• , ? A G 5 A H A
AGA )A
• G A A
– 5 5 5 ? AA
– 5 55 G 55 ? AA
G G A A
. A? A
G A
GA A
. AA
( 55 AA
5 AA
5
5
5 A
)
A G 5
F
AGA
)
Slide 6
Slide 6 text
• A EI G H CB
– F GH IAD /FC 6
– I B B B 6
– CCB1C G B 6
• F G IAD A EI G H CB
– CCB1C G B
• ACF A CB FG CB
– CCB1C G B C G ACF 2CC H 6
1CA CFA HG EI G H CB
2CC G
ACF A
/3 GH F B I
F G
IAD
FB H CB
CH B I
Slide 7
Slide 7 text
A = =D = =I ==D 59 0C9 = 9D
. 9 C
• . 9 C AB=
= DOI AD B =
– I 9 =
– 9 = = = = N
= A =
5 D7
9 = 9 = M 9 =. DI
M =
5 D7
9 = 9 = M
9 =. DI M=
5 D7
9 = 9 = M
9 =. DI M==
5 D7
9 = 9 = M 9 =. DI
M
I 9 = 036
5= = =
, = 6 9 =
5= = = N = A =
2 I 0D B = AD 9 C
N A 9B
1=C N
, =
6 9 =
=
(1
5,1
)
Slide 8
Slide 8 text
0 A DC D 1 BD : DC
DDA
• C B : DC DDA
E C : E 8
– 6 C0C
– 6 C :
• 1 BD DC C : DE DC
– DC : DE DC B : -42/ DC M( B :? C
3 O O O O
/ :
E
O O
)
Slide 9
Slide 9 text
( ?
9 5 6E )C E A ?
• A E E C ? AC
– E ? C F9
• F C A5 6E CA6 E:C A6 E
• E A9
/ 5AE CA6
). 6A 6E A E 5 :
5 AC C
)A 6E A 6E E
Slide 10
Slide 10 text
(C7A G G 7 EA:
: :8 C )D9: C :8 DC
• : :8 C 8D9: C :8 DC
– DA7 A F7 : DF 7A C9
– C)7G: C18F E 79 I E
– 7C9 7C 0:9A C: - FDC :C9 DF : DF M:
• : DDAG 8 :8 EFD :8 DC A7 D F I7A (99F:GG :G8F E DF
Slide 11
Slide 11 text
. 02.
0 2
) (.
0
. 2 2
.
.
2
6O NA
EI PM 36
4 EMN 4
6O NA
0H CA H N
5 P 5 P 5 P
MD OH
/E A I NE I
5 P
MD OH
6O NA 48
DENA NO A
0INA
1,
0INA
1,
0INA 0INA
1,
N NEIC A
AMM MA
IIA NE I
2 2 AM AM
2 NA 1 P A 5EMF
0I A
1AH,
,ECEN ,2
A
C DEIC
3 AI M O A
E D OCEIM
1O NE EICO
MA D
IN R
H EM I 1AH R I RMEM 7 M
• - / B : B I - BB: - B > :
D B D : :4: BI B : >
– > D D > B I>4 B >:J
• D 44 B > B D
• 4 D 44 B D :D 4
• BI 4A : :D: > D 4 >> D B >D - / B
B : :> BI
– D > I : D 4 > D 4D D :>
>D: 4A : :D: > D
- / B 0 1
• FA P RE C EO A PA D EM A P ATP P GA AH FA P
E B I PE
– A C L AOO FA P - 6 -
• .E A ( LA EVA E ,1 ) -6 -),-6
• H PEHEP . IAS G( H C E 2 -),-6
• A , H / REPP AP H S A PP GA H
D CA PDA R H AO P DE A OLA EBEA FA P :
– 1 OPA PDA L L OA OP OEC P AO OE C ,
B PE HEP B EH AO EB PDA R H AO A D CA
) PE ) H OEO APD (
) PE FA P RE C
I EB E C
DA A R H AO
B I ATA
Slide 17
Slide 17 text
• A 7 A C 7 AA :7 : 7
BCA 7
– -AH A :7 (
• :7C : A 7 CG :7C7 C7 7G7C 7
AB7C A AC ?7?AC ? 7
– :7 AB7C A C7 CA (
• .7 :7
) ) 7 :A
) 7 CG A !
