CMSC449_A-6
.docx
keyboard_arrow_up
School
University of Maryland, Baltimore County *
*We aren’t endorsed by this school
Course
449
Subject
Computer Science
Date
Jan 9, 2024
Type
docx
Pages
8
Uploaded by ChefOryxMaster925
CMSC 491/691 Malware Analysis HW 6
Name: Ricky Kapoor
Assigned: 11/15/2023
Due: 11/29/2022 by 5:30pm
Download the OllyDumpEx plugin and ImportREC.7z onto your VM. Place OllyDumpEx_Imm18.dll inside of the C:\Progam Files (x86)\Immunity Inc\Immunity Debugger\ folder. Unzip ImportREC.7z. The password is “imprec”.
OllyDumpEx_Imm18.dll:
●
https://drive.google.com/file/d/1xCtIC-9qbWZlqg2ct04-xAqeNPuNCMGK/view?usp=share_link
ImportRec.7z:
●
https://drive.google.com/file/d/13rZDfCnv9m9pdrfxDIlVJXvWDmt3NQ1h/view?usp=share_link
Download hw6.7z onto your Flare VM and extract it. The password is “infected”. Set your VM’s network adapter to “not attached”. Take a snapshot of your VM when your VM is set up because you will likely need to revert multiple times. You are not required to run Immunity Debugger as administrator.
HW 6.7z:
●
https://drive.google.com/file/d/1MOaC0pgfI05o0iG2igpCJf3n4qZcBK6m/view?usp=share_link
Hint: Chapter 18 of PMA is a great reference for this homework!
Part 1: Unpacking hw6_1.exe (33 pts)
Answer the following questions about hw6_1.exe.
1) What is the relative virtual address (RVA) of the entrypoint? (3 pts) 1d001
2) What section contains the unpacking stub? Justify your answer. (4 pts) The section “.aspack” or “Section 8” has the unpacking stub. When navigating to the entry point in IDA, this section contains the command “start”.
3) What section contains the packed data? Justify your answer. (4 pts) The section “CODE” or “Section 1” has the packed data. Its entropy is very high and it contains the largest amount of data.
4) Using one of the methods described in class, find the original entry point (OEP) of hw6_1.exe. What is the address of the OEP? In a few sentences, describe which method you used and how you found the OEP. (8 pts)
Address of OEP: 413C14
Description: I used the second method (“Read Breakpoints on the Stack”). First, I found where the executable was pushed onto the stack, then took the bytes in the ESP’s address register when it was run,
and set a hardware access breakpoint. Then, I stepped through the remaining instructions until the executable was loaded into the EIP register and “returned” that address.
5) Provide a screenshot of Immunity Debugger showing execution paused at the OEP. Make sure that your screenshot shows the entire window of your virtual machine. (8 pts)
6) Use OllyDumpEx to dump the unpacked hw6_1.exe and then fix its IAT using ImpRec. Provide a screenshot of ImpRec once you have fixed the IAT. Make sure that your screenshot shows the entire window of your virtual machine, and that the ImpRec log shows how many modules and import functions were detected. (6 pts)
Your preview ends here
Eager to read complete document? Join bartleby learn and gain access to the full version
- Access to all documents
- Unlimited textbook solutions
- 24/7 expert homework help
Related Questions
What does the following Python code do?
import serial #Import Serial Library
arduinoSerialData = serial.Serial('com11,9600) #Create Serial port object called
arduinoSerialData
while (1==1):
if (arduinoSerialData.inWaiting()>0):
myData = arduinoSerialData.readline()
print myData
O Nothing
O Read data from the serial port and plot it on an x-y graph.
O Read data from the serial port and displays it on the screen.
