Главная
Study mode:
on
1
Introduction
2
About the speaker
3
Slides
4
What are Fix It Patches
5
Secrets of the Application Compatibility Database
6
Mark Badgett
7
Tools
8
Application Compatibility Toolkit
9
svtoxml
10
cdd
11
spinst
12
registry locations
13
my tool for installing
14
real world cases
15
XML Core Services bug
16
Fix It
17
Reverse Engineering
18
High Level View
19
Pseudo Code
20
Documentation
21
Git Tag Structure
22
Uninitialized Data
23
Displaying Patches
24
IDA
25
Required Information
26
Config Files
27
Sample Target
28
Sample Configuration
29
Run Sample Target
30
Create Process Internal
31
Debug View
32
Config File
33
Load Explorer into IDE
34
Shell Code
35
Disable shim engine
36
Search for sap files
37
References
38
Questions
Description:
Explore the intricacies of Microsoft's Fix It patches in this Black Hat Asia 2014 conference talk. Delve into the analysis of in-memory patches and their role in preventing exploitation. Learn how to extract valuable information from these patches to gain insights into vulnerabilities Microsoft aims to address. Discover techniques for reverse engineering patches and leveraging this knowledge to maintain system persistence. Examine real-world cases, such as the XML Core Services bug, and understand the structure of Application Compatibility Databases. Gain hands-on experience with tools like the Application Compatibility Toolkit and custom utilities for patch installation. Follow along as the speaker demonstrates the process of creating and configuring sample targets, debugging, and manipulating the shim engine. Enhance your understanding of Microsoft's security measures and potential vulnerabilities in this comprehensive exploration of Fix It patches.

Persist It - Using and Abusing Microsoft's Fix It Patches

Black Hat
Add to list