Embed Size (px)
DESCRIPTION
2014 CodeEngn Conference 10 함께 개발하실분!! 무작정 분석 할 파일을 열어 눈에 핏줄 세우고 허우적대다 지쳐 잠이든 당신의 모습에 눈물을 흘립니다. 동적분석에 기반한 분석 포인트 선정, 데이터 확인, 동작 과정 분석 등을 도와줄 "User Function Monitoring Tool" 도구를 소개합니다. 코드를 분석하는 당신! 당신의 소중한 여가 시간을 지켜드립니다. http://codeengn.com/conference/10 http://codeengn.com/conference/archive
Citation preview
![Page 1: [2014 CodeEngn Conference 10] 장기헌 - 삽을 만들어야 땅을파지(User Function Monitoring Tool)](https://reader035.pdfslide.net/reader035/viewer/2022081908/553890a04a79590a7f8b4779/html5/thumbnails/1.jpg)
The 삽 : User Function Monitoring Tool
장기헌nvdark
2014.07.05
www.CodeEngn.com2014 CodeEngn Conference 10
![Page 2: [2014 CodeEngn Conference 10] 장기헌 - 삽을 만들어야 땅을파지(User Function Monitoring Tool)](https://reader035.pdfslide.net/reader035/viewer/2022081908/553890a04a79590a7f8b4779/html5/thumbnails/2.jpg)
The 삽
![Page 3: [2014 CodeEngn Conference 10] 장기헌 - 삽을 만들어야 땅을파지(User Function Monitoring Tool)](https://reader035.pdfslide.net/reader035/viewer/2022081908/553890a04a79590a7f8b4779/html5/thumbnails/3.jpg)
배경
동적, 정적 분석 : 삽, 삽, 삽, 삽 그리고 삽
분석을 하다 보면 누구나 하는 생각 : 아…없나?
검색 중 API모니터링 도구는 있지만 USER 함수모니터링 도구가 없었음!!!
그래서!! 있으면 편하겠다!!
![Page 4: [2014 CodeEngn Conference 10] 장기헌 - 삽을 만들어야 땅을파지(User Function Monitoring Tool)](https://reader035.pdfslide.net/reader035/viewer/2022081908/553890a04a79590a7f8b4779/html5/thumbnails/4.jpg)
컨샙
1. DLL
2. User Function 찾기
3. 함수 내부 연결 점 찾기
4. 원하는 포인트 모니터링
![Page 5: [2014 CodeEngn Conference 10] 장기헌 - 삽을 만들어야 땅을파지(User Function Monitoring Tool)](https://reader035.pdfslide.net/reader035/viewer/2022081908/553890a04a79590a7f8b4779/html5/thumbnails/5.jpg)
개발
API, User Function 및 함수 이외의 부분 포함
동적 분석에 기반한 모니터링
출력 할 결과 값 구분
![Page 6: [2014 CodeEngn Conference 10] 장기헌 - 삽을 만들어야 땅을파지(User Function Monitoring Tool)](https://reader035.pdfslide.net/reader035/viewer/2022081908/553890a04a79590a7f8b4779/html5/thumbnails/6.jpg)
예시 1 : API
![Page 7: [2014 CodeEngn Conference 10] 장기헌 - 삽을 만들어야 땅을파지(User Function Monitoring Tool)](https://reader035.pdfslide.net/reader035/viewer/2022081908/553890a04a79590a7f8b4779/html5/thumbnails/7.jpg)
예시 2 : User Function
![Page 8: [2014 CodeEngn Conference 10] 장기헌 - 삽을 만들어야 땅을파지(User Function Monitoring Tool)](https://reader035.pdfslide.net/reader035/viewer/2022081908/553890a04a79590a7f8b4779/html5/thumbnails/8.jpg)
문제
분석의 정확성
늘어나는 요구사항
아…..이건 뭐 쓸때마다…
![Page 9: [2014 CodeEngn Conference 10] 장기헌 - 삽을 만들어야 땅을파지(User Function Monitoring Tool)](https://reader035.pdfslide.net/reader035/viewer/2022081908/553890a04a79590a7f8b4779/html5/thumbnails/9.jpg)
그래서…목적 : 삽 제작
아이디어 듬뿍 담긴 머리
방향 : 손맛 있는 삽 만들기
![Page 10: [2014 CodeEngn Conference 10] 장기헌 - 삽을 만들어야 땅을파지(User Function Monitoring Tool)](https://reader035.pdfslide.net/reader035/viewer/2022081908/553890a04a79590a7f8b4779/html5/thumbnails/10.jpg)
www.codeengn.comunsigned.kr