O Reads data once from the serial port and displays one piece of data on the screen.
arrow_forward
Below is cache.py. Make sure the code works properly and is plagarism free. Make sure to show the screenshot of the output with the screenshot of the code being tested as plagarism free.
cache.py
import socketimport sys
def handle_client(client_socket): while True: command = client_socket.recv(1024).decode() if not command: break if command == 'quit': break elif command == 'put': receive_file(client_socket) elif command == 'get': send_file(client_socket) else: print("Invalid command.") break client_socket.close()
def receive_file(client_socket): pass
def send_file(client_socket): pass
def main(): if len(sys.argv) != 4: print("Usage: cache.py <port> <server_ip> <server_port> <transport_protocol>") return
port, server_ip, server_port, transport_protocol = int(sys.argv[1]), sys.argv[2], int(sys.argv[3]), sys.argv[4]…
arrow_forward
Make a port scanner in python
This is what I have so far, but I need the program to take a host as a command-line argument and the port range to scan.
arrow_forward
Last Stage of Delirium, a security study organisation, created some clean portbinding shellcode for Linux. Shellcode that is clean is shellcode without any NULL symbols. As was already stated, NULL characters prevent the majority of buffer overflow vulnerabilities from being exploited properly because the function stops copying when a NULL byte is encountered. E
arrow_forward
PLeae write in python
The populated contacts.txt file with at least 5 contacts
1 screenshot of executed code in command line/terminal window for the print address book option (either paste into Word document or as an image)
1 screenshot of executed code in command line/terminal window for the search contact option (either paste into Word document or as an image)
arrow_forward
Computer Science
Create a PowerShell script that handles the following information. The script must utilize an arrays and loop.
$server1 = "Mercury"
$server2 = "Venus"
$server3 = "Mars"
$server4 = "Pluto"
Write-Host "$server1 has been backed up"
Write-Host "$server1 has been updated"
Write-Host "$server1 has been received vendor files"
Write-Host "$server2 has been backed up"
Write-Host "$server2 has been updated"
Write-Host "$server2 has been received vendor files"
Write-Host "$server3 has been backed up"
Write-Host "$server3 has been updated"
Write-Host "$server3 has been received vendor files"
Write-Host "$server4 has been backed up"
Write-Host "$server4 has been updated"
Write-Host "$server4 has been received vendor files"
Answer
Skip
arrow_forward
If r0 = 0x20000004, r1 = 0xC3B2A and r2 = 0x02, after executing STR r1, [r0, r2, LSL #2] command, which of the following is the data in memory address 0x2000000D (data layout big endian)?
Please choose one:A. 0x2AB. 0xB2C. 0x0CD. 0xC3E. 0x3B
arrow_forward
DO NOT COPY FROM OTHER WEBSITES
Correct and detailed answer will be Upvoted else downvoted. Thank you!
arrow_forward
7
Which command can be used to kill background process "(sleep 160; who)"?
(2 Points)
kill %1
kill 12804
O kill 12808
O kill %[3]-
arrow_forward
What is the full command line for the loopback address test command?
arrow_forward
I have a powershell fill in the blank I need help with.
arrow_forward
In this part, we add the CPU temperature ID of the Raspberry Pi to the MQTT stream.
Open a new terminal and create a new script by the name of py and add the following content to it.
import paho.mqtt.client as mqtt
import time
from subprocess import check_output
from re import findall
def get_temp():
temp = check_output(["vcgencmd","measure_temp"]).decode("UTF-8")
return(findall("\d+\.\d+",temp)[0])
def on_connect(client, userdata, flags, rc):
print("Connected with result code "+str(rc))
client.subscribe("etec224_mqtt_test/")
global Connected
Connected = True
Connected = False
client = mqtt.Client()
client.on_connect = on_connect
client.connect("broker.emqx.io", 1883, 60)
client.loop_start()
while Connected!= True:
#Wait Here
time.sleep(0.1)
try:
while True:
value = get_temp()
client.publish('etec224_mqtt_test/', value)
time.sleep(1)
except KeyboardInterrupt:
client.disconnect()…
arrow_forward
how to fix error message in pdfsense in vmware . need help
arrow_forward
how do i apprach this problem?
arrow_forward
The NX (“no execute”) bit can also be supported by modern CPUs. To force a CPU to avoid running the code on a file, set the NX bit to 1 on that page.
