http://www.hackerschool.org/HS_Boards/zboard.php?id=HS_Translate&no=76 [º¹»ç]
Áß°£Áß°£¿¡ Çؼ®¾ÈµÇ¼ ºó°÷À¸·Î ³öµÐ°Íµµ ÀÖ½À´Ï´Ù.
Á˼ÛÇÕ´Ï´Ù.
So this is this case where the structure is actually useable some case.
ÀÌ·± °æ¿ì´Â ÀÌ ±¸Á¶°¡ ¾µ ¸¸ÇÏ´Ù´Â °ÍÀ» º¸¿©ÁÝ´Ï´Ù.
So you can go through and find some of the bottom functions and things like that.
µû¶ó¼ ÇÏ´ÜÀÇ ¸î¸î ÇÔ¼öµéÀ» »ìÆ캼 ¼ö ÀÖ½À´Ï´Ù.
In this case ****** and I know this because I cheated a little bit ************** .
ÀÌ·± °æ¿ì¿¡´Â ****** ±×¸®°í Á¦°¡ ¹Ì¸® ºÁµÎ¾ú±â ´ë¹®ÀÔ´Ï´Ù.
this particular one is to create *****.
ÀÌ Æ¯Á¤ÇÑ ***À» »ý¼ºÇϱâ À§ÇØ ******
So if you go to the uh imports section,
µû¶ó¼ ¸¸¾à imports section¿¡ µé¾î°£´Ù¸é,
******* and this is one of the reasons why the pro.... is a...
**** ±×¸®°í ÀÌ°ÍÀº Pro°¡...
whoops, I got to call one.
ÀÌ·±, Á¦°¡ ÀÛµ¿À» ½ÃÄѾßÇϴ±º¿ä.
So here we go. Why is pro really nice if you got *********.
ÀÚ ÀÌÁ¦ °©´Ï´Ù. ¿Ö Pro°¡ *****µÇ¸é ÁÁ¾ÆÁö´ÂÁö...
So, I'm gonna to look at the couple of ****
µû¶ó¼ Àú´Â ¸î¸îÀÇ ***À» »ìÆ캼°ÍÀÔ´Ï´Ù.
It'll generically name them start address. Which is not very useful.
ÀϹÝÀûÀ¸·Î À̸¦ Start Adress¶ó°í ÇÕ´Ï´Ù. ±×·¸°Ô Áß¿äÇÏÁö ¾Ê½À´Ï´Ù.
If I go and look at one of these.
Á¦°¡ start adress¸¦ »ìÆ캸¸é
I'm going to try to be quick about this.
¼µÑ·¯ ¸¶Ä¥ ¼ö ÀÖµµ·Ï ³ë·ÂÇÏ°Ú½À´Ï´Ù.
Okay. I've got a DNS name ****.com as well as ******.com as much other host name.
ÁÁ½À´Ï´Ù. ****.comÀÇ DNS name °Ô´Ù°¡ *****.com ±×¸®°í ¶Ç ´Ù¸¥ host nameÀ» ȹµæÇß½À´Ï´Ù.
This is kind of interesting ***** by the way.
±×·±µ¥ ÀÌ°ÍÀº Èï¹Ì·Î¿î »ç½ÇÀÔ´Ï´Ù.
*********. This name is not exist yet.
host nameÀº ¾ÆÁ÷ Á¸ÀçÇÏÁö ¾Ê½À´Ï´Ù.
It may not ever exist *******.
host nameÀº ¿µ¿øÈ÷ Á¸ÀçÇÏÁö ¾ÊÀ» °ÍÀÔ´Ï´Ù.
They can't call home for update yet.
±×µéÀº ¾ÆÁ÷ home¿¡ ¾÷µ¥ÀÌÆ®¸¦ ¿ä±¸ÇÏÁö ¸øÇÕ´Ï´Ù.
They can't hit the IRC servers yet.
±×µéÀº ¾ÆÁ÷ IRC ¼¹ö¸¦ °ø°ÝÇÏÁö ¸øÇÕ´Ï´Ù.
