|
http://www.hackerschool.org/HS_Boards/zboard.php?id=HS_Translate&no=93 [복사]
죄송합니다.. 늦은주제에 번역도 안 되어있고..
그렇다고 100% 완벽하게 된 것도 아니고..
더 늦으면 잠수탔다고 생각하실까봐 그냥 올립니다..ㅜㅜ
번역 ..맡아주실분.... ㅜㅜ 죄송해요 ㅜ
==========================================
um... we can have a look at the first section.
And is the first section characteristics is irregular.
Maybe..umm.. ugh there is a background going to open that's first section,
so we need to have write access to it.
um... we cannot look at the first section rawsize
and...um... is ugh.. the file is FAT.
the physical size of the first section is null,
because the null and the FAT to that section.
we can also have a look at the last section as a..
as a Entry Point.. sorry,
And ugh.. Entry Point starting in the last section.
It's means that ugh.. something has happened to the program,
because usually the program stops at the first section.
It can also be a virus.
ugh.. we can also check the section names
and we can find something like **** section names
or um.. aspect sections.
So sometimes it gives you an idea of the record review.
We can also checks Import Table.
And if there is a very few important functions,
it might be because there is a background import table.
And those **** program import table so it might be packed.
we can also check for strings,
ugh.. usually packers um..
pack up the data section
where we find **** strings,
so if you find those strings as well
maybe it's a file ***.
Unless *** is a looking at the Raw Size and..
it in a file that has been packed
so..the physical size is going to be smaller that the **** size.
So, um...
we can see the Entry Point **** ***
and we can see that it's the last section **** address.
You can also see that's the Raw Size is blue here
so this file must not have been packed.
And with this example,
if you look at the last section the Raw Size section here
you can see the characteristic and um..
the last section is executable.
Raw Size sections are usually not executable
so it might be a hint that's the file has been packed.
So now the basic unpacking method
we have to find the original Entry Point first
and this is the *** of the *** program.
So a few ways to find the original Entry Point is to trace until you jump to the real program.
You can also use a static disassembly
***** jump to the first section or
um.. hint to jump to the first section.
Or you can use ********* smart hardware break points.
And you can also use a API functions break point.
Because umm...ugh.. computer programs like c++ programs
are going to use a start up API functions ***
at the Entry Points
where you can adjust the break point of these functions
and... **** program
adjust so you can ****
if you are at the Entry Point.
Once you have found the Entry Point
we have to *** the process to authorized ********
there should have program.
As then you have to Reconstruct import table
so we have a few ways to do it.
You can trust the packer and find ***
the Import Access Table is being ****
and ugh.. *** information or um..
attach to packers represents originate functions.
or if you are lazy you can use a *** tool
is called Import Reconstructor
to ugh.. reconstruct the Import table automatically.
So we are going to do a demonstration *********
So *** *** the program **** packed it **** Entry Points
I'm going to do it **** and hope that ********* effect.
"He's using my laptop for this step of course."
==================================
중간에 마이크 안 대고 말한 것도 **로 표시했습니다. 아예 들리질 않아서..
발음이..불어에 가까워서 dictation도 정확한지도 모르겠습니다.
다시 한번 죄송합니다..ㅜㅜ
|
Hit : 2310 Date : 2011/08/26 02:04
|
97, 
4/4 
멍멍