Currently, the OS and paging hardware implement this maximum quantity. Keep in mind that non-X86-compliant software/hardware can be executed on an OS and hardware How about a parser who wants to enforce NX above the operating system level? The programmer inserts a nX-bit association with each memory page at the bottom (in other words, at each memory location of nX bits.)
The programmer imposes a size limit of 4095 bytes for application-level data structures. each stack frame is allocated in its own page, and no stack frame is larger than a page. At a given point in time, a stack frame might look like this:
|-----------------------|
| |
+-----------------------+
entry %esp-->| return address |
+-----------------------+
new %ebp---->| saved %ebp |
+-----------------------+
| buf[4] |
| buf[3] |
| buf[1] |
| buf[0] |…
arrow_forward
An encryption mode
Accepts 3 parameters on the stack
32 bit OFFSET of a BYTE array (this array contains a 26 character key)
32 bit OFFSET of a BYTE array (this array contains the plaintext message to be encrypted)
32 bit OFFSET of a signed DWORD (the dereferenced value initially contains the integer -1)
Note that the plaintext message will be in a BYTE array that ends with a NULL character (indicating the end of the message)
This operational mode will encrypt the requested message. By the time your function returns, the original plaintext message array will be overwritten with the correctly encrypted message.
arrow_forward
File "chegg.py", line 144, in <module>
sys.exit(main())
File "chegg.py", line 32, in main
server_socket.bind(('', args.port))
OSError: [Errno 48] Address already in useerror occurs
arrow_forward
Attached are two python files snw_transport.py and tcp_transport.py. There are errors in these codes, so make sure to show screenshots of the fixed code for both of the python files along with the screenshot of the output as well.
arrow_forward
Objective:
This project will introduce you to interprocess synchronization mechanisms in UNIX using named POSIX semaphores, pthread mutex semaphores, and pthread condition variables.
You will:Use named POSIX semaphores to synchronize the producer and consumer threads.
Use pthread mutex semaphores and pthread condition variables to synchronize the access to a shared buffer between producer and consumer threads.
Create a fixed-sized buffer to store the encoded data generated by the producer thread.
Use the buffer to store the encoded data generated by the producer thread and transfer it to the consumer thread through the shared buffer.
The producer thread should read the input file and generate the Huffman code for the input data. The producer thread should then encode the input data using the Huffman code and write the encoded data to the fixed-sized buffer.
The consumer thread should read the encoded data from the shared buffer and decode it using the Huffman code. The consumer thread…
arrow_forward
Explain the Exceptions in Linux/x86-64 Systems ?
arrow_forward
Experimenting with AES-”S symmetric key cipher. Note: You may use any programming language that provided libraries for AES. Descrion: This assignment consists of two parts:PART 1: write a program that uses AES-12/1 to decrypt a message. The program should be named "decrypt", and should deal with three files that contain the encrypted text as a stream of bytes, the 128-bit key for decryption stored as a stream of bytes, and file outcome of the decryption, respectively. o To test this program, here's an example of an encrypted message a. its 128-bit secret key
PART 2: you will try to use "brute force" to decrypt an encrypted message, where you only have Sirrst 96-bits of the 12S-bit secret key (last 9 bytes of the secret key are he program should be called "findk", and should deal with two files that contain the encrypted text as a stream of bytes and the first 96-bits of the key, respetively. The program should decryptedn standard the the missing h6177 of the key in hexadecimal,…
arrow_forward
Write a bash script to support the following capabilities:
Write a bash script using GREP to detect the following scenario: display all Users who have logged in during non-office hours (8:00AM to 5:00PM).
