网络攻击课件-恶意葱满码概论.ppt

Introduction of Malicious Programs;;Growth and Change in Malware Development;Growth in Malware;Evaluation only. Created with Aspose.Slides for .NET 3.5 Client Profile 5.2.0.0. Copyright 2004-2011 Aspose Pty Ltd.;What is Malicious Code?;Malicious Programs;Malicious Program’s Evolution;Trapdoors;Trapdoor;Trapdoors (Back doors);Examples of Backdoor;Backdoor Types;Backdoor Installation;Starting backdoors automatically;Starting backdoors automatically on Windows;Example;Sub 7;;Logic Bomb;Logic Bomb;Logic Bomb;Viruses;Viruses;;Virus Infection Mechanism ; Virus; Virus: Boot Sector Infectors; Virus: Boot Sector Infectors; Virus: Boot Sector Infectors; Virus: Boot Sector Infectors; Virus: File Infectors; Virus: File Infectors; Virus: File Infectors; Virus: File Infectors; Virus: Concealment ; Virus: Concealment ; Virus: Concealment ;Anti-Virus Technologies;Virus Detection by Emulation;Trojan horses;Trojan Horse;Trojan Horse;Rootkit;Motivation;Definition;*;History of Rootkits;Popular Rootkits;New Rootkits;Commercial Stealth;*;Rootkits;Operating System Design;User-Land vs. Kernel-Land;Windows Architecture;How does Rootkit work?;System Service Call Cycle;NTDLL Interface;Getting Into The Root;NTOSKRNL Exports;KeServiceDescriptor Table;Hooking System Service;What Happens When You Read a File?;Userland (Ring 3) Rootkits;Kernel (Ring 0) Rootkits;Kernel (Ring 0) Rootkits;Kernel (Ring 0) Rootkits;Classfical ways for hiding various objects;IAT hooking;IAT Modification;IAT Modification;IAT hooking;Inline function hooking;Inline function hooking;Dynamic Code Patching;Injecting a DLL;Injecting a DLL;SSDT hooking;Using SSDT hooks;SDT;SDT SDTShadow;ActiveProcessLinks;Fu rootkit;IDT hooking;Hooking I/O;Rootkit Technology Summary;Linux Rootkits;Different types;*;*;Example: LKM Rootkit Functionality;Example: RKP Rootkit Functionality;Detecting Rootkits;How to Detect;UNIX tools;UNIX tools (cont’d);Windows Tools;Evaluation only. Created with Aspose.Slides for .NET 3.5 Client Profil