{"id":74109,"date":"2020-03-14T08:42:14","date_gmt":"2020-03-14T05:42:14","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/loadlibrary-proslojka-dlya-zagruzki-windows-dll-v-linux-prilozheniya"},"modified":"2020-03-14T08:42:14","modified_gmt":"2020-03-14T05:42:14","slug":"loadlibrary-proslojka-dlya-zagruzki-windows-dll-v-linux-prilozheniya","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/loadlibrary-proslojka-dlya-zagruzki-windows-dll-v-linux-prilozheniya","title":{"rendered":"LoadLibrary, un strat pentru \u00eenc\u0103rcarea DLL-urilor Windows \u00een aplica\u021bii Linux","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Tavis Ormandy (Tavis Ormandy<\/a><\/noindex>), cercet\u0103tor \u00een domeniul securit\u0103\u021bii de la Google, dezvolt\u0103 proiectul LoadLibrary<\/a><\/noindex>, destinat port\u0103rii bibliotecilor DLL compilate pentru Windows pentru utilizarea \u00een aplica\u021biile Linux. Proiectul ofer\u0103 o bibliotec\u0103 de interfa\u021b\u0103 care permite \u00eenc\u0103rcarea fi\u0219ierelor DLL \u00een format PE\/COFF \u0219i apelarea func\u021biilor definite \u00een acestea. \u00cenc\u0103rc\u0103torul PE\/COFF se bazeaz\u0103 pe codul ndiswrapper<\/a><\/noindex>. Codul proiectului se r\u0103sp\u00e2nde\u0219te<\/a><\/noindex> sub licen\u021ba GPLv2.<\/p>\n

LoadLibrary se ocup\u0103 cu func\u021biile de \u00eenc\u0103rcare a bibliotecii \u00een memorie \u0219i importul simbolurilor existente, oferind aplica\u021biei Linux o API de tip dlopen. Codul dinamic poate fi decodat folosind gdb, ASAN \u0219i Valgrind. Este posibil\u0103 ajustarea codului executabil \u00een timpul execu\u021biei prin conectarea hook-urilor \u0219i aplicarea patch-urilor (runtime patching). Suport\u0103 procesarea \u0219i desf\u0103\u0219urarea excep\u021biilor pentru C++.<\/p>\n

Obiectivul proiectului este organizarea unui testare distribuit\u0103 de fuzzing a bibliotecilor DLL \u00eentr-un mediu bazat pe Linux. \u00cen Windows, efectuarea testelor de fuzzing \u0219i coverage nu permite ob\u021binerea eficien\u021bei dorite \u0219i necesit\u0103 adesea rularea unei copii virtualizate separate de Windows, \u00een special c\u00e2nd se analizeaz\u0103 produse complexe, cum ar fi software-ul antivirus, care acoper\u0103 func\u021bionarea la nivel de kernel \u0219i spa\u021biul utilizatorului. Prin intermediul LoadLibrary, cercet\u0103torii de la Google caut\u0103 vulnerabilit\u0103\u021bi \u00een codec-uri video, scanere antivirus, biblioteci de decomprimare a datelor, decodoare de imagini etc. <\/p>\n

De exemplu, prin intermediul LoadLibrary a fost posibil\u0103 portarea motorului antivirus Windows Defender pentru a rula \u00een Linux. Analiza mpengine.dll, care este baza Windows Defender, a permis analiza unui num\u0103r mare de manipulatoare complexe pentru diverse formate, emulatori de FS \u0219i interpre\u021bi de limbaje, care pot oferi vectori pentru realiz\u0103rile fizice<\/a><\/noindex> atacurilor<\/a><\/noindex>.<\/p>\n

