bugtraq - [WHITEPAPER] Bugger The Debugger

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <KFEMINDBKGBEMHACCJHCMEIOFOAA.brett.moore@security-assessment.com>
Date: Tue, 12 Apr 2005 09:29:56 +1200
From: "Brett Moore" <brett.moore@...urity-assessment.com>
To: "Bugtraq@...urityfocus. Com" <bugtraq@...urityfocus.com>
Subject: [WHITEPAPER] Bugger The Debugger

Bugger The Debugger
 - Pre Interaction Debugger Code Execution

The use of debuggers to analyse malicious or otherwise unknown binaries
has become a requirement for reverse engineering executables to help
determine their purpose.

While researchers in places such as anti-virus laboratories have always
done this, with the availability of free and easy to use debuggers it has
also become popular with corporate security officers and home users.
One of the main purposes of a debugger is to allow the user to control
the execution of a binary in such a way as to determine what instructions
or commands the binary is executing. During malware analysis the user
can modify what the binary is trying to execute, or prevent it all together.

This paper will demonstrate methods that may be used by malware to
execute code, simply by being loaded into a debugging session.

The paper can be downloaded from the whitepapers section of our website.
http://www.security-assessment.com

Brett Moore
Network Intrusion Specialist, CTO
Security-Assessment.com

######################################################################
CONFIDENTIALITY NOTICE: 

This message and any attachment(s) are confidential and proprietary. 
They may also be privileged or otherwise protected from disclosure. If 
you are not the intended recipient, advise the sender and delete this 
message and any attachment from your system. If you are not the 
intended recipient, you are not authorised to use or copy this message 
or attachment or disclose the contents to any other person. Views 
expressed are not necessarily endorsed by Security-Assessment.com 
Limited. Please note that this communication does not designate an 
information system for the purposes of the New Zealand Electronic 
Transactions Act 2003.
######################################################################