|
Hmmmm,
Extremely easy... the call to the VirtualAlloc function[^] is using external input from
InternalImageData->memoryType; You could easily allocate executable memory (Memory Protection Constants)[^]. The sample application then calls DebugPrintDimensions() which will return
m_imageData->GetWidth() and
m_imageData->GetHeight() which would be the local shell code entry point.
Best Wishes,
-David Delaune
|
|
|
|
|
Web attack uses malware encoded as images and delivered through iframe injection in a way that escapes easy detection While I think this (and the malware's author) are vile, you have to applaud his creativity
|
|
|
|
|
Hi,
This is not new. The PNG image format specifies sections that can be used for embedded file (text) descriptions.
http://www.libpng.org/pub/png/spec/1.2/png-1.2-pdg.html#C.Anc-text[^]
Plenty of room in there for shell code. Your other Insider News post titled 'Challenge – Vulnerable Code' would have been a little more interesting if the author would have used an existing image format such as PNG for storing his shell code.
Security products should consider scanning these sections in PNG images.
Best Wishes,
-David Delaune
|
|
|
|
|
I recently had the chance to talk with Eric Lippert, who works as an architect on the C# analysis team at Coverity, a company that analyzes C# source code and looks for known defects. Prior to joining Coverity, Lippert's known for his work with the Microsoft language team, where he worked on design and implementation of the C# language for 16 years. I still think they should have gone with "Deep C"
|
|
|
|
|
It's a little brief, but interesting. Did I miss the practical tips that the sub-header promised?
I like the equality semantics in C#. I've found it to be flexible. I don't see a problem here. Rudimentary testing will pick up problems.
I think this is more of a veiled ad for the analysis tools mentioned in the article.
|
|
|
|
|
I agree with tgrt. It doesn't really seem like there's anything new here. All the information on C# Lippert provides is common knowlege and it always comes back to Coverity's own testing products.
|
|
|
|
|
Ballmer ascended the throne of Microsoft in January of 2000. When he took over as CEO for Bill Gates, Microsoft was bringing in US$21 billion in revenue and the company’s stock had just hit an all-time high of $51.87 a share in September 1999. The Windows desktop OS was atop the personal computing market, and Internet Explorer was the leading Web browser by a mile. What Ballmer did right....and what he did oh so wrong...
|
|
|
|
|
What's the one word you'd use to define the Ballmer era at Microsoft? For me it's a tie between Vista and Zune.
|
|
|
|
|
chanting... chanting... chanting...
If your actions inspire others to dream more, learn more, do more and become more, you are a leader.-John Q. Adams You must accept one of two basic premises: Either we are alone in the universe, or we are not alone in the universe. And either way, the implications are staggering.-Wernher von Braun Only two things are infinite, the universe and human stupidity, and I'm not sure about the former.-Albert Einstein
|
|
|
|
|
|
|
|
So says[^] Leslie...
If your actions inspire others to dream more, learn more, do more and become more, you are a leader.-John Q. Adams You must accept one of two basic premises: Either we are alone in the universe, or we are not alone in the universe. And either way, the implications are staggering.-Wernher von Braun Only two things are infinite, the universe and human stupidity, and I'm not sure about the former.-Albert Einstein
|
|
|
|
|
Damn I knew I read that somewhere!!
Should I delete my post?!
|
|
|
|
|
It will be way more fun if you leave it.
Peter Wasser
Art is making something out of nothing and selling it.
Frank Zappa
|
|
|
|
|
|
Julia looks really ineresting. It was first brought to my attention in the Lounge about a month ago when I was (and still am, actually) looking into semantic types.
Marc
|
|
|
|
|
What it didn't explain and would interest excite me more at this stage is if I can integrate Julia programming with C++
Then I can merge it with my exiting program!
(integrate with C# will be even better but is less likely I suppose! ^_^)
|
|
|
|
|
|
Even as Bill Gates weighs giving up his title of chairman of Microsoft Corp. (MSFT), he’s poised to remain involved at the company he co-founded in an area of its deepest need: crafting must-have products. "Hic iacet Arthurus, rex quondam, rexque futurus"
|
|
|
|
|
Sounds like a good idea. Gates seems to have pretty good focus, and had the power to force Microsoft to go in a positive stategic direction, which he has done successfully in the past.
|
|
|
|
|
Good! It's about time someone fixes the shitstorm that is the whole Windows 8/8.1/Metro/RT/Bad usability mess up.
.-.
|o,o|
,| _\=/_ .-""-.
||/_/_\_\ /[] _ _\
|_/|(_)|\\ _|_o_LII|_
\._. |\_/|"` |_| ==== |_|
|_|_| ||" || ||
|-|-| ||LI o ||
|_|_| ||'----'||
/_/ \_\ /__| |__\
|
|
|
|
|
It could work just as a soufflé could rise twice.
Peter Wasser
Art is making something out of nothing and selling it.
Frank Zappa
|
|
|
|
|
That. was. beautiful.
TTFN - Kent
|
|
|
|
|
His new official title now that he's stepped down as chairman is "Founder and Technology Adviser."
|
|
|
|