size_t *nargs)
{
    char *bargs[sargs], **cp, *pbuf;

ntddk

解析ツール

• Smali/Baksmali
• apktool
• Smali-CFGs
• apparecium
• Smali2PsuedoJava
• sublime-smali
• Androguard
  • honeynet / androguard
• DroidBox

ntddk

#!/bin/sh
awk '{print $1, $4"]", $7}' access_log.txt | grep -v "/$" | uniq -c | sort > log.txt
awk '{print $4"]"}' access_log.txt | uniq -c | sort -r | tail -308 > trank.txt
awk '{print $11}' access_log.txt | grep -v - | sort | uniq -c | sort -r | tail -308 > accessrank.txt

ntddk

# ls / -al
-rwx------   1 root   root   17530430 Nov 13 07:52 .dockerinit
drwxr-xr-x   7 root   root         60 Nov 13 05:06 .gem
drwxr-xr-x  36 root   root        720 Nov 13 04:31 .npm
drwxr-xr-x   2 root   root        540 Nov 13 04:37 bin
drwxr-xr-x   2 root   root         40 Apr 10  2014 boot
drwxr-xr-x   4 root   root        340 Nov 18 05:56 dev
drwxr-xr-x 213 root   root        120 Nov 18 05:56 etc
-rw-r--r--   1 root   root      24828 Nov 13 04:36 fuse.deb
drwxr-xr-x   3 root   root         60 Nov 13 04:36 home

ntddk

%
% From jarticle.sty 16-Mar-88
% -------------------------------------------------------------------------

% No page number
\pagestyle{empty}

% Page layout
%
%\paperwidth	210mm

ntddk

• '';!--"<XSS>=&{()}``\"
• <script>alert(XSS);</script>
• "><script>alert(XSS);</script>
• <ScrIpt>alert(1);</SCript>
• <a onmouseover="alert(document.cookie)">XSS</a>
• <a onmouseover=alert(document.cookie)>XSS</a>
• <<script>alert("XSS");//<</script>
• <iframe src="javascript:alert('XSS');"></iframe>
• <iframe src=# onmouseover="alert(document.cookie)"></iframe>
• ``