Comments on: Puppet Master… or how to poison Red Pill http://indefinitestudies.org/2009/04/16/puppet-master-or-how-to-poison-red-pill/ Academic ramblings about software security. Thu, 02 Feb 2012 14:37:29 +0000 hourly 1 http://wordpress.com/ By: tokki2cut http://indefinitestudies.org/2009/04/16/puppet-master-or-how-to-poison-red-pill/#comment-196 Sun, 20 Sep 2009 17:14:17 +0000 http://indefinitestudies.org/?p=298#comment-196 good job… but… we need puppet master for PIN :)

]]> By: Puppetmaster Strikes Back « Indefinite Studies http://indefinitestudies.org/2009/04/16/puppet-master-or-how-to-poison-red-pill/#comment-123 Mon, 13 Jul 2009 10:47:05 +0000 http://indefinitestudies.org/?p=298#comment-123 [...] 13 07 2009 Vincent Mussot and I implemented new virtualization counter-countermeasures in puppetmaster. This time we can detect and thwart 6 tests out of 7 in ScoopyNG. In addition to the SIDT test, we [...]

]]> By: Security News » Unpacking samomodyfikujących się aplikacji http://indefinitestudies.org/2009/04/16/puppet-master-or-how-to-poison-red-pill/#comment-106 Fri, 19 Jun 2009 13:40:43 +0000 http://indefinitestudies.org/?p=298#comment-106 [...] Piotr Bania opublikował artykuł przedstawiający metodę rozpakowania samomodyfikujących się aplikacji (spakowanych) wykorzystując binarną instrumentację (patrz np. Pin i jego przykładowe wykorzystanie): [...]

]]> By: Jeff http://indefinitestudies.org/2009/04/16/puppet-master-or-how-to-poison-red-pill/#comment-80 Fri, 17 Apr 2009 16:15:48 +0000 http://indefinitestudies.org/?p=298#comment-80 >what about Windows systems ?

Use a hypervisor to prevent redpill on windows in kernelmode.

]]> By: dan http://indefinitestudies.org/2009/04/16/puppet-master-or-how-to-poison-red-pill/#comment-79 Fri, 17 Apr 2009 08:37:06 +0000 http://indefinitestudies.org/?p=298#comment-79 >Useless when redpill is in kernelland
true

>It’s possible to do the same thing with ptrace
what about Windows systems ?

]]> By: Pouik http://indefinitestudies.org/2009/04/16/puppet-master-or-how-to-poison-red-pill/#comment-78 Fri, 17 Apr 2009 08:25:59 +0000 http://indefinitestudies.org/?p=298#comment-78 Useless when redpill is in kernelland. It’s possible to do the same thing with ptrace (which is GPL :)).

]]>