{"id":74109,"date":"2020-03-14T08:42:14","date_gmt":"2020-03-14T05:42:14","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/loadlibrary-proslojka-dlya-zagruzki-windows-dll-v-linux-prilozheniya"},"modified":"2020-03-14T08:42:14","modified_gmt":"2020-03-14T05:42:14","slug":"loadlibrary-proslojka-dlya-zagruzki-windows-dll-v-linux-prilozheniya","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/news\/loadlibrary-proslojka-dlya-zagruzki-windows-dll-v-linux-prilozheniya","title":{"rendered":"LoadLibrary, vrstva na na\u010d\u00edtanie Windows DLL v aplik\u00e1ci\u00e1ch Linux","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Tavis Ormandy (Tavis Ormandy<\/a><\/noindex>), expert na bezpe\u010dnos\u0165 z Google, rozv\u00edja projekt LoadLibrary<\/a><\/noindex>, zameran\u00fd na portovanie kni\u017en\u00edc DLL zostaven\u00fdch pre Windows na ich pou\u017eitie v aplik\u00e1ci\u00e1ch pre Linux. Projekt poskytuje kni\u017enicu-vrstvu, pomocou ktorej je mo\u017en\u00e9 na\u010d\u00edta\u0165 DLL s\u00fabor vo form\u00e1te PE\/COFF a zavola\u0165 definovan\u00e9 v \u0148om funkcie. Na\u010d\u00edta\u010d PE\/COFF je zalo\u017een\u00fd na k\u00f3de ndiswrapper<\/a><\/noindex>. K\u00f3d projektu distribuovan\u00fd<\/a><\/noindex> pod licenciou GPLv2.<\/p>\n

LoadLibrary sa star\u00e1 o funkcie na\u010d\u00edtania kni\u017enice do pam\u00e4te a importovania existuj\u00facich symbolov, poskytuj\u00fac aplik\u00e1cii Linux API v \u0161t\u00fdle dlopen. Pripojen\u00fd k\u00f3d m\u00f4\u017ee by\u0165 ladite\u013en\u00fd pomocou gdb, ASAN a Valgrind. Predpoklad\u00e1 sa mo\u017enos\u0165 \u00fapravy vykon\u00e1vacieho k\u00f3du po\u010das behu prostredn\u00edctvom pripojenia hookov a nan\u00e1\u0161ania patchov (runtime patching). Podporuje sa spracovanie a rozmot\u00e1vanie (unwinding) v\u00fdnimiek pre C++.<\/p>\n

Cie\u013eom projektu je organiz\u00e1cia \u0161k\u00e1lovate\u013en\u00e9ho a efekt\u00edvneho distribuovan\u00e9ho fuzzing-testovania kni\u017en\u00edc DLL v prostred\u00ed zalo\u017eenom na Linuxe. Na Windows uskuto\u010dnenie fuzzing- a coverage-testovania nedosahuje po\u017eadovan\u00fa efekt\u00edvnos\u0165 a \u010dasto vy\u017eaduje spustenie samostatn\u00e9ho virtualizovan\u00e9ho in\u0161tancie Windows, najm\u00e4 pri pokuse analyzova\u0165 zlo\u017eit\u00fd softv\u00e9r, ako je antiv\u00edrusov\u00fd softv\u00e9r, pokr\u00fdvaj\u00faci pr\u00e1cu na \u00farovni jadra a u\u017e\u00edvate\u013esk\u00e9ho priestoru. Pomocou LoadLibrary sa v\u00fdskumn\u00edci z Google zaoberaj\u00fa vyh\u013ead\u00e1van\u00edm zranite\u013enost\u00ed vo video kodekoch, antiv\u00edrusov\u00fdch skeneroch, kni\u017eniciach na rozba\u013eovanie d\u00e1t, dekod\u00e9roch obr\u00e1zkov a podobne. <\/p>\n

Napr\u00edklad pomocou LoadLibrary sa podarilo portova\u0165 na spustenie v Linuxe antiv\u00edrusov\u00fd motor Windows Defender. V\u00fdskum mpengine.dll, ktor\u00fd tvor\u00ed z\u00e1klad Windows Defender, umo\u017enil analyzova\u0165 ve\u013ek\u00e9 mno\u017estvo zlo\u017eit\u00fdch spracovate\u013eov r\u00f4znych form\u00e1tov, emul\u00e1torov FS a interpret\u00e1torov jazykov, potenci\u00e1lne poskytuj\u00facich vektory pre mo\u017en\u00e9<\/a><\/noindex> \u00fatokmi<\/a><\/noindex>.<\/p>\n

