22 results about "Shellcode" patented technology

Kernel-mode security software detects a trigger event indicative of a specific stage in the lifecycle of a target software entity executing in user mode. In response, the security software identifies a target object residing in memory (e.g., loaded library, chunk of code, etc.) according to a current content of the user-mode call stack, and determines whether the target object is malicious. Various methods described herein detect malicious modifications of a loaded module, such as overload, stomping, and unhooking, among others. Other methods described herein detect dynamically swapped libraries and malicious shellcode, among others.

The invention relates to the technical field of network security, and discloses a non-killing PE program generation method based on Shellcode encryption, which comprises the following steps of: converting an original PE program into a position-independent Shellcode, respectively encrypting the Shellcode and a key loading parameter, and writing the Shellcode and the key loading parameter into a loader configuration file; a loader configuration file and a Shellcode loader main program file used for decrypting and executing a Shellcode are compiled through a compiling tool, and a non-killing PE program is generated, so that the PE program can bypass static feature analysis and a conventional file detection mechanism on the basis of not modifying a source code; meanwhile, the Shellcode loader directly executes the Shellcode in a system call (syscale) mode, and behavior characteristic monitoring caused by a common API call path is avoided. According to the method, the PE program effectively avoids a traditional antivirus engine and a terminal detection system, the concealment and reliability of the antivirus-free PE program sample are remarkably improved, and then the generalization of an existing malicious program detection system is improved.

A computer-implemented method 300 and system comprises (a) detecting discovery, by code running in an application buffer, of malicious code in application memory 301; and responsive thereto: (b) preve

The invention relates to the field of information security, in particular to an automatic killing-free remote control program generation method, tool and equipment, and aims to improve the attack and defense drilling efficiency. The automatic killing-free remote control program generation method provided by the invention comprises the following steps: acquiring an initial Shellcode; calling an encryption function to encrypt the initial Shellcode so as to obtain an encrypted Shellcode; embedding the source code of the decryption function into the loader template so as to generate a loader source file; and compiling the loader source file by adopting a compiling tool, and embedding the encrypted Shellcode so as to obtain an executable remote control program. According to the method and the device, decoupling between the loader template and the encryption and decryption algorithm is realized, so that a user can independently optimize the encryption and decryption algorithm without concerning other codes of the loader, the encryption and decryption algorithm can be automatically upgraded or replaced under the condition of not influencing other system functions, and the efficiency of attack and defense drilling work is improved.

One or more embodiments of the invention provide a malicious program detection method and apparatus. The method comprises the steps of obtaining a to-be-detected Webshell code of a network shell; identifying a target method which is indirectly called or implicitly called from the Webshell code, and determining the type of a target object calling the target method; in response to determining that the security detection platform needs to execute sensitive operation in the process of calling the target method in the target object type, triggering a malicious alarm for the target object type; wherein the malicious alarm is used for representing that the Webshell code is a malicious code. According to the method, the target methods of indirect calling and implicit calling in the Webshell code are recognized, and the sensitive operation of each target object type when the target methods are called is detected, so that the malicious code can be accurately recognized.

A method for detecting exploits involving shellcode is disclosed. Memory blocks are monitored during dynamic analysis of a sample to identify memory blocks containing suspect shellcode. The memory blocks are dumped into memory to identify candidate shellcode entry points associated with the suspect shellcode. Based on the candidate shellcode entry points, the suspect shellcode is executed to determine whether the suspect shellcode is malicious. A verdict is generated for the sample based on a result of executing the suspect shellcode.

The invention discloses a host and guest message tunnel communication method and system based on virtualized black box escape. The method comprises the following steps: firstly, detecting a key function address or symbol information of a host machine by using a QEMU vulnerability; secondly, capturing a command input by a user, and monitoring command execution result data returned by the host machine at the same time; and according to vulnerability detection and monitoring results, dynamically analyzing and generating a shellcode character string capable of triggering command execution of a host machine, and outputting the shellcode character string to a terminal. And finally, covering and writing the shellcode into a corresponding file reserved area, compiling, and when the virtual machine end runs, triggering host machine command execution through a QEMU vulnerability attack surface, and returning an execution result to the virtual machine end in real time by utilizing a message tunnel constructed by the vulnerability. The method is suitable for a typical cloud computing security scene in which a host machine is strictly isolated from a network and a user cannot directly interact with the host machine, and the visibility and troubleshooting efficiency of security problems in a virtual environment are improved.