www.CodeEngn.com2014 CodeEngn Conference 10
![[2007 CodeEngn Conference 01] 김기오 - NASM 어셈블러 사용법과 Calling Convention](https://img.pdfslide.net/doc/110x75/553891954a79594f6c8b47c4/2007-codeengn-conference-01-nasm-calling-convention.jpg)
![[2012 CodeEngn Conference 07] M-Stoned - iThreat](https://img.pdfslide.net/doc/110x75/553891b34a79597c778b4797/2012-codeengn-conference-07-m-stoned-ithreat.jpg)
![[2007 CodeEngn Conference 01] amesianx - Art of Hooking](https://img.pdfslide.net/doc/110x75/553890cc550346bf308b47cf/2007-codeengn-conference-01-amesianx-art-of-hooking.jpg)
![[2013 CodeEngn Conference 09] BlueH4G - hooking and visualization](https://img.pdfslide.net/doc/110x75/55389074550346653f8b47f9/2013-codeengn-conference-09-blueh4g-hooking-and-visualization.jpg)
![[2007 CodeEngn Conference 01] seaofglass - Linux Virus Analysis](https://img.pdfslide.net/doc/110x75/547bf5ce5806b5fe3f8b46ac/2007-codeengn-conference-01-seaofglass-linux-virus-analysis.jpg)
![[2008 CodeEngn Conference 02] 송민호 - 임베디드 시스템에서의 펌웨어 보호](https://img.pdfslide.net/doc/110x75/553890a7550346b04c8b47b2/2008-codeengn-conference-02-.jpg)
![[2011 CodeEngn Conference 05] daly25 - 파일바이러스 분석 및 치료로직 개발](https://img.pdfslide.net/doc/110x75/553890b6550346bb318b47f0/2011-codeengn-conference-05-daly25-.jpg)
![[2014 CodeEngn Conference 11] 정든품바 - 웹성코드](https://img.pdfslide.net/doc/110x75/55a253f21a28abc7758b4836/2014-codeengn-conference-11--55a52a24e3a3a.jpg)
![[2014 CodeEngn Conference 11] 김호빈 - Android Bootkit Analysis KO](https://img.pdfslide.net/doc/110x75/55a253f11a28abc7758b4834/2014-codeengn-conference-11-android-bootkit-analysis-ko.jpg)
![[2010 CodeEngn Conference 04] hahah - Defcon 18 CTF 문제풀이](https://img.pdfslide.net/doc/110x75/553890f8550346f53d8b47e0/2010-codeengn-conference-04-hahah-defcon-18-ctf-.jpg)
![[2011 CodeEngn Conference 05] ashine - 안드로이드 리눅스에서의 시스템 해킹](https://img.pdfslide.net/doc/110x75/555c422fd8b42a2c068b4e39/2011-codeengn-conference-05-ashine-.jpg)
![[2007 CodeEngn Conference 01] 이강석 - Malware Analysis Start](https://img.pdfslide.net/doc/110x75/553891ad4a7959c1688b4779/2007-codeengn-conference-01-malware-analysis-start.jpg)
![[2010 CodeEngn Conference 04] Max - Fighting against Botnet](https://img.pdfslide.net/doc/110x75/554a052cb4c905e56c8b5543/2010-codeengn-conference-04-max-fighting-against-botnet.jpg)
![[2014 CodeEngn Conference 10] 김학수 - 하이퍼바이저 루트킷, 어디까지 가봤니](https://img.pdfslide.net/doc/110x75/546b276daf795919088b5441/2014-codeengn-conference-10--5584ac5ff1aa6.jpg)
![[2013 CodeEngn Conference 09] proneer - Malware Tracker](https://img.pdfslide.net/doc/110x75/553890c04a7959437c8b47a2/2013-codeengn-conference-09-proneer-malware-tracker.jpg){kind=tracking}
![[2012 CodeEngn Conference 07] nesk - Defcon 20th : 본선 CTF 문제풀이](https://img.pdfslide.net/doc/110x75/553891b14a795971788b4771/2012-codeengn-conference-07-nesk-defcon-20th-ctf-.jpg)