97,

1/4

neb91

9번파트 dictation입니다

http://www.hackerschool.org/HS_Boards/zboard.php?AllArticle=true&no=93 [복사]

죄송합니다.. 늦은주제에 번역도 안 되어있고..

그렇다고 100% 완벽하게 된 것도 아니고..

더 늦으면 잠수탔다고 생각하실까봐 그냥 올립니다..ㅜㅜ

번역 ..맡아주실분.... ㅜㅜ 죄송해요 ㅜ

==========================================

um... we can have a look at the first section.

And is the first section characteristics is irregular.

Maybe..umm.. ugh there is a background going to open that's first section,

so we need to have write access to it.

um... we cannot look at the first section rawsize

and...um... is ugh.. the file is FAT.

the physical size of the first section is null,

because the null and the FAT to that section.

we can also have a look at the last section as a..

as a Entry Point.. sorry,

And ugh.. Entry Point starting in the last section.

It's means that ugh.. something has happened to the program,

because usually the program stops at the first section.

It can also be a virus.

ugh.. we can also check the section names

and we can find something like **** section names

or um.. aspect sections.

So sometimes it gives you an idea of the record review.

We can also checks Import Table.

And if there is a very few important functions,

it might be because there is a background import table.

And those **** program import table so it might be packed.

we can also check for strings,

ugh.. usually packers um..

pack up the data section

where we find **** strings,

so if you find those strings as well

maybe it's a file ***.

Unless *** is a looking at the Raw Size and..

it in a file that has been packed

so..the physical size is going to be smaller that the **** size.

So, um...

we can see the Entry Point **** ***

and we can see that it's the last section **** address.

You can also see that's the Raw Size is blue here

so this file must not have been packed.

And with this example,

if you look at the last section the Raw Size section here

you can see the characteristic and um..

the last section is executable.

Raw Size sections are usually not executable

so it might be a hint that's the file has been packed.

So now the basic unpacking method

we have to find the original Entry Point first

and this is the *** of the *** program.

So a few ways to find the original Entry Point is to trace until you jump to the real program.

You can also use a static disassembly

***** jump to the first section or

um.. hint to jump to the first section.

Or you can use ********* smart hardware break points.

And you can also use a API functions break point.

Because umm...ugh.. computer programs like c++ programs

are going to use a start up API functions ***

at the Entry Points

where you can adjust the break point of these functions

and... **** program

adjust so you can ****

if you are at the Entry Point.

Once you have found the Entry Point

we have to *** the process to authorized ********

there should have program.

As then you have to Reconstruct import table

so we have a few ways to do it.

You can trust the packer and find ***

the Import Access Table is being ****

and ugh.. *** information or um..

attach to packers represents originate functions.

or if you are lazy you can use a *** tool

is called Import Reconstructor

to ugh.. reconstruct the Import table automatically.

So we are going to do a demonstration *********

So *** *** the program **** packed it **** Entry Points

I'm going to do it **** and hope that ********* effect.

"He's using my laptop for this step of course."

==================================

중간에 마이크 안 대고 말한 것도 **로 표시했습니다. 아예 들리질 않아서..

발음이..불어에 가까워서 dictation도 정확한지도 모르겠습니다.

다시 한번 죄송합니다..ㅜㅜ

Hit : 2756 Date : 2011/08/26 02:04


멍멍	고생하셨습니다~!	2011/08/26
1234qwert	so..the physical size is going to be smaller that the ****(actual) size. 인거같네요	2011/09/09
1234qwert	and this is the *(start) of the *(packed) program.	2011/09/09
1234qwert	*****(and look to the) jump to the first section or	2011/09/09
1234qwert	we have to *(have) the process to authorized ******(to pack)	2011/09/09
1234qwert	and ugh.. ***(grab) information or um..	2011/09/09
1234qwert	or if you are lazy you can use a ***(nice) tool	2011/09/09
1234qwert	So *(this is the packed) the program *(, the program isn't packed) Entry Points	2011/09/09
1234qwert	And those ****(real) program import table so it might be packed.	2011/09/09
1234qwert	Unless[another] ***(thing) is a looking at the Raw Size and..	2011/09/09
1234qwert	where we find **(data) strings maybe it's a file (packed)*.	2011/09/09
1234qwert	we can see the Entry Point ** *(here)	2011/09/09
1234qwert	and we can see that it's the last section ****(actual) address.	2011/09/09