Detection of an exploit including shellcode is disclosed. Memory blocks are monitored during dynamic analysis of a sample to identify a memory block including suspicious shellcode. The memory block is dumped in memory to identify a candidate shellcode entry point associated with the suspicious shellcode. The suspicious shellcode is executed based on the candidate shellcode entry point to determine whether the suspicious shellcode is malicious. A verdict is generated regarding the sample based on results of executing the suspicious shellcode.

Methods, storage systems and computer program products implement embodiments of the present invention for protecting a computing device, which includes a processor and a memory and is coupled to a storage device storing a set of one or more files. In embodiments of the present invention, a call to a specified function for execution by the processor is detected, and a stack trace for the call to the specified function is generated in the memory. Upon detecting, in the stack trace, a stack frame including a return address referencing a shellcode region in the memory, wherein the shellcode region includes executable code that was not loaded from any given file on the storage device, then the referenced executable code is compared to a list of malicious shellcode. Finally, a preventive action is initiated upon detecting a match between the referenced executable code and one of malicious shellcodes in the list.

The present application relates to the field of computer security, and provides an application processing method and apparatus, and an attack defense system. A computer device monitors whether an application running on the computer device loads a network dynamic link library. If it is detected that the application loads the network dynamic link library, and a memory block where the running code used for loading the network dynamic link library in the application is located meets a shellcode running condition, the execution of the application is terminated before the application successfully calls a network connection function in the network dynamic link library. In this way, an application running shellcode can be prevented from being connected to a remote server, thereby preventing the computer device from being controlled by an attacker by means of the remote server or preventing internal data of the computer device from being stolen by the attacker by means of the remote server.

The present invention provides a method for determining whether shellcode is maliciously executed, the method comprising: detecting a behavior event on a preset path; when the behavior event is detected, performing a stack backtrace on the current thread to obtain a function call instruction sequence of the application layer; identifying the shellcode according to the function call instruction sequence; and determining whether the shellcode is maliciously executed according to a memory chain, wherein the memory chain is constructed according to the legality of the memory operation behavior. The present invention does not rely on feature codes to identify shellcodes, but rather identifies shellcodes based on stack backtrace, and can effectively and qualitatively identify shellcodes, so it can be applied to determine various frequently changing shellcodes, and will not mistake similar codes for shellcodes. And further determining whether the shellcode is maliciously executed through the memory chain can protect against Shellcode attacks of unknown vulnerabilities. It can be seen that the present invention provides a new means for vulnerability protection and improves the ability of device security protection.

Kernel-mode security software detects a trigger event indicative of a specific stage in the lifecycle of a target software entity executing in user mode. In response, the security software identifies a target object residing in memory (e.g., loaded library, chunk of code, etc.) according to a current content of the user-mode call stack, and determines whether the target object is malicious. Various methods described herein detect malicious modifications of a loaded module, such as overload, stomping, and unhooking, among others. Other methods described herein detect dynamically swapped libraries and malicious shellcode, among others.

The present application belongs to the network security technical field, especially a kind of Windowsx86 under the positioning and extraction method of shellcode in stack space, comprising: hooking system API function, after hitting, the function of being hooked is carried out stack backtracking, every backtracking one level stack frame, it is checked to the position that the return address of this level points to, see whether the position belongs to stack space, when checking that the return address of certain level points to stack space inside, address value is noted down, and the EBP value of the nearest level in address decreasing direction is noted down, then backtracking one level obtains the EBP value of current stack frame;In order to further confirm the boundary of extraction;According to the boundary range determined, binary data is extracted, and binary data is identified as x86 assembly, and the real code will be contained therein.The present application can realize the positioning and extraction of shellcode in an intuitive and fast way, and improve the accuracy of extraction.

The invention discloses a security defense method and device and electronic equipment, and the method comprises the steps: disassembling a shellcode file to obtain an assembly code file, grouping each assembly instruction to obtain a grouping set when the assembly code file meets a preset condition, adding a jump instruction for the tail of each group of instruction, converting the jump instruction into a corresponding Double value, and sending the Double value to a server; the method comprises the following steps of: establishing a Double array by utilizing a Double value to obtain a target html test file, changing a code execution initial address of an optimization function into an initial address of a Double array element, and calling the optimization function to execute shellcode, so that a security defense system detects whether a malicious code exists in a sample file or not according to whether the Double array element in the sample file is executed or not. According to the method, whether malicious codes exist in the sample file or not can be detected according to whether the Double array elements in the sample file are executed or not, so that a security defense strategy is formulated.

