PowerPoint Presentation · Filter Manager Virus Scanner Kernel System Library System Library...
Transcript of PowerPoint Presentation · Filter Manager Virus Scanner Kernel System Library System Library...
sigcheck -e -u -s c:\
listdlls -u
strings <file>
http://www.e-markettop.com/
http://blogs.technet.com/b/markrussinovich/archive/2011/03/14/3412374.aspx
User Mode
Kernel Mode
File System
Filter Registry Callback
Kernel
Callouts
Process Monitor UI
Process Monitor Driver TCP/IP Driver ETW
events
Function 2
Function 1
Function 3
Function 3 Function 2 Function 1
Stack Display
Filter Manager
Virus Scanner
Kernel
System Library
System Library
SuperFetch
(root cause)
Kernel Mode
User Mode
Note: user stack capture isn’t supported on 64-bit versions of Windows XP/Server 2003
“Category is Write”
http://blogs.technet.com/b/markrussinovich/archive/2011/03/08/3392087.aspx
http://blogs.technet.com/b/markrussinovich/archive/2011/02/27/3390475.aspx
http://blogs.technet.com/b/markrussinovich/archive/2011/03/30/3416253.aspx
www.zerodaythebook.com
http://www.youtube.com/watch?v=ucyMBYg9RWU
http://technet.microsoft.com/en-us/sysinternals/hh290819
http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/w32_stuxnet_dossier.pdf
http://www.wired.com/threatlevel/2011/07/how-digital-detectives-deciphered-stuxnet/
http://www.virusbtn.com/pdf/conference_slides/2010/Johnson-VB2010.pdf