|
http://www.hackerschool.org/HS_Boards/zboard.php?AllArticle=true&no=83 [복사]
딴건 둘째치고, 말이 너무 빨라요..... ㅠㅠ
늦게올리는 주제에 빈칸도 많지만... 아무튼 1차번역본 올립니다
0:00
we just put the breakpoint in front of it, and just punching it, trust him
이 앞에 브레이크포인트를 겁니다. ***** , *****
you' setting the earlier breakpoint that you said
이전에 말했던 브레이크포인트를 설정하세요. (?)
and you slop her deyoda for proportion
**********
so we just opt intros on the jump
(느낌으로 해석) 우리는 맨 처음(intro)으로 가는 점프문을 찾았어요
and we freeze single step once, we're right inside
한 step을 진행하면, 안으로 들어오죠
00:40
and so pogging underaround
********
everything is a "back to near loop"
모든 것이 back to near loop(?) 합니다.
so go get just a make a memory dump
이제 memory dump를 만드세요.
of bafter ground
*******
we're going to use a Import Reconstructor
우리는 "Import Reconstructor"라는 프로그램을 사용할 거에요
because it's a very nice tool
아주 좋은 툴이기 때문이죠
1:00
process number and a (impor triple striptor)
프로세스 번호와 ****를 입력하면
so we (just a actual) process
******
(여기 왜이렇게 단어가 이상하죠... triport, porphia 뜻을 모르겠어요)
we have to write up (triport) here
******
which is a several 4 for porphia
******
press "IAT autosearch"
IAT autosearch 버튼을 누르세요.
so it's a, searching for IAT import table,
그러면 IAT import 테이블을 검색하게 됩니다.
ane we've(?) get to import
******
so we have **** imported through dlls and function right here
이제 dll과 함수들을 import 했구요.
so i'm going to make a dump, all the process,
프로세스 전체의 덤프를 만들겁니다.
(go right)
1:50
ends endless feesee info takler
******????
jumped up, everything is (ripple shripped into a no reges dots, stuck you care on it)
점프해 왔구요. 모든 것은 ********
2:05
and we get the grows of deriving ******** (meeyour, my roo..)
********** (?)
thank you
감사합니다
(i didn't you donno)
couple quick points there
몇가지 지적해드리고 싶은 점이 있습니다.
if you used import reconstructor before we,
만약 import reconstructor를 사용하셨을 경우
be aware that it doesn't always leave a perfectly working executable immediately
완벽히 작동하는 실행파일을 바로 만들어주지는 않는다는 것입니다.
they have to do *****(에취)******** sinces faces of washes code
~~~~~~ 를 해야 합니다.
help you creating (ferfrep) that may not actually run
실제로 실행되지는 않는 실행파일을 만들어준다는 것이죠. (?)
instead, ah, what i'm gonna ****(introduce?) is, it is now easily analyzed in ida-pro,
대신, **** 이제는, 지금은 ida-pro로 실행파일을 쉽게 분석 할 수 있습니다.
so as you seen before, when i try to load it up, i wouldn't get the very good.. ******** (->don't efeckers is looking into quickter's code)
이전에 보았다시피, 이것을 불러오고자 할 때, 아주 좋은 ********** 를 얻지는 못합니다.
but nichole find out was that, this was looks like it was first tab
그러나 nichole이 알아낸 바로는, 이건 first tab처럼 보이지만
ifewer px and aelviyoda quicter run on a so lu's actually two
????????????????????????, 이것은 실제로 두개란 것이죠. (?)
3:00
may have **** noticed two different places for of you separate points and cocked(talked) out
*******
ahm, it's quite good, the main reason why **** (ka kei) to do this that
그점은 좋아요. *********
you just did that in, a know what 10 minutes,
당신이 그걸 하는 데 10분밖에 안걸렸고
everyone took him few minutes longer than that
다른 분들도 10분보다 조금 더 걸린 정도지요.
and you get that for real for the first time (that's for days) so..
***********
very lucky to have him to demonstrate to you via **** of these
이분(Nichole?)이 ****을 통해 여러분께 분석을 시연하게 되어서 아주 행운이라 생각합니다.
if you noticed **** slides, there's preety lame,
*** 슬라이드를 보시면 알겠지만, ****
discussion on how i used to do a bad thing,
제가 어떻게 나쁜 짓들(?)을 했는지 discussion한 게 있어요.
yeah, and a good place ****, with this actually we getting slides to the conference garge you can download
*******
3:40
i'll come little over talk *** trying go through quickly see you guys ** launch here
unloading FV , now nofect, executable,
and a *** hotload 201 here
yeah i'm go right from my don before
didn't complain about the imports table (at top), that's a good sign
맨 위에 있는 import table에 대해 불평하지 마세요. 그건 좋은 뜻이에요
yeah, you see we actually have "local ****(saico) real WinMain"
이곳에서 진짜 WinMain함수를 볼 수 있죠.
and I prose(?) finding lots and lots of executable code
이제 ***** 아주 많은 실행코드를 찾았어요.
so, again (polly take it over, ok)
(폴리씨, 받으세요, 오케이.)
so, its, i'm gonna see if i can see the structure (삐놀리아)
this is still quite busy but it's far far better ******* in terms of
아직 해야할 게 많지만, 이렇게 하는 건 ******보다 훨씬 좋아요. |
Hit : 2612 Date : 2011/08/03 06:20
|
97, 
1/4 