7?AC 7 - , C 17 BA 7C
Slide 18
Slide 18 text
No content
Slide 19
Slide 19 text
• H G9 CFB C DI I EDH E I G C EG IEEBH
– EB I B IM G C EGA
– D DI CEGMN
– - , GM HFED G ECC D IM I ED
• E D I G EF G I EDH 9 I D C CEGM
D BMH H D9B D9EDH G HH CFI EDH
– 2GEFEH C I E CE H ED MI E I G B I
IE I EF G I EDH
• I H D H P EGI 9IEG
– .I 9 DOI HF 9 9 E 9IH I 9 D EGI D BMH H
– 0E CF 9I ED I G DD D HMHI C
• 0E 1 DE GGEGH EG MH IE AH
HIG 9I E 2GEFEH I E
Slide 20
Slide 20 text
• 2 2 2
•
• 2 0
– 2 2
– 0
2
Slide 21
Slide 21 text
• 2 2 1 2
•
• 1 2
– 2 1 2
–
2
Slide 22
Slide 22 text
• 69 PT A CP P A C V B E 1 OCA OV : C / PC 1:/
D C A O ACPP
– 1:/ P P OCB C A O ACPP HCA 27860299
• V VP P P KRP EC 1:/ S RC D O ICO C P AC
• :T O ACPPCP SC C ICO C 1:/
– 7P 9VP CK7O ACPP 9VP CK O ACPP
– 7P B C7O ACPP B C O ACPP
O R .BBOCPP :O P CO C 9 AC
69 BP
9 O VP A BBOCPP D O
BBOCPP O P
0 O 8CE P CO 08(
) .BBOCPP :O P 3 T 7.2 ) OIP
- CA C K AO P D A K C RP O OV AA ()( , 9 P
Slide 23
Slide 23 text
3 BDE B CC 2B C D B A
B CC D DBE DEB
2
2
2 : H B I
2FA
2
:
H FCD I B H I
:C
Slide 24
Slide 24 text
• B :,0 4) : ), H A
: 4 3
• B D OB B B 0F A .CE 2 F CK R0 E S
– 0 B I H KK CK 0 E A , N E C
:14 3
C E ) KK KE CH C 1 E I (
HE CEC . F OH D
:,0 4) : ),
A RTP TP TP TP S
0F A .CE 2 F
Slide 25
Slide 25 text
• 5: I CD D
2 C D CD 5 CC
• D EC 2 2 D:
2
• 2 2 A DD C 5: 5
DE CC C D A 5
D H
2 2 C
F C C
Slide 26
Slide 26 text
• : FD M R LDHB .F BL DH 1 ), H
6IIF B DH 6 3 ),
– C E MC DLM H MP H 6IIF B H 6
• B DM ( IK
• 0A FF M DL O FD B M MC , O F
:DKM F ) K LL K HLF MDIH DH 2 KH F J (
H D HM IKRS IHM
6L0HDMD F RLM 6KI LL
.F BL DH
1 ),
6IIF B DH
6 3 ),
Slide 27
Slide 27 text
• 2 2 A B B
2
• B D C 7 B AC B D : B :B B
: BC E :A D
: BC AA A B: :
E A
:AB :
2 2 A
7 D A: A
Slide 28
Slide 28 text
• CBA8 GB DH CC 8 G G
B G H A A (
– : ( B: 0 A G 2K G 0 B A8
0 8 0 B ABG :BHA8 H 8 (
I H H 8
GH 88 A G BA A . A 2C
,( K CBA8 )BAG
: G H AG :B ( I H
G A ( H G 8 A 8
GH B K BI :HA G BA
Slide 29
Slide 29 text
EGH ::E FF E BF G CB B EB D 9
2 G : G
C G GJ
E A ICE
2 2 F : EC9 FF
A A B 2
B: BG
ACEJK
2 2 F B G JFG A E
C9 FF
CC B 2
F B 2
A A B 2
EJ
2 FDCB: E
2 2 CE B H FF B
CE G A
• 3 7 C C D A 7 7
E DG GD E D 7 CD C
– 13 DE C 62 32 32 32 32
– 7D GD ) 7 )(
• ,AA 7 7A E E CCAE G EE DE C GE
8G E DG GD E
0G EE 13 DE C 7
,D GD
) ) ( )
C E 62 32 8 )
C E 32 8
C E 32 )(8 (.
