{"id":74109,"date":"2020-03-14T08:42:14","date_gmt":"2020-03-14T05:42:14","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/loadlibrary-proslojka-dlya-zagruzki-windows-dll-v-linux-prilozheniya"},"modified":"2020-03-14T08:42:14","modified_gmt":"2020-03-14T05:42:14","slug":"loadlibrary-proslojka-dlya-zagruzki-windows-dll-v-linux-prilozheniya","status":"publish","type":"post","link":"https:\/\/prohoster.info\/fr\/blog\/news\/loadlibrary-proslojka-dlya-zagruzki-windows-dll-v-linux-prilozheniya","title":{"rendered":"LoadLibrary, une couche pour charger des DLL Windows dans des applications Linux","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Tavis Ormandy (Tavis Ormandy<\/a><\/noindex>), chercheur en s\u00e9curit\u00e9 chez Google, d\u00e9veloppe un projet LoadLibrary<\/a><\/noindex>, visant \u00e0 porter des biblioth\u00e8ques DLL compil\u00e9es pour Windows afin de les utiliser dans des applications Linux. Le projet fournit une biblioth\u00e8que interm\u00e9diaire permettant de charger un fichier DLL au format PE\/COFF et d'appeler des fonctions d\u00e9finies dans celui-ci. Le chargeur PE\/COFF est bas\u00e9 sur le code ndiswrapper<\/a><\/noindex>. Le code du projet est distribu\u00e9<\/a><\/noindex> sous licence GPLv2.<\/p>\n

LoadLibrary prend en charge les fonctions de chargement de biblioth\u00e8que en m\u00e9moire et d'importation de symboles existants, offrant \u00e0 l'application Linux une API de style dlopen. Le code connectable peut \u00eatre d\u00e9bogu\u00e9 \u00e0 l'aide de gdb, ASAN et Valgrind. Il est pr\u00e9vu de pouvoir ajuster le code ex\u00e9cutable au moment de l'ex\u00e9cution via des hooks et l'application de patches (runtime patching). Le traitement et le d\u00e9ballage (unwinding) des exceptions pour C++ sont pris en charge.<\/p>\n

L'objectif du projet est de mettre en place un test de fuzzing distribu\u00e9, \u00e9volutif et efficace des biblioth\u00e8ques DLL dans un environnement bas\u00e9 sur Linux. Dans Windows, la r\u00e9alisation de tests de fuzzing et de couverture ne permet pas d'atteindre une efficacit\u00e9 suffisante et n\u00e9cessite souvent de lancer une instance virtualis\u00e9e s\u00e9par\u00e9e de Windows, surtout lors de tentatives d'analyse de produits complexes tels que les logiciels antivirus, qui impliquent le fonctionnement au niveau du noyau et de l'espace utilisateur. Gr\u00e2ce \u00e0 LoadLibrary, des chercheurs de Google cherchent des vuln\u00e9rabilit\u00e9s dans des codecs vid\u00e9o, des scanners antivirus, des biblioth\u00e8ques de d\u00e9compression de donn\u00e9es, des d\u00e9codeurs d'images, etc. <\/p>\n

Par exemple, gr\u00e2ce \u00e0 LoadLibrary, il a \u00e9t\u00e9 possible de porter pour un fonctionnement sous Linux le moteur antivirus Windows Defender. L'analyse de mpengine.dll, qui constitue la base de Windows Defender, a permis d'\u00e9tudier un grand nombre de gestionnaires complexes de diff\u00e9rents formats, d'\u00e9mulateurs de syst\u00e8mes de fichiers et d'interpr\u00e9teurs de langages, potentiellement offrant des vecteurs pour des r\u00e9alisations<\/a><\/noindex> les attaques<\/a><\/noindex>.<\/p>\n

