资源描述：
《Windows operating system - Antivirus perspective.pdf》由会员上传分享，免费在线阅读，更多相关内容在学术论文-天天文库。
1、T-110.6220:WindowsOSwithanAntivirusPerspectiveAnttiTikkanen,F-SecureCorporationAgenda1.ApplicationsonWindows2.Processesandthreads3.Windowsarchitecture4.Systemmechanisms5.Managementmechanisms6.Memorymanagement7.Securitymechanisms8.Filesystems9.I/OSystemanddr
2、ivers10.WindowsAPIformalwareanalysts11.Casestudy:rootkitsonWindowsOctober11,2007Page2NoteonWindowsversions!•MuchofthispresentationwillincludedetailsspecifictoWindowsXP!•Vistaincludesmanychangesandnewsecurityfeatureslike•Addressspacerandomization(ASLR)•Integ
3、ritylevels•Useraccountcontrol(UAC)•Idon’thavetimetogointothese,sorry!October11,2007Page3ApplicationsonWindowsWindowsExecutables•Commonfilenameextensionshintthetypeofanexecutable•EXE•Anexecutableprogram,anythingfromaDOSexecutableto32-bitPEexecutables•DLL•Dyn
4、amic-linklibrary,exportsfunctionsusinganumericordinal(andoptionally,aname)•.OCXfilesareActiveXcontrols,basicallyjustDLL’s•SYS•Adevicedriverloadedtokernelspace•OBJ•Anobjectfilecreatedbyacompiler,usedasinputtothelinker•AlloftheabovefollowthePE/COFFfileformats
5、pecificationOctober11,2007Page5PE/COFFFileFormat•WindowsexecutablesandobjectfilesfollowthePortableExecutable(PE)specification•BasedonUNIXCOFF(CommonObjectFileFormat)•Fullspecificationavailableonline*)•MoreonthisintheReverseEngineeringlectures*)http://www.mi
6、crosoft.com/whdc/system/platform/firmware/PECOFF.mspxOctober11,2007Page6WindowsAPI•TheWindowsAPI(aka.Win32API)isthesetofcoreusermodeinterfacestotheOS•ExposedbyseveralDLL’s(kernel32,user32,gdi32)•Canbelogicallydividedintosubcategories•Administrationandmanage
7、ment•Taskscheduler,WMI,…•Diagnostics•Eventlogging,debugging,…•Graphicsandmultimedia•Networking•Winsock,…•Security•Systemservices•Processes,threads,registry,filesystems•WindowsUI•SeefulldocumentationonMSDN•http://msdn2.microsoft.com/en-us/library/default.asp
8、xOctober11,2007Page7ProcessesandthreadsProcesses•Processisanabstractionofarunningprogram•Processconsistsoffollowingessentialcomponents:•Aprivatevirtualaddressspace•Anexecutableprogram•Alistofopenhandle