C E 4 E 7 32 8
C E 4 E 7 32 )(8 /
Slide 32
Slide 32 text
H C 3 I E DC C E: G :GHE
H 3GEH:GHE C K 6 AH
2
4 6 23
2 4
6 E DC AD:
H E G G
E
B G 3 6 E DC
4
2
C E4 M N
3 L
EC
EC
E: G
:G I ED:
D D HA G
2
HEE CG4 E
Slide 33
Slide 33 text
• 8 B IP O B F T 36 B FK A EFOB OP B
– B D K FHB :F 464 S
• 1 OEB B FK F P G KR FI DBF K KII A
DPB FO
– , 2, ,- 8 , - ,- =
PB F D 36 B FK A EFOB OP B
KH OFHFOT . IBRK G
3R B D V2, W
6FUB
Slide 34
Slide 34 text
• D F C A 3 3A : C CDA
43
• 3 3C C: 4F D 3 C E3 D
3 3
D E A 3 A : C CDA
3 3 C AFG
C E3 D
3 3
Slide 35
Slide 35 text
• O LH L GKE L ND LM E KK HA C DKL. DG
564 ,
– A IHKKD E LC 4 N KDHG G CDL LM H L
• L 5 N KDHG A H 3L : KDHG DG
,) ,6 ( (
M KKDGB 4 N KDHG G ( CDL LM
G D GL H OP HGL
Slide 36
Slide 36 text
• H F G BI
– ( ( )4 6) 3 / DF (() ) ( 4
• 6 B H H ) F G HIF G
– ( 3 F /4 F
I GG 3 FG D F: H :HIF
FK GED F
H F G K : BB
F B /HDGAF B G I :H D
) F G HIF G
( 3 F /4 F
) F G HIF G
( 3 F /4 F
Slide 37
Slide 37 text
• .:H 13 :FG DC
– 1 :F7H C 3 GH:B :FG DCG C 1 H DC7A :7 :F
• : 6 C D G 7 DF1 :F7H C 3 GH:B :FG DC(
7C CDF1 :F7H C 3 GH:B :FG DC(
• .:H BDF: G : :FG DC
– B:,7H73H7B C A: =:7 :F
. :GG C 13 :FG DC 7C )F = H: H F:
.7F :G DC :F DCH
=:
1 :F7H C 3 GH:B :FG DC
=:
B:,7H73H7B
Slide 38
Slide 38 text
N LLDHB O KLDIH H K CDM MNK
4 F M M
8IF MDFDM
K G PIKE
6
4
:
H D HM
GIK R
3 6 4 4 : 3L HDMD F LM G3K
I LL
IAAL M O FN IA G B DF G :
6CK /DLM DH 34
G M 8 KLDIH DH
4 6
K
4 L IH K
KH L DH
6 8 4 IK
4 6
3 K IA
DH IPL E KH F
3 C K LDBH MNK L S T T3 T
K MDHB LM G8 KLDIH DH
MDIH F K
:
6DG M M G DH DF K
• D4H DE A A E E D A4D D E
– A D4 GE EC 4 4 D 4 D EE E
• E H D EE 4 D CD EE E
• E 4 , G E D DA G E
• 4 / D D G4 D EE E D C D D
• 4DH A
– A D4 GE I H4 G E A 4 DE
• /
• 0 / /
• , D E 4D GE A A
/ 00
A DA E
Slide 41
Slide 41 text
• GE: HH B HI H ILE L B A
– ) : ) 1()44 :B H :I K GE: HH AH
• -4 ) B A B A
– H :I K GE: HH H- I B4 HI C GE: HH
G E F IE I G
II . G B 1 :IH
GE: HH A HI
PsActiveProcessHead
_EPROCESS
“System”
_EPROCESS
