{"id":74109,"date":"2020-03-14T08:42:14","date_gmt":"2020-03-14T05:42:14","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/loadlibrary-proslojka-dlya-zagruzki-windows-dll-v-linux-prilozheniya"},"modified":"2020-03-14T08:42:14","modified_gmt":"2020-03-14T05:42:14","slug":"loadlibrary-proslojka-dlya-zagruzki-windows-dll-v-linux-prilozheniya","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/loadlibrary-proslojka-dlya-zagruzki-windows-dll-v-linux-prilozheniya","title":{"rendered":"LoadLibrary, nj\u00eb nd\u00ebrfaqe p\u00ebr ngarkimin e DLL-ve t\u00eb Windows brenda aplikacioneve Linux.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Tavis Ormandy (Tavis Ormandy<\/a><\/noindex>), nj\u00eb k\u00ebrkues i siguris\u00eb n\u00eb Google, \u00ebsht\u00eb duke zhvilluar nj\u00eb projekt LoadLibrary<\/a><\/noindex>, i orientuar drejt portimit t\u00eb bibliotekave DLL t\u00eb mbledhura p\u00ebr Windows p\u00ebr t'i p\u00ebrdorur n\u00eb aplikacionet p\u00ebr Linux. Projekti ofron nj\u00eb bibliotek\u00eb-mesfush\u00eb, me ndihm\u00ebn e s\u00eb cil\u00ebs mund t\u00eb ngarkohet nj\u00eb skedar DLL n\u00eb formatin PE\/COFF dhe t\u00eb thirren funksione t\u00eb caktuara n\u00eb t\u00eb. Ngarkuesi PE\/COFF bazohet n\u00eb kodin ndiswrapper<\/a><\/noindex>. Kodi i projektit shp\u00ebrndahet<\/a><\/noindex> n\u00eb p\u00ebrputhje me licenc\u00ebn GPLv2.<\/p>\n

LoadLibrary merr mbi vete funksionet e ngarkimit t\u00eb bibliotekave n\u00eb memorje dhe importimin e simboleve ekzistuese, duke i ofruar aplikacionit p\u00ebr Linux nj\u00eb API n\u00eb stilin dlopen. Kodi i lidhur mund t\u00eb ndiqet me ndihm\u00ebn e gdb, ASAN dhe Valgrind. \u00cbsht\u00eb parashikuar mund\u00ebsia e rregullimit t\u00eb kodit ekzekutues gjat\u00eb ekzekutimit p\u00ebrmes lidhjes s\u00eb hooks dhe vendosjes s\u00eb patches (runtime patching). Mb\u00ebshteten trajtimi dhe zgjidhja (unwinding) e p\u00ebrjashtimeve p\u00ebr C++.<\/p>\n

Q\u00ebllimi i projektit \u00ebsht\u00eb organizimi i nj\u00eb testimi fuzzing-shkall\u00ebzues dhe efikas t\u00eb shp\u00ebrndarjes s\u00eb bibliotekave DLL n\u00eb nj\u00eb mjedis bazuar n\u00eb Linux. N\u00eb Windows, kryerja e testimeve fuzzing dhe coverage nuk lejon arritjen e efektivitetit t\u00eb duhur dhe shpesh k\u00ebrkon t\u00eb drejtohet nj\u00eb instanc\u00eb e ve\u00e7ant\u00eb virtualizimi e Windows, ve\u00e7an\u00ebrisht kur p\u00ebrpiqet t\u00eb analizohet produkte t\u00eb komplikuara, si\u00e7 jan\u00eb softuer\u00ebt antivirus, q\u00eb mbulojn\u00eb operimin n\u00eb nivelin e b\u00ebrtham\u00ebs dhe hap\u00ebsir\u00ebs s\u00eb p\u00ebrdoruesit. Me ndihm\u00ebn e LoadLibrary, k\u00ebrkuesit nga Google jan\u00eb duke k\u00ebrkuar p\u00ebr dob\u00ebsi n\u00eb kodek\u00ebt video, skaner\u00ebt antivirus, bibliotekat e shp\u00ebrb\u00ebrjes s\u00eb t\u00eb dh\u00ebnave, dekoduesit e imazheve, etj. <\/p>\n

P\u00ebr shembull, me ndihm\u00ebn e LoadLibrary, \u00ebsht\u00eb arritur t\u00eb portohen p\u00ebr ekzekutim n\u00eb Linux motorin antivirus Windows Defender. Studimi i mpengine.dll, q\u00eb formon themel t\u00eb Windows Defender, ka lejuar analizimin e nj\u00eb numri t\u00eb madh t\u00eb trajtuesve t\u00eb komplikuar t\u00eb formateve t\u00eb ndryshme, emuluesve t\u00eb FUS dhe interpretor\u00ebve t\u00eb gjuh\u00ebve, q\u00eb potencialisht ofrojn\u00eb vektor\u00eb p\u00ebr realizimet<\/a><\/noindex> e sulmeve<\/a><\/noindex>.<\/p>\n

