{"id":74109,"date":"2020-03-14T08:42:14","date_gmt":"2020-03-14T05:42:14","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/loadlibrary-proslojka-dlya-zagruzki-windows-dll-v-linux-prilozheniya"},"modified":"2020-03-14T08:42:14","modified_gmt":"2020-03-14T05:42:14","slug":"loadlibrary-proslojka-dlya-zagruzki-windows-dll-v-linux-prilozheniya","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/loadlibrary-proslojka-dlya-zagruzki-windows-dll-v-linux-prilozheniya","title":{"rendered":"LoadLibrary, nj\u00eb shtres\u00eb p\u00ebr ngarkimin e DLL Windows n\u00eb aplikacionet Linux","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Tavis Ormandy (Tavis Ormandy<\/a><\/noindex>), hulumtues i siguris\u00eb nga Google, po zhvillon projektin LoadLibrary<\/a><\/noindex>, i cili ka si q\u00ebllim portimin e bibliotekave DLL t\u00eb mbledhura p\u00ebr Windows p\u00ebr t'u p\u00ebrdorur n\u00eb aplikacionet p\u00ebr Linux. Projekti ofron nj\u00eb bibliotek\u00eb ndihm\u00ebse, me t\u00eb cil\u00ebn mund t\u00eb ngarkohet nj\u00eb skedar DLL n\u00eb formatin PE\/COFF dhe t\u00eb thirren funksionet e caktuara brenda tij. Ngarkuesi PE\/COFF bazohet n\u00eb kodin ndiswrapper<\/a><\/noindex>. Kodi i projektit distribuohet<\/a><\/noindex> n\u00ebn licenc\u00ebn GPLv2.<\/p>\n

LoadLibrary merr p\u00ebrsip\u00ebr funksionet e ngarkimit t\u00eb bibliotekave n\u00eb memorje dhe importimin e simboleve t\u00eb disponueshme, duke ofruar nj\u00eb API p\u00ebr aplikacionin Linux n\u00eb stilin e dlopen. Kodi i lidhur mund t\u00eb debugohet me ndihm\u00ebn e gdb, ASAN dhe Valgrind. Parashikohet mund\u00ebsia e modifikimit t\u00eb kodit ekzekutiv gjat\u00eb ekzekutimit p\u00ebrmes lidhjes s\u00eb hooks dhe vendosjes s\u00eb patches (runtime patching). Mb\u00ebshteten p\u00ebrpunimet dhe shfletimi (unwinding) i p\u00ebrjashtimeve p\u00ebr C++.<\/p>\n

Q\u00ebllimi i projektit \u00ebsht\u00eb organizimi i testimeve fuzzing t\u00eb shkall\u00ebzuara dhe efektive p\u00ebr bibliotekat DLL n\u00eb nj\u00eb mjedis t\u00eb bazuar n\u00eb Linux. N\u00eb Windows, kryerja e testeve fuzzing dhe coverage nuk arrin t\u00eb jap\u00eb efikasitetin e duhur dhe shpesh k\u00ebrkon ekzekutimin e nj\u00eb instance t\u00eb ve\u00e7ant\u00eb t\u00eb virtualizuar t\u00eb Windows, ve\u00e7an\u00ebrisht kur tentoni t\u00eb analizoni produkte komplekse, si\u00e7 jan\u00eb softuer\u00ebt antivirus, t\u00eb cil\u00ebt mbulojn\u00eb operimin n\u00eb nivelin e b\u00ebrtham\u00ebs dhe hap\u00ebsir\u00ebs s\u00eb p\u00ebrdoruesit. Me ndihm\u00ebn e LoadLibrary, hulumtuesit nga Google jan\u00eb angazhuar n\u00eb gjetjen e vulnerabiliteteve n\u00eb kodek\u00ebt video, skanuesit antivirus, bibliotekat e shpaketimit t\u00eb t\u00eb dh\u00ebnave, dekoduesit e imazheve, etj. <\/p>\n

P\u00ebr shembull, me ndihm\u00ebn e LoadLibrary u arrit t\u00eb portifikohej motorin antivirus Windows Defender p\u00ebr ekzekutimin n\u00eb Linux. Hulumtimi i mpengine.dll, q\u00eb p\u00ebrb\u00ebn baz\u00ebn e Windows Defender, dha mund\u00ebsin\u00eb p\u00ebr t\u00eb analizuar nj\u00eb num\u00ebr t\u00eb madh t\u00eb p\u00ebrpunuesve kompleks t\u00eb formateve t\u00eb ndryshme, emulator\u00ebve t\u00eb FS dhe interpretor\u00ebve t\u00eb gjuh\u00ebve, q\u00eb potencialisht ofrojn\u00eb vektor\u00eb p\u00ebr realizimet<\/a><\/noindex> sulm<\/a><\/noindex>.<\/p>\n