“smss.exe”
_EPROCESS
“win32dd.exe”
FLINK
BLINK
FLINK
BLINK
FLINK
BLINK
FLINK
BLINK
Slide 42
Slide 42 text
• E EF A : A FGF DE EL GE F
– 2 E = 6( (6() 4 6( 6 ) ()
– G F G ED FF : 6 (() 4 ) 6(
• G E
– HF DDA 6 6 ) ()
GG E A GF
DA G A GL E B DE
)K HG ( 2 E
GG 6( (6() 4 6( 6 ) ()
6 (() 4 ) 6( ::E FF
Slide 43
Slide 43 text
• BIECR CAPT MG
– F MD 2: 02 S MG ADDPE TAKSE
– L KAP R P BS R GMARSPE OP O ED B
PEMDAM 1 KAM 4AT RR ER AK &?
(
4ERR MG EPMEK BIECR
8AMD AMR 8EL P E
1= &
B RE AK GMED-
.CR TE:P CE 7 M 3K M
-
:EB )FFD
)FFD -
Slide 44
Slide 44 text
• D4H DE A: A E E BD A4D D E
– : GDD A D 4 A ,.
– : ). ) DB D 4
• : C 4 .DB EE A , ) ( .
– E 4D B D4H DE CDB EE E DB
). )
A: , DA E
4D ECBA D
4D G AB B : 4 4
.E H .DB EE 4 4E ). )
Slide 45
Slide 45 text
ANNDIB ALIAG 4 EA NM
6AG NA N
: G NDGDNR
,L HA LF
( ( . 6
5M NDPA5L AMM.A DI
( 6
5 G B DI 544 . 6
I D IN
AH LRSA
LAMM P GOAM DI 564)
( 5A AN
.( LR
6AMK I AL
)OLLAIN CLA DI 56)( 5M IDND G RMNA
H5L AMM
564) K DINAL DI .6
H BA,DGA HA DI 564)
Slide 46
Slide 46 text
H , H K
HE CEC P
, F OH D
H K
: 64 ) :
G
F A ,CE 2 F
4K E 4 H KK
H
: ( : ( :
:
H K
: ( : ( :
:
G
4K CN 4 H KK
1 G C G
1 FH P
H K
: 64 ) :
4HHE A
,E AK G
F A ,CE 2 F
4K GC C E6PK F
4 H KK
H K
: 64 ) :
G
H K N EM H
F A ,CE 2 F
4K GC C E6PK F
4 H KK
2HG
( P
KIHG
2HG H
I CGA6PK F
KCHG
H D G E B
H
F A ,CE 2 F
4K GC C E6PK F
4 H KK
Slide 47
Slide 47 text
• H D K E K O K MH 6 4
– A K O K H L RM H MA HEEHP
M
• S ( )1 ) ()1 H L E KH LL
• HHE ) ()1 H
L M E RLM KH LL
• CHK I K M RLM 4 KL H ) A K H
HPL D K E
• A D MA H M H L (
• K MA HKR L
O EH 7 8
• ERS M L MAK MHHEL
( H L H (K O K 4 H
Slide 48
Slide 48 text
4 4
8
Slide 49
Slide 49 text
No content
Slide 50
Slide 50 text
• 55 5 55 5
• 0 0 55
• 0 0 5
5
0 0 5
Slide 51
Slide 51 text
• B E BA B C DD G F D B E A FD D
BC FA E BA FC D
– B5= E CG A 5 BC
– B5= E CG A 5 B E E C BC 1
F DD A D BA
C DD F D
C DD C A
C DD C 5
Slide 52
Slide 52 text
• 6LHHG K B LEH G E K
– 5 AC K M DL GK EG C C
1C CELE AL C A !