Kernel-mode security software detects a trigger event indicative of a specific stage in the lifecycle of a target software entity executing in user mode. In response, the security software identifies a target object residing in memory (e.g., loaded library, chunk of code, etc.) according to a current content of the user-mode call stack, and determines whether the target object is malicious. Various methods described herein detect malicious modifications of a loaded module, such as overload, stomping, and unhooking, among others. Other methods described herein detect dynamically swapped libraries and malicious shellcode, among others.

The invention provides an application program processing method and device and an attack defense system, and belongs to the field of computer security. The computer equipment monitors whether the application program running on the computer equipment loads the network dynamic link library or not; if it is monitored that the application program loads the network dynamic link library and a memory block, where an operation code used for loading the network dynamic link library is located, in the application program meets a shellcode operation condition, execution of the application program is stopped before the application program successfully calls a network connection function in the network dynamic link library. In this way, the application program in which the shellcode runs can be prevented from being connected to the remote server, so that the computer equipment can be prevented from being controlled by an attacker through the remote server, or the internal data of the computer equipment can be prevented from being stolen by the attacker through the remote server.

Kernel-mode security software detects a trigger event indicative of a specific stage in the lifecycle of a target software entity executing in user mode. In response, the security software identifies a target object residing in memory (e.g., loaded library, chunk of code, etc.) according to a current content of the user-mode call stack, and determines whether the target object is malicious. Various methods described herein detect malicious modifications of a loaded module, such as overload, stomping, and unhooking, among others. Other methods described herein detect dynamically swapped libraries and malicious shellcode, among others.

The application relates to the field of software security, and provides a function calling method, device and equipment under Java and a storage medium. The method comprises the following steps: acquiring parameters of multiple target functions of an So file and function names of the multiple target functions; encoding the multiple target function parameters through protobuf to obtain multiple encoded parameters; acquiring a version number of the So file and a time stamp corresponding to the version number of the So file; calculating multiple target function numbers through a message digest algorithm Md5 based on the function names of the multiple target functions, the version number of the So file and the time stamp corresponding to the version number of the So file; taking each encoded parameter and each target function number as a new parameter of each target function to obtain multiple functions with completed settings; associating each function with completed settings and each target function to obtain a mapping relationship; acquiring a function called by a user to obtain an input function; and searching and calling the input function through a Shellcode and the mapping relationship. The safety of function calling is improved.

Kernel-mode security software detects a trigger event indicative of a specific stage in the lifecycle of a target software entity executing in user mode. In response, the security software identifies a target object residing in memory (e.g., loaded library, chunk of code, etc.) according to a current content of the user-mode call stack, and determines whether the target object is malicious. Various methods described herein detect malicious modifications of a loaded module, such as overload, stomping, and unhooking, among others. Other methods described herein detect dynamically swapped libraries and malicious shellcode, among others.

The invention discloses a precise penetration test method and system for a very simple kernel VxWorks system, and the method comprises the steps: transmitting a lightweight detection packet based on a UDP protocol to a target VxWorks system, and obtaining the initial fingerprint information of the target system through analyzing the response of the target VxWorks system to the lightweight detection packet; aiming at the initial fingerprint information, sending a targeted detection request to the target VxWorks system, and accurately identifying the version number and / or patch level of the target VxWorks system by analyzing the response of the target VxWorks system; sending a special request to the target VxWorks system by using the identified vulnerability, triggering the vulnerability and implanting a'shellcode 'to obtain a remote code execution permission of the target VxWorks system; and establishing a remote control channel with low resource consumption by utilizing a file transmission function of the target VxWorks system on the basis of the remote code execution permission, so as to realize stable control on the target VxWorks system. According to the invention, efficient and accurate identification of the target system and utilization of security vulnerabilities can be realized.

A method, storage system, and computer program product for protecting a computing device, including a processor and memory, and connected to a storage device that stores a set of one or more files. A call to a function designated for execution by the processor is detected, and a stack trace for the call to the designated function is generated in memory. When the stack trace detects a stack frame containing a return address that references a shellcode region in memory, where the shellcode region contains executable code that was not loaded from any given file on the storage device, the referenced executable code is then compared against a list of malicious shellcodes. Finally, when a match is found between the referenced executable code and one of the malicious shellcodes in the list, preventive action is initiated.

Kernel-mode security software detects a trigger event indicative of a specific stage in the lifecycle of a target software entity executing in user mode. In response, the security software identifies a target object residing in memory (e.g., loaded library, chunk of code, etc.) according to a current content of the user-mode call stack, and determines whether the target object is malicious. Various methods described herein detect malicious modifications of a loaded module, such as overload, stomping, and unhooking, among others. Other methods described herein detect dynamically swapped libraries and malicious shellcode, among others.