LoadLibrary gjithashtu u p\u00ebrdor n\u00eb identifikimin e vulnerabilitetit t\u00eb larg\u00ebt<\/a><\/noindex> n\u00eb paket\u00ebn antivirus Avast. N\u00eb studimin e DLL-s\u00eb nga ky antivirus, u zbulua se procesi kryesor me privilegje i skanimit p\u00ebrfshin nj\u00eb interpretor t\u00eb plot\u00eb JavaScript, i p\u00ebrdorur p\u00ebr t\u00eb imituar ekzekutimin e kodit t\u00eb jasht\u00ebm JavaScript. Ky proces nuk \u00ebsht\u00eb i izoluar n\u00eb nj\u00eb ambient sandbox, nuk heq privilegjet dhe kryen analiz\u00ebn e t\u00eb dh\u00ebnave t\u00eb pap\u00ebrcaktuara nga FS dhe trafiku rrjetor t\u00eb kapur. Duke qen\u00eb se \u00e7do vulnerabilitet n\u00eb k\u00ebt\u00eb proces kompleks dhe t\u00eb pambrojtur potencialisht mund t\u00eb \u00e7oj\u00eb n\u00eb komprometimin e larg\u00ebt t\u00eb t\u00ebr\u00eb sistemit, mbi baz\u00ebn e LoadLibrary u zhvillua nj\u00eb shell speciale avscript<\/a><\/noindex> p\u00ebr analizimin e vulnerabiliteteve n\u00eb skanuesin antivirus Avast n\u00eb nj\u00eb mjedis t\u00eb bazuar n\u00eb Linux.<\/p>\n

<\/a><\/noindex><\/p>\n

Burimi: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0422\u044d\u0432\u0438\u0441 \u041e\u0440\u043c\u0430\u043d\u0434\u0438 (Tavis Ormandy), \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u0437 Google, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u0442 \u043f\u0440\u043e\u0435\u043a\u0442 LoadLibrary, \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u044b\u0439 \u043d\u0430 \u043f\u043e\u0440\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u043e\u0431\u0440\u0430\u043d\u043d\u044b\u0445 \u0434\u043b\u044f Windows DLL-\u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a \u0434\u043b\u044f \u0438\u0445 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u0432 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f\u0445 \u0434\u043b\u044f Linux. \u041f\u0440\u043e\u0435\u043a\u0442\u043e\u043c \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430-\u043f\u0440\u043e\u0441\u043b\u043e\u0439\u043a\u0430, \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043c\u043e\u0436\u043d\u043e \u0437\u0430\u0433\u0440\u0443\u0437\u0438\u0442\u044c DLL-\u0444\u0430\u0439\u043b \u0432 \u0444\u043e\u0440\u043c\u0430\u0442\u0435 PE\/COFF \u0438 \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0451\u043d\u043d\u044b\u0435 \u0432 \u043d\u0451\u043c \u0444\u0443\u043d\u043a\u0446\u0438\u0438. \u0417\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a PE\/COFF \u043e\u0441\u043d\u043e\u0432\u0430\u043d \u043d\u0430 \u043a\u043e\u0434\u0435 ndiswrapper. \u041a\u043e\u0434 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u0435\u0442\u0441\u044f \u043f\u043e\u0434 \u043b\u0438\u0446\u0435\u043d\u0437\u0438\u0435\u0439 GPLv2. […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-74109","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47LoadLibrary, nj\u00eb shtres\u00eb p\u00ebr ngarkimin e Windows DLL n\u00eb aplikacionet Linux | ProHoster","description":"Tavis Ormandy, nj\u00eb studiues sigurie nga Google, po zhvillon nj\u00eb projekt","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/loadlibrary-proslojka-dlya-zagruzki-windows-dll-v-linux-prilozheniya","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47LoadLibrary, \u043f\u0440\u043e\u0441\u043b\u043e\u0439\u043a\u0430 \u0434\u043b\u044f \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 Windows DLL \u0432 Linux-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f | ProHoster","og:description":"\u0422\u044d\u0432\u0438\u0441 \u041e\u0440\u043c\u0430\u043d\u0434\u0438 (Tavis Ormandy), \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u0437 Google, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u0442 \u043f\u0440\u043e\u0435\u043a\u0442","og:url":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/loadlibrary-proslojka-dlya-zagruzki-windows-dll-v-linux-prilozheniya","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-03-14T05:42:14+00:00","article:modified_time":"2020-03-14T05:42:14+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"74109","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 18:21:21","updated":"2022-10-04 23:06:53","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/74109","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=74109"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/74109\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=74109"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=74109"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=74109"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}