VMware Fusion: Serial Port Ayarlama
İlk yazımın üzerine ek bir bilgi gibi olacak ve VMware Fusion üzerinde Serial Ports ayarlamalarının nasıl yapıldığı ile ilgili olacak.
İlk yazımın üzerine ek bir bilgi gibi olacak ve VMware Fusion üzerinde Serial Ports ayarlamalarının nasıl yapıldığı ile ilgili olacak.
In this article, I will give some solutions when writing code for Windows Kernel driver or C++. Especially these are solutions when try to set up VS Studio on VM and start to write codes.
Topic is the Arbitrary Memory Overwrite vulnerability, also known as Write-What-Where. Our goal is essentially to overwrite a pointer in the Kernel Dispatch Table (where) with the address of our shellcode (what).
On the user mode side: whenever an application runs, Windows creates a process for it. Within that process, Windows allocates a private virtual address space exclusively for that application. Because this address space belongs to only one application, other applications cannot modify it.
Nearly every process in the operating system architecture is defined within the EPROCESS structure. Inside this structure, we can access all information — such as memory regions — belonging to the processes we examine.
We specify the path of our file named HEVD.sys, which can be exploited from the DriverPath section. We set Service Start*to Automatic.
As can be understood from my previous articles, I was doing malware analysis. It will take time to deal with the issues encountered in the beginning. So I will explain these experiences.