LoadLibrary gjithashtu \u00ebsht\u00eb p\u00ebrdorur p\u00ebr identifikimin e dob\u00ebsive t\u00eb larguara<\/a><\/noindex> n\u00eb paket\u00ebn antivirus Avast. Gjat\u00eb studimit t\u00eb DLL nga ky antivirus, u zbulua se procesi kryesor privilegjuar i skanimit p\u00ebrfshin nj\u00eb interpretues t\u00eb plot\u00eb JavaScript, i p\u00ebrdorur p\u00ebr t\u00eb imituar ekzekutimin e kodit JavaScript t\u00eb pal\u00ebve t\u00eb treta. Ky proces nuk \u00ebsht\u00eb i izoluar n\u00eb nj\u00eb ambient sandbox, nuk u heq privilegjet dhe kryen analiz\u00ebn e t\u00eb dh\u00ebnave t\u00eb paprovuar t\u00eb jashtme nga FS dhe trafik\u00ebt rrjetor t\u00eb kapura. Duke qen\u00eb se \u00e7do dob\u00ebsi n\u00eb k\u00ebt\u00eb proces t\u00eb nd\u00ebrlikuar dhe t\u00eb pambrojtur mund t\u00eb \u00e7oj\u00eb n\u00eb kompromitim t\u00eb larg\u00ebt t\u00eb gjith\u00eb sistemit, u zhvillua nj\u00eb shell e ve\u00e7ant\u00eb mbi LoadLibrary. avscript<\/a><\/noindex> p\u00ebr analizimin e dob\u00ebsive n\u00eb skanerin antivirus Avast n\u00eb nj\u00eb ambient t\u00eb bazuar n\u00eb Linux.<\/p>\n

<\/a><\/noindex><\/p>\n

Burimi: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0422\u044d\u0432\u0438\u0441 \u041e\u0440\u043c\u0430\u043d\u0434\u0438 (Tavis Ormandy), \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u0437 Google, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u0442 \u043f\u0440\u043e\u0435\u043a\u0442 LoadLibrary, \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u044b\u0439 \u043d\u0430 \u043f\u043e\u0440\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u043e\u0431\u0440\u0430\u043d\u043d\u044b\u0445 \u0434\u043b\u044f Windows DLL-\u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a \u0434\u043b\u044f \u0438\u0445 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u0432 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f\u0445 \u0434\u043b\u044f Linux. \u041f\u0440\u043e\u0435\u043a\u0442\u043e\u043c \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430-\u043f\u0440\u043e\u0441\u043b\u043e\u0439\u043a\u0430, \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043c\u043e\u0436\u043d\u043e \u0437\u0430\u0433\u0440\u0443\u0437\u0438\u0442\u044c DLL-\u0444\u0430\u0439\u043b \u0432 \u0444\u043e\u0440\u043c\u0430\u0442\u0435 PE\/COFF \u0438 \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0451\u043d\u043d\u044b\u0435 \u0432 \u043d\u0451\u043c \u0444\u0443\u043d\u043a\u0446\u0438\u0438. \u0417\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a PE\/COFF \u043e\u0441\u043d\u043e\u0432\u0430\u043d \u043d\u0430 \u043a\u043e\u0434\u0435 ndiswrapper. \u041a\u043e\u0434 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u0435\u0442\u0441\u044f \u043f\u043e\u0434 \u043b\u0438\u0446\u0435\u043d\u0437\u0438\u0435\u0439 GPLv2. […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-74109","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47LoadLibrary, nj\u00eb nd\u00ebrfaqe p\u00ebr ngarkimin e DLL Windows n\u00eb aplikacione Linux | ProHoster","description":"Tavis Ormandy, nj\u00eb k\u00ebrkues sigurie nga Google, zhvillon projektin","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/news\/loadlibrary-proslojka-dlya-zagruzki-windows-dll-v-linux-prilozheniya","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47LoadLibrary, \u043f\u0440\u043e\u0441\u043b\u043e\u0439\u043a\u0430 \u0434\u043b\u044f \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 Windows DLL \u0432 Linux-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f | ProHoster","og:description":"\u0422\u044d\u0432\u0438\u0441 \u041e\u0440\u043c\u0430\u043d\u0434\u0438 (Tavis Ormandy), \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u0437 Google, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u0442 \u043f\u0440\u043e\u0435\u043a\u0442","og:url":"https:\/\/prohoster.info\/sq\/blog\/news\/loadlibrary-proslojka-dlya-zagruzki-windows-dll-v-linux-prilozheniya","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-03-14T05:42:14+00:00","article:modified_time":"2020-03-14T05:42:14+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"74109","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 18:21:21","updated":"2022-10-04 23:06:53","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/74109","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=74109"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/74109\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=74109"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=74109"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=74109"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}