{"id":74109,"date":"2020-03-14T08:42:14","date_gmt":"2020-03-14T05:42:14","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/loadlibrary-proslojka-dlya-zagruzki-windows-dll-v-linux-prilozheniya"},"modified":"2020-03-14T08:42:14","modified_gmt":"2020-03-14T05:42:14","slug":"loadlibrary-proslojka-dlya-zagruzki-windows-dll-v-linux-prilozheniya","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sv\/blog\/news\/loadlibrary-proslojka-dlya-zagruzki-windows-dll-v-linux-prilozheniya","title":{"rendered":"LoadLibrary, ett lager f\u00f6r att ladda Windows DLL:er i Linux-applikationer","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Tavis Ormandy (Tavis Ormandy<\/a><\/noindex>), s\u00e4kerhetsexpert fr\u00e5n Google, utvecklar ett projekt LoadLibrary<\/a><\/noindex>, inriktat p\u00e5 att portera DLL-bibliotek som samlats in f\u00f6r Windows f\u00f6r anv\u00e4ndning i Linux-applikationer. Projektet tillhandah\u00e5ller ett mellanlagerbibliotek, som g\u00f6r det m\u00f6jligt att ladda en DLL-fil i PE\/COFF-format och anropa specifika funktioner i den. PE\/COFF-laddaren bygger p\u00e5 koden ndiswrapper<\/a><\/noindex>. Projektets kod sprids<\/a><\/noindex> \u00e4r under GPLv2-licensen.<\/p>\n

LoadLibrary ansvarar f\u00f6r att ladda biblioteket i minnet och importera befintliga symboler, vilket ger Linux-applikationen ett API i stil med dlopen. Den l\u00e4nkade koden kan debugga med hj\u00e4lp av gdb, ASAN och Valgrind. M\u00f6jlighet att justera k\u00f6rande kod under k\u00f6rning genom att koppla in hooks och applicera patchar (runtime patching) finns. St\u00f6d f\u00f6r utv\u00e4rdering och backtrace (unwinding) av undantag f\u00f6r C++ ing\u00e5r.<\/p>\n

Projektets m\u00e5l \u00e4r att organisera skalbart och effektivt distribuerat fuzzing-testande av DLL-bibliotek i en Linux-baserad milj\u00f6. I Windows till\u00e5ter fuzzing- och coverage-testing inte att man uppn\u00e5r \u00f6nskad effektivitet och kr\u00e4ver ofta att man k\u00f6r en separat virtualiserad instans av Windows, s\u00e4rskilt vid analys av komplexa produkter som antivirusprogramvara, som involverar arbete p\u00e5 k\u00e4rnniv\u00e5 och anv\u00e4ndarutrymmets niv\u00e5. Genom LoadLibrary letar forskare fr\u00e5n Google efter s\u00e5rbarheter i videokodekar, antivirus-scanners, datadekomprimeringsbibliotek, bilddecoderare m.m. <\/p>\n

Till exempel har LoadLibrary anv\u00e4nts f\u00f6r att portera Windows Defender-antivirusmotorn f\u00f6r k\u00f6rning i Linux. Unders\u00f6kning av mpengine.dll, som utg\u00f6r k\u00e4rnan i Windows Defender, har gjort det m\u00f6jligt att analysera ett stort antal komplexa hanterare av olika format, filsystemsemmulatorer och spr\u00e5kinterpreterare som potentiellt erbjuder vektorer f\u00f6r m\u00f6jliga<\/a><\/noindex> attacker<\/a><\/noindex>.<\/p>\n