Take a screenshot of the console output.
arrow_forward
Write a bash script using for loop to list 0 - 9 as 1234567890 and the command prompt should be innext line of the resu
arrow_forward
# server2.py
import socket
# Function to validate credit card information
def validate_credit_card(credit_card_details):
# Dummy validation, always returns True
return True
# UDP server setup
server_socket = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
server_socket.bind(('localhost', 6000))
print("Server2 is listening...")
while True:
data, addr = server_socket.recvfrom(1024)
print(f"Received credit card details from {addr}")
# Credit card validation
if validate_credit_card(data.decode()):
server_socket.sendto(b"Payment successful.", addr)
else:
server_socket.sendto(b"Payment failed. Please check your credit card details.", addr)
arrow_forward
SEE MORE QUESTIONS
Recommended textbooks for you
Database System Concepts
Computer Science
ISBN:9780078022159
Author:Abraham Silberschatz Professor, Henry F. Korth, S. Sudarshan
Publisher:McGraw-Hill Education
Starting Out with Python (4th Edition)
Computer Science
ISBN:9780134444321
Author:Tony Gaddis
Publisher:PEARSON
Digital Fundamentals (11th Edition)
Computer Science
ISBN:9780132737968
Author:Thomas L. Floyd
Publisher:PEARSON
C How to Program (8th Edition)
Computer Science
ISBN:9780133976892
Author:Paul J. Deitel, Harvey Deitel
Publisher:PEARSON
Database Systems: Design, Implementation, & Manag...
Computer Science
ISBN:9781337627900
Author:Carlos Coronel, Steven Morris
Publisher:Cengage Learning
Programmable Logic Controllers
Computer Science
ISBN:9780073373843
Author:Frank D. Petruzella
Publisher:McGraw-Hill Education
Related Questions
- What does the following Python code do? import serial #Import Serial Library arduinoSerialData = serial.Serial('com11,9600) #Create Serial port object called arduinoSerialData while (1==1): if (arduinoSerialData.inWaiting()>0): myData = arduinoSerialData.readline() print myData O Nothing O Read data from the serial port and plot it on an x-y graph. O Read data from the serial port and displays it on the screen. O Reads data once from the serial port and displays one piece of data on the screen.arrow_forwardBelow is cache.py. Make sure the code works properly and is plagarism free. Make sure to show the screenshot of the output with the screenshot of the code being tested as plagarism free. cache.py import socketimport sys def handle_client(client_socket): while True: command = client_socket.recv(1024).decode() if not command: break if command == 'quit': break elif command == 'put': receive_file(client_socket) elif command == 'get': send_file(client_socket) else: print("Invalid command.") break client_socket.close() def receive_file(client_socket): pass def send_file(client_socket): pass def main(): if len(sys.argv) != 4: print("Usage: cache.py <port> <server_ip> <server_port> <transport_protocol>") return port, server_ip, server_port, transport_protocol = int(sys.argv[1]), sys.argv[2], int(sys.argv[3]), sys.argv[4]…arrow_forwardMake a port scanner in python This is what I have so far, but I need the program to take a host as a command-line argument and the port range to scan.arrow_forward
- Last Stage of Delirium, a security study organisation, created some clean portbinding shellcode for Linux. Shellcode that is clean is shellcode without any NULL symbols. As was already stated, NULL characters prevent the majority of buffer overflow vulnerabilities from being exploited properly because the function stops copying when a NULL byte is encountered. Earrow_forwardPLeae write in python The populated contacts.txt file with at least 5 contacts 1 screenshot of executed code in command line/terminal window for the print address book option (either paste into Word document or as an image) 1 screenshot of executed code in command line/terminal window for the search contact option (either paste into Word document or as an