How are the guy wrote this probably owns this ******** in the future.
And the outside of library checks and uh... stable to IRC command.
It is start to be trend
ÀÌ°ÍÀº ¿äÁò °æÇâÀÔ´Ï´Ù.
where people uh... well.. you know prepare remain host name to be a control point later on
»ç¶÷µéÀÌ °è¼Ó host nameÀ» ÁغñÇÏ¸é¼ control point
but that doesn't exist yet so may think it is bit shut down and may not actually starting up yet.
So I'm just glancing through here.
±×³É ÈȾ°Ú½À´Ï´Ù.
okay. So **** what, what section **** what, what does it people do.
±×·³... ¾î¶² ºÎºÐÀÌ.. »ç¶÷µéÀÌ ¹«¾ùÀ» ÇÏ°í ÀÖ½À´Ï±î??
IRC ****.
IRC *****.
So I'm gonna mark this guy IRC *****.
ÀÌ »ç¶÷ÀÇ IRC ***À» Ç¥±âÇصΰڽÀ´Ï´Ù.
And to take a look at the uh.... so listen entire IRC code ******.
±×¸®°í ÀüüÀûÀÎ IRC Äڵ带 º¸½Ã¸é ****
And we are go to the next one.
´ÙÀ½À¸·Î ³Ñ¾î°¡°Ú½À´Ï´Ù.
Ah... I don't see anything ah...
¾Æ... ¾Æ¹«°Íµµ º¸ÀÌÁö ¾Ê½À´Ï´Ù. À½..
Obviously *** find another, we go the next one.
¸í¹éÈ÷ *** ´Ù¸¥ °ÍÀ» ã°Ú½À´Ï´Ù. ´ÙÀ½À¸·Î ³Ñ¾î°¡°Ú½À´Ï´Ù.
************.
***** this is a calling *** using the words.
This tells me I got some sort of proxy code.
ÀÌ°ÍÀº Á¦°¡ ÇÁ·Ï½Ã ÄÚµå ºñ½ÁÇÑ °ÍÀ» ȹµæÇß´Ù´Â °ÍÀÔ´Ï´Ù.
So it's just called proxy. And look at the next one. Ah... similar things.
ÀÌ°ÍÀ» ±×³É ÇÁ·Ï½Ã¶ó ºÎ¸¨´Ï´Ù. ´ÙÀ½À¸·Î ³Ñ¾î°¡°Ú½À´Ï´Ù. ¾Æ.... ºñ½ÁÇÑ °ÍÀÔ´Ï´Ù.
I can see some of the **** we need to filled in with ***********.
*******À¸·Î °¡µæ Âù ****À» º¼ ¼ö ÀÖ½À´Ï´Ù.
And looking for more ************.
´õ¿í ´õ ¸¹Àº ******À» ã¾Æ º¼¼ö ÀÖ½À´Ï´Ù.
Okay. So start playing file descriptor.
±×·³ ÀÌÁ¦ ÆÄÀÏ µð½ºÅ©¸³Å͸¦ ½ÇÇàÇÏ°Ú½À´Ï´Ù.
This is **** **** code that is managing uh... hundred *** or something rather than *****
ÀÌ°ÍÀº *** ÄÚµå·Î ¼ö¹éÀÇ ***À» °ü¸®ÇÕ´Ï´Ù.
So this tells me may be I caught D-dos code or a multi-*** proxy,
µû¶ó¼ ÀÌ°ÍÀº Á¦°¡ D-dos ÄÚµå ȤÀº ¸ÖƼ-***** ÇÁ·Ï½Ã,
IRC advancer something like that.
IRC advancer °°Àº °ÍÀ» °¡Áö°í ÀÖ´ÂÁö °¡¸£ÃÄ ÁÝ´Ï´Ù.
so I'm gonna call this ***** proxy to may be D-dos.
