Full Disclosure mailing list archives
Re: cloning PC / run in VMware
From: Nicolas RUFF <nicolas.ruff () gmail com>
Date: Tue, 25 Jul 2006 13:11:02 +0200
Don't tell me a simple greyed out checkbox can stop you ...^---> foudstone's showwin.exe usually does the trick
Actually, it's a bit harder. At export time, the Crypto provider will check the "non exportable" flag, even if you have "ungreyed" the checkbox.
From here you have 2 choices :
- Searching for the private key blob in the process memory. - Patching the Crypto provider to kill the check (harder, because of WFP and some internal checksums inside Crypto providers - e.g. RSAENH.DLL). I have not heard of any readily usable code on the Internet, but looking at the slides it should not be too hard to reproduce. Regards, - Nicolas RUFF _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- cloning PC / run in VMware indianz (Jul 22)
- Re: cloning PC / run in VMware Denis Jedig (Jul 24)
- Re: cloning PC / run in VMware indianz (Jul 24)
- Re: cloning PC / run in VMware Nicolas RUFF (Jul 25)
- Re: cloning PC / run in VMware endrazine (Jul 25)
- Re: cloning PC / run in VMware Nicolas RUFF (Jul 25)
- Message not available
- Re: cloning PC / run in VMware endrazine (Jul 25)
- Re: cloning PC / run in VMware indianz (Jul 24)
- Re: cloning PC / run in VMware Denis Jedig (Jul 24)