So Cool (PL) 19 th Kang, Sung won 19 th Park, Jong min 19 th Park Gui mong.
-
Upload
daryl-fiske -
Category
Documents
-
view
217 -
download
2
Transcript of So Cool (PL) 19 th Kang, Sung won 19 th Park, Jong min 19 th Park Gui mong.
![Page 1: So Cool (PL) 19 th Kang, Sung won 19 th Park, Jong min 19 th Park Gui mong.](https://reader035.fdocuments.net/reader035/viewer/2022062515/56649cab5503460f9496cea2/html5/thumbnails/1.jpg)
Protector of My Digital Contents
So Cool(PL) 19th Kang, Sung won
19th Park, Jong min19th Park Gui mong
![Page 2: So Cool (PL) 19 th Kang, Sung won 19 th Park, Jong min 19 th Park Gui mong.](https://reader035.fdocuments.net/reader035/viewer/2022062515/56649cab5503460f9496cea2/html5/thumbnails/2.jpg)
Agenda
1. Project Motive
2. Goal3. Architecture4. Detail5. Development Environment6. Division of Work7. Project Schedule8. Q & A
![Page 3: So Cool (PL) 19 th Kang, Sung won 19 th Park, Jong min 19 th Park Gui mong.](https://reader035.fdocuments.net/reader035/viewer/2022062515/56649cab5503460f9496cea2/html5/thumbnails/3.jpg)
Protector of My Digital Contents Busan Samsung Software Membership
Project Motive
![Page 4: So Cool (PL) 19 th Kang, Sung won 19 th Park, Jong min 19 th Park Gui mong.](https://reader035.fdocuments.net/reader035/viewer/2022062515/56649cab5503460f9496cea2/html5/thumbnails/4.jpg)
Protector of My Digital Contents Busan Samsung Software Membership
Project Motive
X?
User
![Page 5: So Cool (PL) 19 th Kang, Sung won 19 th Park, Jong min 19 th Park Gui mong.](https://reader035.fdocuments.net/reader035/viewer/2022062515/56649cab5503460f9496cea2/html5/thumbnails/5.jpg)
Protector of My Digital Contents Busan Samsung Software Membership
Goal
Protector
Prevent Illegal Copy & Use
Unlimited
File Format
(Limited Period)
JPG
JPG
Regular Players
![Page 6: So Cool (PL) 19 th Kang, Sung won 19 th Park, Jong min 19 th Park Gui mong.](https://reader035.fdocuments.net/reader035/viewer/2022062515/56649cab5503460f9496cea2/html5/thumbnails/6.jpg)
Protector of My Digital Contents Busan Samsung Software Membership
Entire Architecture
LicensePolicy
Contents
ProviderApplicatio
n
+
Web Server
WindowsDriver
ActiveX
LicensePolicy
LicensePolicy
Contents
User
WindowsDriver
WebServer Address
Connect(Using WebBrower)
Using ActiveX ( Automatically install Driver &
License )
Contents Transmit
![Page 7: So Cool (PL) 19 th Kang, Sung won 19 th Park, Jong min 19 th Park Gui mong.](https://reader035.fdocuments.net/reader035/viewer/2022062515/56649cab5503460f9496cea2/html5/thumbnails/7.jpg)
Protector of My Digital Contents Busan Samsung Software Membership
Provider Architecture
ProviderApplicatio
nAdd File
Save String[]
License Setup to File
CAB File Auto Make
Add to Web Server& Running
![Page 8: So Cool (PL) 19 th Kang, Sung won 19 th Park, Jong min 19 th Park Gui mong.](https://reader035.fdocuments.net/reader035/viewer/2022062515/56649cab5503460f9496cea2/html5/thumbnails/8.jpg)
Protector of My Digital Contents Busan Samsung Software Membership
DownLoader ArchitectureProvider User
Add File
ProviderApplicatio
n
WebServer DownFile
List
INCLUDE
Setup
RUN
WebServer DownFile
List
READ
DownlaoderFile Down
![Page 9: So Cool (PL) 19 th Kang, Sung won 19 th Park, Jong min 19 th Park Gui mong.](https://reader035.fdocuments.net/reader035/viewer/2022062515/56649cab5503460f9496cea2/html5/thumbnails/9.jpg)
Protector of My Digital Contents Busan Samsung Software Membership
System Architecture (File System Filter Driver)
Application
I/O Manager
File System Filter
File System
Stack
User Level
Kernel Level
FilterManage
r
System Mini Filter Driver
NetworkMini FilterDriver
![Page 10: So Cool (PL) 19 th Kang, Sung won 19 th Park, Jong min 19 th Park Gui mong.](https://reader035.fdocuments.net/reader035/viewer/2022062515/56649cab5503460f9496cea2/html5/thumbnails/10.jpg)
Protector of My Digital Contents Busan Samsung Software Membership
Detail (SSDT Hooking)
System Service Dispatch Table
XX
Keeper (Self Defender)
SystemService
Dispather
SystemService
XX
![Page 11: So Cool (PL) 19 th Kang, Sung won 19 th Park, Jong min 19 th Park Gui mong.](https://reader035.fdocuments.net/reader035/viewer/2022062515/56649cab5503460f9496cea2/html5/thumbnails/11.jpg)
Protector of My Digital Contents Busan Samsung Software Membership
Detail (Process Hide)
Keeper Driver (Self De-fender)
SystemInformationClass
SystemInformation
….
