{"id":74109,"date":"2020-03-14T08:42:14","date_gmt":"2020-03-14T05:42:14","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/loadlibrary-proslojka-dlya-zagruzki-windows-dll-v-linux-prilozheniya"},"modified":"2020-03-14T08:42:14","modified_gmt":"2020-03-14T05:42:14","slug":"loadlibrary-proslojka-dlya-zagruzki-windows-dll-v-linux-prilozheniya","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/loadlibrary-proslojka-dlya-zagruzki-windows-dll-v-linux-prilozheniya","title":{"rendered":"LoadLibrary, Windows DLL-de Linuxi rakendustesse laadimise vahekiht","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Tavis Ormandy (Tavis Ormandy<\/a><\/noindex>), Google'i turvauurija, arendab projekti LoadLibrary<\/a><\/noindex>, mille eesm\u00e4rk on portida Windowsi jaoks koostatud DLL-raamatukogusid nende kasutamiseks Linuxi rakendustes. Projekt pakub vahekihti, mille abil saab laadida PE\/COFF formaadis DLL-faili ja kutsuda seda funktsioone. PE\/COFF laadija p\u00f5hineb koodil ndiswrapper<\/a><\/noindex>. Projekti kood levitatakse<\/a><\/noindex> on GPLv2 litsentsi all.<\/p>\n

LoadLibrary v\u00f5tab endale raamatukogu laadimise m\u00e4esse ja olemasolevate s\u00fcmbolite importimise funktsioonid, pakkudes Linuxi rakendusele dlopen stiilis API. Lisatud koodi saab t\u00f5rkeotsinguks kasutada gdb, ASAN ja Valgrind. On v\u00f5imalik teha k\u00e4itava koodi muutusi jooksvalt, \u00fchendades hook'e ja rakendades parandusplaane (runtime patching). Toetatakse C++ puhul erandite t\u00f6\u00f6tlemist ja lahtiharimist (unwinding).<\/p>\n

Projekti eesm\u00e4rk on organiseerida skaleeritavat ja efektiivset jaotatud fuzzing-testimist DLL-raamatukogude jaoks Linuxi keskkonnas. Windowsis fuzzing- ja coverage testimine ei pruugi olla piisavalt efektiivne ning sageli n\u00f5uab eraldi virtualiseeritud Windowsi instantsi k\u00e4ivitamist, eriti keerukate toodete, n\u00e4iteks tuvastustarkvara anal\u00fc\u00fcsimisel, mis katab t\u00f6\u00f6d tuumatasemel ja kasutajaruumis. LoadLibrary abil otsivad Google'i teadlased haavatavusi videokodekites, viiruset\u00f5rje skannerites, andmete dekompressori raamatukogudes, pildikooderites jne. <\/p>\n

N\u00e4iteks LoadLibrary abil \u00f5nnestus portida Windows Defenderi viiruset\u00f5rje mootori k\u00e4ivitamine Linuxis. Mpengine.dll, mis on Windows Defenderi alus, anal\u00fc\u00fcsimine v\u00f5imaldas uurida suurt hulka keerulisi erinevate formaatide t\u00f6\u00f6tlejaid, failis\u00fcsteemide emulaatoreid ja keele interpretere, mis v\u00f5ivad potentsiaalselt pakkuda r\u00fcnnakuv\u00f5tteid v\u00f5imalike<\/a><\/noindex> r\u00fcnnakute<\/a><\/noindex>.<\/p>\n

LoadLibrary'd on samuti kasutatud kauglekkega haavatavuste tuvastamiseks tuvastatud haavatavust<\/a><\/noindex> Avasti viiruset\u00f5rje paketis. DLL-i uurimisel sellest viiruset\u00f5rjest avastati, et v\u00f5tme privileegitud skaneerimisprotsess sisaldab t\u00e4ielikku JavaScripti t\u00f5lgendajat, mida kasutatakse kolmanda osapoole JavaScripti koodi t\u00e4itmise emuleerimiseks. See protsess ei ole isoleeritud sandbox- keskkonda, ei maanda privileege ja anal\u00fc\u00fcsib kontrollimata v\u00e4liseid andmeid failis\u00fcsteemist ja peidetud v\u00f5rguliikluse anal\u00fc\u00fcsiks. Kuna iga haavatavus selles keerulises ja kaitsmata protsessis v\u00f5ib potentsiaalselt p\u00f5hjustada kogu s\u00fcsteemi kaugl\u00e4bimurdmise, on LoadLibrary alusel v\u00e4lja t\u00f6\u00f6tatud spetsiaalne kiht. avscript<\/a><\/noindex> viiruset\u00f5rjuja Avast haavatavuste anal\u00fc\u00fcsimiseks Linuxi baasil keskkonnas.<\/p>\n

<\/a><\/noindex><\/p>\n

Allikas: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0422\u044d\u0432\u0438\u0441 \u041e\u0440\u043c\u0430\u043d\u0434\u0438 (Tavis Ormandy), \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u0437 Google, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u0442 \u043f\u0440\u043e\u0435\u043a\u0442 LoadLibrary, \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u044b\u0439 \u043d\u0430 \u043f\u043e\u0440\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u043e\u0431\u0440\u0430\u043d\u043d\u044b\u0445 \u0434\u043b\u044f Windows DLL-\u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a \u0434\u043b\u044f \u0438\u0445 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u0432 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f\u0445 \u0434\u043b\u044f Linux. \u041f\u0440\u043e\u0435\u043a\u0442\u043e\u043c \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430-\u043f\u0440\u043e\u0441\u043b\u043e\u0439\u043a\u0430, \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043c\u043e\u0436\u043d\u043e \u0437\u0430\u0433\u0440\u0443\u0437\u0438\u0442\u044c DLL-\u0444\u0430\u0439\u043b \u0432 \u0444\u043e\u0440\u043c\u0430\u0442\u0435 PE\/COFF \u0438 \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0451\u043d\u043d\u044b\u0435 \u0432 \u043d\u0451\u043c \u0444\u0443\u043d\u043a\u0446\u0438\u0438. \u0417\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a PE\/COFF \u043e\u0441\u043d\u043e\u0432\u0430\u043d \u043d\u0430 \u043a\u043e\u0434\u0435 ndiswrapper. \u041a\u043e\u0434 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u0435\u0442\u0441\u044f \u043f\u043e\u0434 \u043b\u0438\u0446\u0435\u043d\u0437\u0438\u0435\u0439 GPLv2. […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-74109","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47LoadLibrary, Windows DLL-de laadimiskiht Linuxi rakendustes | ProHoster","description":"Tavis Ormandy, Google'i turvauurija, arendab projekti","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/loadlibrary-proslojka-dlya-zagruzki-windows-dll-v-linux-prilozheniya","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47LoadLibrary, \u043f\u0440\u043e\u0441\u043b\u043e\u0439\u043a\u0430 \u0434\u043b\u044f \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 Windows DLL \u0432 Linux-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f | ProHoster","og:description":"\u0422\u044d\u0432\u0438\u0441 \u041e\u0440\u043c\u0430\u043d\u0434\u0438 (Tavis Ormandy), \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u0437 Google, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u0442 \u043f\u0440\u043e\u0435\u043a\u0442","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/loadlibrary-proslojka-dlya-zagruzki-windows-dll-v-linux-prilozheniya","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-03-14T05:42:14+00:00","article:modified_time":"2020-03-14T05:42:14+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"74109","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 18:21:21","updated":"2022-10-04 23:06:53","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/74109","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=74109"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/74109\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=74109"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=74109"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=74109"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}