µû¶ó¼ Àú´Â ÀÌ°ÍÀ» **** ÇÁ·Ï½Ã to D-dos¶ó°í ÇÏ°Ú½À´Ï´Ù.
And uh... ****** is our those who some of the main functions to this particular ***
±×¸®°í ****´Â ÀÌ Æ¯Á¤ÇÑ ***¿¡ °¡Àå Áß¿äÇÑ ÇÔ¼öÀÔ´Ï´Ù.
and this one is actually quite friendlier and it is at the end uh...
±×¸®°í ÀÌ°ÍÀº »ç½Ç °¡Àå Ä£¹ÐÇÏ°í ¸¶Áö¸·¿¡ À½...
a lot smaller when we were done
¿ì¸®°¡ ³¡³¾ ¶§ ¾ÆÁÖ ÀÛ¾ÆÁý´Ï´Ù.
the download is hundred fourteen K library functions will identified.
´Ù¿î·Îµå´Â 140K ¶óÀ̺귯¸® ÇÔ¼ö·Î ½Äº°µË´Ï´Ù.
expected the mention than the other ones.
´Ù¸¥ °Íµé º¸´Ù ¾ð±ÞÀÌ ¿¹»óµË´Ï´Ù
One of the things you will see typically is that all of the library functions the light blue
¿©·¯ºÐµéÀÌ º¸°Ô µÉ °¡Àå ÀüÇüÀûÀÎ Çϴûö ¶óÀ̺귯¸® ÇÔ¼ö´Â
tend to be ***** tend to be 1 new chunk.
ÇϳªÀÇ µ¢¾î¸®°¡ µÇ´Â °æÇâÀÌ ÀÖ½À´Ï´Ù.
So if you step in some code with confusing view and write surrounded by 2 chunks of blue,
µû¶ó¼ ¸¸¾à ºÐ°£Çϱâ Èûµé°í 2°³ÀÇ Çϴûö µ¢¾î¸®·Î ÀÌ·ç¾îÁø Äڵ带 º¸°Ô µÈ´Ù¸é,
light blue but you are looking up certain mark you probably got unidentified library functions.
±×°ÍÀº ´ç½ÅÀÌ ½Äº°µÇÁö ¾ÊÀº ¶óÀ̺귯¸® Äڵ带 º¸°í ÀÖ´Â °ÍÀÔ´Ï´Ù.
something keep in mind.
¹Ýµå½Ã ¾Ë¾ÆµÎ¾î¾ß ÇÒ °ÍÀÔ´Ï´Ù.
okay. um... okay.. I apologize over time.
ÁÁ½À´Ï´Ù. À½.. ½Ã°£ÀÌ Áö³ª¹ö¸° °Í¿¡ ´ëÇØ »ç°úÇÕ´Ï´Ù.
And having really quick and quickly kind of **** have much time
±×¸®°í Á¤¸» »¡¸® ****Çϴµ¥ ½Ã°£À» °®°í
do we need to do this properly but a.... I appreciate your patient.
¿ì¸®°¡ ÀÌ°ÍÀ» Á¤È®È÷ Çؾߵdzª? ¶ó°í Çϴµ¥ À½.... ¿©·¯ºÐµéÀÇ ¿Á¤¿¡ °¨»çµå¸³´Ï´Ù.
Briefly before let you go for lunch uh... have any questions?
Àá½Ã.. Á¡½É ¸ÔÀ¸·¯ °¡±â Àü¿¡... À½.. Áú¹® ÀÖÀ¸½Å°¡¿ä?
you have your choice to ask me your questions. Not?
Àú¿¡°Ô Áú¹®ÇÏ½Ç ±âȸ°¡ ÀÖ½À´Ï´Ù. ¾ø½À´Ï±î?
³¡!!!!!!!!!
ÇØÄ¿½ºÄð ¹ø¿ªÆÀ¿ø´Ôµé ¸ðµÎ ¼ö°íÇϼ̾î¿ä!^^ |
Hit : 1662 Date : 2011/08/01 04:13
|