Re: Full-Disclosure Digest, Vol 89, Issue 15 suspicion of rootkit (Alexandru Balan)

[phocean <0x90 () phocean net>]

Yes, maybe WinDbg… Not that I am confortable with WinDBG, but certainly a good chance to learn and get more familiar.

However:

- Volatility: anything has to sit somehow in the memory, so there is no way for it to escape from the analysis. It has 
all advantages of offline analysis. I don't think Volatility is script kiddy stuff. I think it is a great tool and 
should be enough for my concern.

- WinDBG: here we are doing live analysis, with all the difficulties it implies. It is long and painful. You have to 
read damn a lot of assembly, thousands of calls, decide to step into or step over, when and based on what assumptions, 
etc.
Of course, perfect knowledge of the system internals is required. Difficulty will be raised if ever there are some 
anti-debugging protections. Respect to the people who can do it, they are artists, but is it really the most reasonable 
way to go?

--- phocean


Le 12 juil. 2012 à 18:22, Григорий Братислава a écrit :

> On Thu, Jul 12, 2012 at 12:09 PM, phocean <0x90 () phocean net> wrote:
> > Could you elaborate please?
> > What that I haven't done yet? If we agree there is nothing in the RAM dump,
> > how can we explain the artefacts?
> >
> > Musntlive, I never trust any antivirus.
> >
> > --- phocean
>
> 0x00: MusntLive will always help you. .effmach x86 (or is whatever is
> your machine amd64, ia64) is your first friend. When you is run this,
> you come back and let MusntLive know. For then we must use !dml_proc
> and only is real hacker debug stuff. No script kid stuff. Only for
> when you is know WinDBG like is back of your hand is you Windows
> hacker. Not is Immunity or is Olly, this is these are for is how you
> say rookie. Now you is go dump with is effmach. Then is we can study
> this is yes with HB Gary memory tools. Because is HB Gary, if we know
> is find it, HB Gary is will find with is their backdoor into is their
> tools. We not worry, we find evil 1337 together.

Attachment: signature.asc
Description: Message signed with OpenPGP using GPGMail

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/