image)arrow_forwardComputer Science Create a PowerShell script that handles the following information. The script must utilize an arrays and loop. $server1 = "Mercury" $server2 = "Venus" $server3 = "Mars" $server4 = "Pluto" Write-Host "$server1 has been backed up" Write-Host "$server1 has been updated" Write-Host "$server1 has been received vendor files" Write-Host "$server2 has been backed up" Write-Host "$server2 has been updated" Write-Host "$server2 has been received vendor files" Write-Host "$server3 has been backed up" Write-Host "$server3 has been updated" Write-Host "$server3 has been received vendor files" Write-Host "$server4 has been backed up" Write-Host "$server4 has been updated" Write-Host "$server4 has been received vendor files" Answer Skiparrow_forward
- If r0 = 0x20000004, r1 = 0xC3B2A and r2 = 0x02, after executing STR r1, [r0, r2, LSL #2] command, which of the following is the data in memory address 0x2000000D (data layout big endian)? Please choose one:A. 0x2AB. 0xB2C. 0x0CD. 0xC3E. 0x3Barrow_forwardDO NOT COPY FROM OTHER WEBSITES Correct and detailed answer will be Upvoted else downvoted. Thank you!arrow_forward7 Which command can be used to kill background process "(sleep 160; who)"? (2 Points) kill %1 kill 12804 O kill 12808 O kill %[3]-arrow_forward
- What is the full command line for the loopback address test command?arrow_forwardI have a powershell fill in the blank I need help with.arrow_forwardIn this part, we add the CPU temperature ID of the Raspberry Pi to the MQTT stream. Open a new terminal and create a new script by the name of py and add the following content to it. import paho.mqtt.client as mqtt import time from subprocess import check_output from re import findall def get_temp(): temp = check_output(["vcgencmd","measure_temp"]).decode("UTF-8") return(findall("\d+\.\d+",temp)[0]) def on_connect(client, userdata, flags, rc): print("Connected with result code "+str(rc)) client.subscribe("etec224_mqtt_test/") global Connected Connected = True Connected = False client = mqtt.Client() client.on_connect = on_connect client.connect("broker.emqx.io", 1883, 60) client.loop_start() while Connected!= True: #Wait Here time.sleep(0.1) try: while True: value = get_temp() client.publish('etec224_mqtt_test/', value) time.sleep(1) except KeyboardInterrupt: client.disconnect()…arrow_forward
arrow_back_ios
SEE MORE QUESTIONS
arrow_forward_ios
Recommended textbooks for you
- Database System ConceptsComputer ScienceISBN:9780078022159Author:Abraham Silberschatz Professor, Henry F. Korth, S. SudarshanPublisher:McGraw-Hill EducationStarting Out with Python (4th Edition)Computer ScienceISBN:9780134444321Author:Tony GaddisPublisher:PEARSONDigital Fundamentals (11th Edition)Computer ScienceISBN:9780132737968Author:Thomas L. FloydPublisher:PEARSON
- C How to Program (8th Edition)Computer ScienceISBN:9780133976892Author:Paul J. Deitel, Harvey DeitelPublisher:PEARSONDatabase Systems: Design, Implementation, & Manag...Computer ScienceISBN:9781337627900Author:Carlos Coronel, Steven MorrisPublisher:Cengage LearningProgrammable Logic ControllersComputer ScienceISBN:9780073373843Author:Frank D. PetruzellaPublisher:McGraw-Hill Education
Database System Concepts
Computer Science
ISBN:9780078022159
Author:Abraham Silberschatz Professor, Henry F. Korth, S. Sudarshan
Publisher:McGraw-Hill Education
Starting Out with Python (4th Edition)
Computer Science
ISBN:9780134444321
Author:Tony Gaddis
Publisher:PEARSON
Digital Fundamentals (11th Edition)
Computer Science
ISBN:9780132737968
Author:Thomas L. Floyd
Publisher:PEARSON
C How to Program (8th Edition)
Computer Science
ISBN:9780133976892
Author:Paul J. Deitel, Harvey Deitel
Publisher:PEARSON
Database Systems: Design, Implementation, & Manag...
Computer Science
ISBN:9781337627900
Author:Carlos Coronel, Steven Morris
Publisher:Cengage Learning
Programmable Logic Controllers
Computer Science
ISBN:9780073373843
Author:Frank D. Petruzella
Publisher:McGraw-Hill Education