LoadLibrary a \u00e9galement \u00e9t\u00e9 utilis\u00e9 pour identifier une vuln\u00e9rabilit\u00e9 distante<\/a><\/noindex> dans le paquet antivirus Avast. En \u00e9tudiant les DLL de cet antivirus, il a \u00e9t\u00e9 d\u00e9couvert que le processus de num\u00e9risation privil\u00e9gi\u00e9 cl\u00e9 inclut un interpr\u00e9teur JavaScript complet, utilis\u00e9 pour \u00e9muler l'ex\u00e9cution de code JavaScript tiers. Ce processus n'est pas isol\u00e9 dans un environnement sandbox, ne r\u00e9initialise pas les privil\u00e8ges et analyse des donn\u00e9es externes non v\u00e9rifi\u00e9es provenant du syst\u00e8me de fichiers et du trafic r\u00e9seau intercept\u00e9. \u00c9tant donn\u00e9 qu'une vuln\u00e9rabilit\u00e9 dans ce processus complexe et non s\u00e9curis\u00e9 peut potentiellement conduire \u00e0 une compromission \u00e0 distance de l'ensemble du syst\u00e8me, une couche sp\u00e9ciale a \u00e9t\u00e9 d\u00e9velopp\u00e9e sur la base de LoadLibrary. avscript<\/a><\/noindex> pour analyser les vuln\u00e9rabilit\u00e9s de l'analyseur antivirus Avast dans un environnement bas\u00e9 sur Linux.<\/p>\n

<\/a><\/noindex><\/p>\n

Source : opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0422\u044d\u0432\u0438\u0441 \u041e\u0440\u043c\u0430\u043d\u0434\u0438 (Tavis Ormandy), \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u0437 Google, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u0442 \u043f\u0440\u043e\u0435\u043a\u0442 LoadLibrary, \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u044b\u0439 \u043d\u0430 \u043f\u043e\u0440\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u043e\u0431\u0440\u0430\u043d\u043d\u044b\u0445 \u0434\u043b\u044f Windows DLL-\u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a \u0434\u043b\u044f \u0438\u0445 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u0432 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f\u0445 \u0434\u043b\u044f Linux. \u041f\u0440\u043e\u0435\u043a\u0442\u043e\u043c \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430-\u043f\u0440\u043e\u0441\u043b\u043e\u0439\u043a\u0430, \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043c\u043e\u0436\u043d\u043e \u0437\u0430\u0433\u0440\u0443\u0437\u0438\u0442\u044c DLL-\u0444\u0430\u0439\u043b \u0432 \u0444\u043e\u0440\u043c\u0430\u0442\u0435 PE\/COFF \u0438 \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0451\u043d\u043d\u044b\u0435 \u0432 \u043d\u0451\u043c \u0444\u0443\u043d\u043a\u0446\u0438\u0438. \u0417\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a PE\/COFF \u043e\u0441\u043d\u043e\u0432\u0430\u043d \u043d\u0430 \u043a\u043e\u0434\u0435 ndiswrapper. \u041a\u043e\u0434 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u0435\u0442\u0441\u044f \u043f\u043e\u0434 \u043b\u0438\u0446\u0435\u043d\u0437\u0438\u0435\u0439 GPLv2. […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-74109","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47LoadLibrary, une couche pour charger des DLL Windows dans des applications Linux | ProHoster","description":"Tavis Ormandy, chercheur en s\u00e9curit\u00e9 chez Google, d\u00e9veloppe le projet","canonical_url":"https:\/\/prohoster.info\/fr\/blog\/news\/loadlibrary-proslojka-dlya-zagruzki-windows-dll-v-linux-prilozheniya","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"fr_FR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47LoadLibrary, \u043f\u0440\u043e\u0441\u043b\u043e\u0439\u043a\u0430 \u0434\u043b\u044f \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 Windows DLL \u0432 Linux-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f | ProHoster","og:description":"\u0422\u044d\u0432\u0438\u0441 \u041e\u0440\u043c\u0430\u043d\u0434\u0438 (Tavis Ormandy), \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u0437 Google, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u0442 \u043f\u0440\u043e\u0435\u043a\u0442","og:url":"https:\/\/prohoster.info\/fr\/blog\/news\/loadlibrary-proslojka-dlya-zagruzki-windows-dll-v-linux-prilozheniya","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-03-14T05:42:14+00:00","article:modified_time":"2020-03-14T05:42:14+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"74109","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 18:21:21","updated":"2022-10-04 23:06:53","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/74109","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/comments?post=74109"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/74109\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/media?parent=74109"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/categories?post=74109"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/tags?post=74109"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}