ReturnLength
SystemInformation-Length
NewZwQuerySystemInforma-tion
Process information
DCBA
![Page 12: So Cool (PL) 19 th Kang, Sung won 19 th Park, Jong min 19 th Park Gui mong.](https://reader035.fdocuments.net/reader035/viewer/2022062515/56649cab5503460f9496cea2/html5/thumbnails/12.jpg)
Protector of My Digital Contents Busan Samsung Software Membership
Detail (File Hide)
Keeper Driver (Self De-fender)
hFile
hEvent
….
IoApcContext
FileInfoClass
NewZwQueryDirectoryFile Hide File & Folder inform
DCBA
![Page 13: So Cool (PL) 19 th Kang, Sung won 19 th Park, Jong min 19 th Park Gui mong.](https://reader035.fdocuments.net/reader035/viewer/2022062515/56649cab5503460f9496cea2/html5/thumbnails/13.jpg)
Protector of My Digital Contents Busan Samsung Software Membership
Detail (Active X)
![Page 14: So Cool (PL) 19 th Kang, Sung won 19 th Park, Jong min 19 th Park Gui mong.](https://reader035.fdocuments.net/reader035/viewer/2022062515/56649cab5503460f9496cea2/html5/thumbnails/14.jpg)
Protector of My Digital Contents Busan Samsung Software Membership
Detail (Active X)
.inf File Make
.CAB File Make
![Page 15: So Cool (PL) 19 th Kang, Sung won 19 th Park, Jong min 19 th Park Gui mong.](https://reader035.fdocuments.net/reader035/viewer/2022062515/56649cab5503460f9496cea2/html5/thumbnails/15.jpg)
Protector of My Digital Contents Busan Samsung Software Membership
Detail (Active X)
![Page 16: So Cool (PL) 19 th Kang, Sung won 19 th Park, Jong min 19 th Park Gui mong.](https://reader035.fdocuments.net/reader035/viewer/2022062515/56649cab5503460f9496cea2/html5/thumbnails/16.jpg)
Protector of My Digital Contents Busan Samsung Software Membership
Detail (Anti-Reversing)
Anti-Reversing Techniques
Anti-Analysis
BreakPoint Detection
Garbage Code
Anti-Disassembly
![Page 17: So Cool (PL) 19 th Kang, Sung won 19 th Park, Jong min 19 th Park Gui mong.](https://reader035.fdocuments.net/reader035/viewer/2022062515/56649cab5503460f9496cea2/html5/thumbnails/17.jpg)
Protector of My Digital Contents Busan Samsung Software Membership
Detail (Anti-Reversing)
Anti-Disassembly
Example Code
![Page 18: So Cool (PL) 19 th Kang, Sung won 19 th Park, Jong min 19 th Park Gui mong.](https://reader035.fdocuments.net/reader035/viewer/2022062515/56649cab5503460f9496cea2/html5/thumbnails/18.jpg)
Protector of My Digital Contents Busan Samsung Software Membership
Detail (Anti-Reversing)
Anti-Disassembly
Apply
![Page 19: So Cool (PL) 19 th Kang, Sung won 19 th Park, Jong min 19 th Park Gui mong.](https://reader035.fdocuments.net/reader035/viewer/2022062515/56649cab5503460f9496cea2/html5/thumbnails/19.jpg)
Protector of My Digital Contents Busan Samsung Software Membership
Detail (Anti-Reversing)
Anti-Disassembly
Result
![Page 20: So Cool (PL) 19 th Kang, Sung won 19 th Park, Jong min 19 th Park Gui mong.](https://reader035.fdocuments.net/reader035/viewer/2022062515/56649cab5503460f9496cea2/html5/thumbnails/20.jpg)
Protector of My Digital Contents Busan Samsung Software Membership
Detail (Anti-Reversing)
BreakPoint Detection
Apply
![Page 21: So Cool (PL) 19 th Kang, Sung won 19 th Park, Jong min 19 th Park Gui mong.](https://reader035.fdocuments.net/reader035/viewer/2022062515/56649cab5503460f9496cea2/html5/thumbnails/21.jpg)
Protector of My Digital Contents Busan Samsung Software Membership
Detail (Anti-Reversing)
BreakPoint Detection
Result
Will jump to the wrong memory address.