( ( 2 (
(
( 3
2 2 ( 32
)3
( 3
) 5 AC K
36 M CG K 2K)LCD 2LE
4( D 5 AC K
4 ( KCM 4 G ) 5 ( (
4 G 1G LD C K ) 5 ( (
Slide 53
Slide 53 text
• - 3 - 5 3 5
- - ) 5
– - 5 5 B -
• 52B ) 5 B 5 3 25 D 5
• 52B - B 5 3 D 5
(5 5 3 5 3
Slide 54
Slide 54 text
• - , - B
B - ,B ,4 - -
)
5 ,4 -
( - 5
,4 - - B
( 5
5
H I 938K[b 7K ]5 W [Y 0R]] / RL K[b MYW PK ]N W " [Y1
H I 6 4K O FS 6 L SVN"S ]YYV YP 6 4K O 0R]] / SNK MO YP] K[O MYW 1
H(I YY BYV FS NY OWY[b CYYVUS] 0R]] / WYY YV MYW S NY "WOWY[b"]YYVUS] 1
H)I AO O[_ON 2NN[O B KMO S FS NY Rb SMKV OWY[b 0R]] / MMS MYMYVY "
SP]b MYW LVY NO_SMO"[O O[_ON R]WV1
H I EYVK]SVS]b 7[KWO Y[U 0R]] / _YVK]SVO b ]OW MYW NOPK V] _YVK]SVS]b1
H I ]SWOVS O[ V S 0R]] / VOONK LVY Y] MYW . _YVK]SVS]b" "]SWOVS O["
[O S ][bK S R]WV1
H I D NK]O/ OWY[b 7Y[O SM 6 BM[S ] 0R]] / MMS MYMYVY " SP]b MYW LVY ( WOWY[b"
PY[O SM R]WV1
H-I K NSK ] AONVS O 0R]] / WK NSK ] MYW [YN M] P[OO YP] K[O [ONVS O 1
H.I K NSK ] OWY[bcO 0R]] / WK NSK ] MYW [YN M] P[OO YP] K[O WOWY[bcO 1
H I B925 F F2< 6A AKS S CRO 3K[ 7Y[ AYY]US]
0R]] / LVKMURK] MYW [O O ]K]SY LR"T " LR"T " " K[U "L ]VO[ NP1
H I O]O[ [O]O[ 2 ]S OWY[b 7Y[O SM OWY[bcO BM[S ]
0R]] / ] a M LVY Y] MYW WO]O[ [O]O["K ]S"WOWY[b"PY[O SM R]WV1
H I AYL ] BS K] [O PY[ O[ OV 5K]K B][ M] [O
0R]] / MM K]OMR ON dL[O NK MM . S O NP1
H (I :NO ]SPbS OWY[b :WK O 0R]] / VOONK LVY Y] MYW SNO ]SPbS "WOWY[b"
SWK O R]WV1
H )I G DA 4< D5 :B :> G 4 6C 0R]] / WONSK LVKMURK] MYW LR"NM"
B SMRO 3VKMU9K] 54 B SMRO 4VY N YMUO]" NP1
H I 7S NS LTOM] AYY] S ES ]K 4A 0R]] / LVY MRK]cPY[O SM MYW K PS NS "
YLTOM]"[YY] "S "_S ]K"U M[ 1
AOPO[O MO