LoadLibrary har ocks\u00e5 anv\u00e4nts f\u00f6r att identifiera en borttagen s\u00e5rbarhet<\/a><\/noindex> i antiviruspaketet Avast. Under studiet av DLL fr\u00e5n denna antivirusl\u00f6sning har det uppt\u00e4ckts att den centrala privilegierade skanningsprocessen inkluderar en fullst\u00e4ndig JavaScript-tolkar som anv\u00e4nds f\u00f6r att emulera k\u00f6rningen av tredjeparts JavaScript-kod. Denna process \u00e4r inte isolerad i en sandbox-milj\u00f6, \u00e5terst\u00e4ller inga privilegier och utf\u00f6r analyser av os\u00e4krade externa data fr\u00e5n filsystemet och avlyssnad n\u00e4tverkstrafik. Eftersom vilken s\u00e5rbarhet som helst i denna komplicerade och oskyddade process potentiellt kan leda till fj\u00e4rrkompromiss av hela systemet, har en speciell skal utvecklats baserat p\u00e5 LoadLibrary. avscript<\/a><\/noindex> f\u00f6r att analysera s\u00e5rbarheter i antivirusprogrammet Avast i en milj\u00f6 baserad p\u00e5 Linux.<\/p>\n

<\/a><\/noindex><\/p>\n

K\u00e4lla: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0422\u044d\u0432\u0438\u0441 \u041e\u0440\u043c\u0430\u043d\u0434\u0438 (Tavis Ormandy), \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u0437 Google, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u0442 \u043f\u0440\u043e\u0435\u043a\u0442 LoadLibrary, \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u044b\u0439 \u043d\u0430 \u043f\u043e\u0440\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u043e\u0431\u0440\u0430\u043d\u043d\u044b\u0445 \u0434\u043b\u044f Windows DLL-\u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a \u0434\u043b\u044f \u0438\u0445 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u0432 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f\u0445 \u0434\u043b\u044f Linux. \u041f\u0440\u043e\u0435\u043a\u0442\u043e\u043c \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430-\u043f\u0440\u043e\u0441\u043b\u043e\u0439\u043a\u0430, \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043c\u043e\u0436\u043d\u043e \u0437\u0430\u0433\u0440\u0443\u0437\u0438\u0442\u044c DLL-\u0444\u0430\u0439\u043b \u0432 \u0444\u043e\u0440\u043c\u0430\u0442\u0435 PE\/COFF \u0438 \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0451\u043d\u043d\u044b\u0435 \u0432 \u043d\u0451\u043c \u0444\u0443\u043d\u043a\u0446\u0438\u0438. \u0417\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a PE\/COFF \u043e\u0441\u043d\u043e\u0432\u0430\u043d \u043d\u0430 \u043a\u043e\u0434\u0435 ndiswrapper. \u041a\u043e\u0434 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u0435\u0442\u0441\u044f \u043f\u043e\u0434 \u043b\u0438\u0446\u0435\u043d\u0437\u0438\u0435\u0439 GPLv2. […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-74109","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47LoadLibrary, ett lager f\u00f6r att ladda Windows DLL i Linux-applikationer | ProHoster","description":"Tavis Ormandy, s\u00e4kerhetsforskare p\u00e5 Google, driver projektet","canonical_url":"https:\/\/prohoster.info\/sv\/blog\/news\/loadlibrary-proslojka-dlya-zagruzki-windows-dll-v-linux-prilozheniya","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sv_SE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47LoadLibrary, \u043f\u0440\u043e\u0441\u043b\u043e\u0439\u043a\u0430 \u0434\u043b\u044f \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 Windows DLL \u0432 Linux-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f | ProHoster","og:description":"\u0422\u044d\u0432\u0438\u0441 \u041e\u0440\u043c\u0430\u043d\u0434\u0438 (Tavis Ormandy), \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u0437 Google, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u0442 \u043f\u0440\u043e\u0435\u043a\u0442","og:url":"https:\/\/prohoster.info\/sv\/blog\/news\/loadlibrary-proslojka-dlya-zagruzki-windows-dll-v-linux-prilozheniya","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-03-14T05:42:14+00:00","article:modified_time":"2020-03-14T05:42:14+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"74109","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 18:21:21","updated":"2022-10-04 23:06:53","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/74109","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/comments?post=74109"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/74109\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media?parent=74109"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/categories?post=74109"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/tags?post=74109"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}