LoadLibrary a fost de asemenea utilizat \u00een identificarea vulnerabilit\u0103\u021bii de la distan\u021b\u0103<\/a><\/noindex> \u00een pachetul antivirus Avast. La examinarea DLL-ului acestui antivirus, s-a constatat c\u0103 procesul cheie privilegiat de scanare include un interpret JavaScript complet, folosit pentru a emula execu\u021bia codului JavaScript ter\u021b. Acest proces nu este izolat \u00eentr-un mediu sandbox, nu \u00ee\u0219i reduce privilegiile \u0219i efectueaz\u0103 analiza datelor externe nesigure din sistemul de fi\u0219iere \u0219i din traficul de re\u021bea interceptat. Deoarece orice vulnerabilitate \u00een acest proces complex \u0219i neprotejat poate duce poten\u021bial la compromiterea de la distan\u021b\u0103 a \u00eentregului sistem, pe baza LoadLibrary a fost dezvoltat\u0103 o interfa\u021b\u0103 special\u0103. avscript<\/a><\/noindex> pentru analiza vulnerabilit\u0103\u021bilor din scannerul antivirus Avast \u00eentr-un mediu bazat pe Linux.<\/p>\n

<\/a><\/noindex><\/p>\n

Sursa: opennet.ro<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0422\u044d\u0432\u0438\u0441 \u041e\u0440\u043c\u0430\u043d\u0434\u0438 (Tavis Ormandy), \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u0437 Google, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u0442 \u043f\u0440\u043e\u0435\u043a\u0442 LoadLibrary, \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u044b\u0439 \u043d\u0430 \u043f\u043e\u0440\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u043e\u0431\u0440\u0430\u043d\u043d\u044b\u0445 \u0434\u043b\u044f Windows DLL-\u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a \u0434\u043b\u044f \u0438\u0445 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u0432 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f\u0445 \u0434\u043b\u044f Linux. \u041f\u0440\u043e\u0435\u043a\u0442\u043e\u043c \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430-\u043f\u0440\u043e\u0441\u043b\u043e\u0439\u043a\u0430, \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043c\u043e\u0436\u043d\u043e \u0437\u0430\u0433\u0440\u0443\u0437\u0438\u0442\u044c DLL-\u0444\u0430\u0439\u043b \u0432 \u0444\u043e\u0440\u043c\u0430\u0442\u0435 PE\/COFF \u0438 \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0451\u043d\u043d\u044b\u0435 \u0432 \u043d\u0451\u043c \u0444\u0443\u043d\u043a\u0446\u0438\u0438. \u0417\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a PE\/COFF \u043e\u0441\u043d\u043e\u0432\u0430\u043d \u043d\u0430 \u043a\u043e\u0434\u0435 ndiswrapper. \u041a\u043e\u0434 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u0435\u0442\u0441\u044f \u043f\u043e\u0434 \u043b\u0438\u0446\u0435\u043d\u0437\u0438\u0435\u0439 GPLv2. […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-74109","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47LoadLibrary, o interfa\u021b\u0103 pentru \u00eenc\u0103rcarea DLL Windows \u00een aplica\u021bii Linux | ProHoster","description":"Tavis Ormandy, un cercet\u0103tor \u00een securitate de la Google, dezvolt\u0103 proiectul","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/loadlibrary-proslojka-dlya-zagruzki-windows-dll-v-linux-prilozheniya","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47LoadLibrary, \u043f\u0440\u043e\u0441\u043b\u043e\u0439\u043a\u0430 \u0434\u043b\u044f \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 Windows DLL \u0432 Linux-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f | ProHoster","og:description":"\u0422\u044d\u0432\u0438\u0441 \u041e\u0440\u043c\u0430\u043d\u0434\u0438 (Tavis Ormandy), \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u0437 Google, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u0442 \u043f\u0440\u043e\u0435\u043a\u0442","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/loadlibrary-proslojka-dlya-zagruzki-windows-dll-v-linux-prilozheniya","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-03-14T05:42:14+00:00","article:modified_time":"2020-03-14T05:42:14+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"74109","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 18:21:21","updated":"2022-10-04 23:06:53","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/74109","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=74109"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/74109\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=74109"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=74109"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=74109"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}