![Page 22: So Cool (PL) 19 th Kang, Sung won 19 th Park, Jong min 19 th Park Gui mong.](https://reader035.fdocuments.net/reader035/viewer/2022062515/56649cab5503460f9496cea2/html5/thumbnails/22.jpg)
Protector of My Digital Contents Busan Samsung Software Membership
Detail (Anti-Reversing)
Garbage Code
Apply
![Page 23: So Cool (PL) 19 th Kang, Sung won 19 th Park, Jong min 19 th Park Gui mong.](https://reader035.fdocuments.net/reader035/viewer/2022062515/56649cab5503460f9496cea2/html5/thumbnails/23.jpg)
Protector of My Digital Contents Busan Samsung Software Membership
Detail (Anti-Reversing)
Garbage Code
Result
Complex code
![Page 24: So Cool (PL) 19 th Kang, Sung won 19 th Park, Jong min 19 th Park Gui mong.](https://reader035.fdocuments.net/reader035/viewer/2022062515/56649cab5503460f9496cea2/html5/thumbnails/24.jpg)
Protector of My Digital Contents Busan Samsung Software Membership
Detail (Anti-Capture)
Anti-Capture
Empty clipboard
Native Api Hooking
Dll Injection
Ctrl + C, PrintScreen Key to prevent use
BitBlt() Hooking
NtGdiBitBlt() HookingUser
Anti-Capture
![Page 25: So Cool (PL) 19 th Kang, Sung won 19 th Park, Jong min 19 th Park Gui mong.](https://reader035.fdocuments.net/reader035/viewer/2022062515/56649cab5503460f9496cea2/html5/thumbnails/25.jpg)
Protector of My Digital Contents Busan Samsung Software Membership
Detail (Anti-Capture)
Anti-Capture
Native Api Hooking
NtGdiBitBlt Funtion Hooking
Win32k.sys SystemServiceDescriptorShadowTable Hook-ing
![Page 26: So Cool (PL) 19 th Kang, Sung won 19 th Park, Jong min 19 th Park Gui mong.](https://reader035.fdocuments.net/reader035/viewer/2022062515/56649cab5503460f9496cea2/html5/thumbnails/26.jpg)
Protector of My Digital Contents Busan Samsung Software Membership
Detail (Device Driver Loader)
Device Driver Loader
Service Control Manager (SCM)
InstallHinfSection
Program Install
Registry Protection
RUNDLL32.EXE SETUPAPI.DLL,InstallHinfSection DefaultInstall 132 Driver.inf
![Page 27: So Cool (PL) 19 th Kang, Sung won 19 th Park, Jong min 19 th Park Gui mong.](https://reader035.fdocuments.net/reader035/viewer/2022062515/56649cab5503460f9496cea2/html5/thumbnails/27.jpg)
Protector of My Digital Contents Busan Samsung Software Membership
Development Environment
Development Environment
OS : Windows Window XP SP3
IDE : Microsoft Visual Studio 2008 / 6.0
Windows Device Kit 7600.16385.0
Debug Tool : OllyDBG, WinDbg, DbgView
Virtual Machine : VMWare Workstation 6.0
Language : C#, C, C++, Assambly
![Page 28: So Cool (PL) 19 th Kang, Sung won 19 th Park, Jong min 19 th Park Gui mong.](https://reader035.fdocuments.net/reader035/viewer/2022062515/56649cab5503460f9496cea2/html5/thumbnails/28.jpg)
Protector of My Digital Contents Busan Samsung Software Membership
Division of Work
Kang,Sung won
(PL)
Provider Application (Protector) - Digital Contents File Management - License Policy - WebSever & WebPage - ActiveX (Automatically install Driver & License)
Anti-Reversing - Garbage Code - Anti-Disassembly - Breakpoint Detection Anti Capture
Park,Jong min
Park,Gui mong
Keeper (Windows Driver) Mini Filter Driver - System Filter Driver - Network Filter Driver Driver Loader
![Page 29: So Cool (PL) 19 th Kang, Sung won 19 th Park, Jong min 19 th Park Gui mong.](https://reader035.fdocuments.net/reader035/viewer/2022062515/56649cab5503460f9496cea2/html5/thumbnails/29.jpg)
Protector of My Digital Contents Busan Samsung Software Membership
Project Schedule
TASK 08 09 10
1 2 3 4 5 6 7 8 9 10 11 12
Protector
GUI
Contents File Manage-ment
License Policy
Web Server & Page
ActiveX (Auto Install)
AntiRevers-
ing
Garbage Code
Anti-Disassembly
Breakpoint Detection
Keeper
Anti Capture
System Filter Driver
Network Filter Driver
Driver Connection Process
Driver Loader
Keeper Driver
Anti-SSDTHooking
Unify Test & Debugging Kang, Sung won
Park, Jong min
Park, Gui mong
![Page 30: So Cool (PL) 19 th Kang, Sung won 19 th Park, Jong min 19 th Park Gui mong.](https://reader035.fdocuments.net/reader035/viewer/2022062515/56649cab5503460f9496cea2/html5/thumbnails/30.jpg)
Question & Answer
Thank you