makin

I create makin to make initial malware assessment little bit easier for me, I think it's useful for others as well, It helps to reveal a debugger detection techniques used by a sample. Any feedback is greatly appreciated: @qazqaz How does it work? makin opens a sample as a debuggee and injects...

微点主动防御mp110013.sys驱动NtSystemDebugControl本地拒绝服务漏洞

微点主动防御软件是第三代反病毒软件。 微点主动防御软件所使用的mp110013.sys驱动没有正确处理NtSystemDebugControl内核API函数 WriteVirtual/WritePhysical中的Address/Buffer成员，本地用户可以通过运行恶意程序导致内核崩溃。 Micropoint Proactive Defense 100323.1.2.10581.0278.r1 厂商补丁： Micropoint ---------- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www.micropoint.com.cn/...

CVE-2004-2339: Undefined Security Weakness

Microsoft Windows 2000, XP, and possibly 2003 allows local users with the SeDebugPrivilege privilege to execute arbitrary code as kernel and read or write kernel memory via the NtSystemDebugControl function, which does not verify its pointer arguments. Note: this issue has been disputed, since...