[Full-disclosure] [WHITEPAPER] Bugger The Debugger

From: Brett Moore (brett.moore_at_security-assessment.com)
Date: 04/13/05

  • Next message: class101_at_HAT-SQUAD.com: "[Full-disclosure] BakBone NetVault 6.x/7.x multiples vulnerabilities + exploit"
    To: <full-disclosure@lists.grok.org.uk>
    Date: Wed, 13 Apr 2005 18:13:05 +1200
    
    

    Bugger The Debugger
     - Pre Interaction Debugger Code Execution

    The use of debuggers to analyse malicious or otherwise unknown binaries
    has become a requirement for reverse engineering executables to help
    determine their purpose.

    While researchers in places such as anti-virus laboratories have always
    done this, with the availability of free and easy to use debuggers it has
    also become popular with corporate security officers and home users.
    One of the main purposes of a debugger is to allow the user to control
    the execution of a binary in such a way as to determine what instructions
    or commands the binary is executing. During malware analysis the user
    can modify what the binary is trying to execute, or prevent it all together.

    This paper will demonstrate methods that may be used by malware to
    execute code, simply by being loaded into a debugging session.

    The paper can be downloaded from the whitepapers section of our website.
    http://www.security-assessment.com

    Brett Moore
    Network Intrusion Specialist, CTO
    Security-Assessment.com

    ######################################################################
    CONFIDENTIALITY NOTICE:

    This message and any attachment(s) are confidential and proprietary.
    They may also be privileged or otherwise protected from disclosure. If
    you are not the intended recipient, advise the sender and delete this
    message and any attachment from your system. If you are not the
    intended recipient, you are not authorised to use or copy this message
    or attachment or disclose the contents to any other person. Views
    expressed are not necessarily endorsed by Security-Assessment.com
    Limited. Please note that this communication does not designate an
    information system for the purposes of the New Zealand Electronic
    Transactions Act 2003.
    ######################################################################
    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.grok.org.uk/full-disclosure-charter.html
    Hosted and sponsored by Secunia - http://secunia.com/


  • Next message: class101_at_HAT-SQUAD.com: "[Full-disclosure] BakBone NetVault 6.x/7.x multiples vulnerabilities + exploit"