LoadLibrary, lera la ho kenya Windows DLL lits'ebetsong tsa Linux

Tavis OrmandyTavis ormandy), mofuputsi oa ts'ireletso ho Google ea ntseng a ntlafatsa morero Laeborari, e reretsoeng ho tsamaisa li-DLL tse hlophisitsoeng bakeng sa Windows hore li sebelisoe lits'ebetsong tsa Linux. Morero o fana ka laebrari ea lera eo ka eona o ka kenyang faele ea DLL ka sebopeho sa PE / COFF mme o bitsa mesebetsi e hlalositsoeng ho eona. PE/COFF bootloader e ipapisitse le khoutu keswrapper. Khoutu ea morero ajoa ke e nang le laesense tlasa GPLv2.

LoadLibrary e hlokomela ho kenya laeborari mohopolong le ho kenya matšoao a seng a ntse a le teng, e fana ka ts'ebeliso ea Linux ka API ea setaele se thellang. Khoutu ea plug-in e ka lokisoa ka gdb, ASAN le Valgrind. Hoa khoneha ho lokisa khoutu e ka phethisoang nakong ea ts'ebetso ka ho hokahanya li-hook le ho sebelisa li-patches (runtime patching). E ts'ehetsa ho ts'oaroa le ho phutholoha bakeng sa C++.

Sepheo sa morero ke ho hlophisa liteko tse ka sebelisoang ka mokhoa o hlakileng le tse sebetsang hantle tsa lilaebrari tsa DLL tikolohong e thehiloeng ho Linux. Ho Windows, tlhahlobo ea phokotso le tšireletso ha e sebetse hantle 'me hangata e hloka ho sebelisa mohlala o ikhethileng oa Windows, haholo ha o leka ho sekaseka lihlahisoa tse rarahaneng joalo ka software ea antivirus e atileng ka har'a kernel le sebaka sa basebelisi. U sebelisa LoadLibrary, bafuputsi ba Google ba ntse ba batlana le bofokoli ho li-codec tsa video, li-scanner tsa vaerase, lilaebrari tsa decompression ea data, li-decoder tsa litšoantšo, jj.

Mohlala, ka thuso ea LoadLibrary re khonne ho kenya enjine ea antivirus ea Windows Defender ho sebetsa Linux. Boithuto ba mpengine.dll, e leng motheo oa Windows Defender, bo entse hore ho khonehe ho sekaseka palo e kholo ea li-processor tse tsoetseng pele bakeng sa lifomate tse fapaneng, li-emulators tsa sistimi ea lifaele le bafetoleli ba puo ba ka fanang ka li-vectors bakeng sa. ho khoneha litlhaselo.

LoadLibrary e ne e boetse e sebelisetsoa ho khetholla bofokodi bo hole ka har'a sephutheloana sa antivirus sa Avast. Ha u ithuta DLL ho tsoa ho anthivaerase ena, ho ile ha senoloa hore ts'ebetso ea bohlokoa ea ho lekola e kenyelletsa mofetoleli o felletseng oa JavaScript o sebelisetsoang ho etsisa ts'ebetso ea khoutu ea JavaScript ea mokha oa boraro. Ts'ebetso ena ha e khethollehe tikolohong ea sandbox, ha e hlophise litokelo hape, 'me e sekaseka data e sa netefatsoang ea sistimi ea faele le sephethephethe sa marang-rang se kentsoeng. Kaha ts'oaetso leha e le efe ts'ebetsong ena e rarahaneng le e sa sireletsoeng e ka lebisa ho senyeha ho hole ha tsamaiso eohle, ho ile ha etsoa khetla e khethehileng e thehiloeng ho LoadLibrary. avscript ho sekaseka bofokoli ho sekena sa antivirus sa Avast tikolohong e thehiloeng ho Linux.

Source: opennet.ru