LoadLibrary sa taktie\u017e vyu\u017e\u00edval pri odha\u013eovan\u00ed distant vulnerability<\/a><\/noindex> v antiv\u00edrusovom bal\u00edku Avast. Pri sk\u00faman\u00ed DLL tohto antiv\u00edrusu bolo zisten\u00e9, \u017ee k\u013e\u00fa\u010dov\u00fd privilegovan\u00fd proces skenovania zah\u0155\u0148a plnohodnotn\u00fd JavaScript interpreter, ktor\u00fd sa pou\u017e\u00edva na emul\u00e1ciu vykon\u00e1vania extern\u00e9ho JavaScript k\u00f3du. Tento proces nie je izolovan\u00fd v sandboxovom prostred\u00ed, nezni\u017euje privilegiality a vykon\u00e1va anal\u00fdzu neoveren\u00fdch extern\u00fdch \u00fadajov z FS a zachytenej sie\u0165ovej prev\u00e1dzky. Ke\u010f\u017ee ak\u00e1ko\u013evek zranite\u013enos\u0165 v tomto zlo\u017eitom a nezabezpe\u010denom procese m\u00f4\u017ee potenci\u00e1lne vies\u0165 k vzdialenej kompromit\u00e1cii cel\u00e9ho syst\u00e9mu, na z\u00e1klade LoadLibrary bola vyvinut\u00e1 \u0161peci\u00e1lna vrstva. avscript<\/a><\/noindex> na anal\u00fdzu zranite\u013enost\u00ed v antiv\u00edrusovom skeneri Avast v prostred\u00ed zalo\u017eenom na Linuxe.<\/p>\n

<\/a><\/noindex><\/p>\n

Zdroj: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0422\u044d\u0432\u0438\u0441 \u041e\u0440\u043c\u0430\u043d\u0434\u0438 (Tavis Ormandy), \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u0437 Google, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u0442 \u043f\u0440\u043e\u0435\u043a\u0442 LoadLibrary, \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u044b\u0439 \u043d\u0430 \u043f\u043e\u0440\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u043e\u0431\u0440\u0430\u043d\u043d\u044b\u0445 \u0434\u043b\u044f Windows DLL-\u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a \u0434\u043b\u044f \u0438\u0445 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u0432 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f\u0445 \u0434\u043b\u044f Linux. \u041f\u0440\u043e\u0435\u043a\u0442\u043e\u043c \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430-\u043f\u0440\u043e\u0441\u043b\u043e\u0439\u043a\u0430, \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043c\u043e\u0436\u043d\u043e \u0437\u0430\u0433\u0440\u0443\u0437\u0438\u0442\u044c DLL-\u0444\u0430\u0439\u043b \u0432 \u0444\u043e\u0440\u043c\u0430\u0442\u0435 PE\/COFF \u0438 \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0451\u043d\u043d\u044b\u0435 \u0432 \u043d\u0451\u043c \u0444\u0443\u043d\u043a\u0446\u0438\u0438. \u0417\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a PE\/COFF \u043e\u0441\u043d\u043e\u0432\u0430\u043d \u043d\u0430 \u043a\u043e\u0434\u0435 ndiswrapper. \u041a\u043e\u0434 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u0435\u0442\u0441\u044f \u043f\u043e\u0434 \u043b\u0438\u0446\u0435\u043d\u0437\u0438\u0435\u0439 GPLv2. […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-74109","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47LoadLibrary, vrstva na na\u010d\u00edtanie Windows DLL do Linux aplik\u00e1ci\u00ed | ProHoster","description":"Tavis Ormandy, v\u00fdskumn\u00edk v oblasti bezpe\u010dnosti z Google, rozv\u00edja projekt","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/news\/loadlibrary-proslojka-dlya-zagruzki-windows-dll-v-linux-prilozheniya","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47LoadLibrary, \u043f\u0440\u043e\u0441\u043b\u043e\u0439\u043a\u0430 \u0434\u043b\u044f \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 Windows DLL \u0432 Linux-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f | ProHoster","og:description":"\u0422\u044d\u0432\u0438\u0441 \u041e\u0440\u043c\u0430\u043d\u0434\u0438 (Tavis Ormandy), \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u0437 Google, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u0442 \u043f\u0440\u043e\u0435\u043a\u0442","og:url":"https:\/\/prohoster.info\/sk\/blog\/news\/loadlibrary-proslojka-dlya-zagruzki-windows-dll-v-linux-prilozheniya","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-03-14T05:42:14+00:00","article:modified_time":"2020-03-14T05:42:14+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"74109","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 18:21:21","updated":"2022-10-04 23:06:53","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/74109","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=74109"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/74109\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=74109"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=74109"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=74109"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}