Stealing)From)Thieves:)Breaking)
IonCube)VM)to)RE)Exploit)Kits))
!"#$%&'()$#&*(+,#$-./&01(
!"#$%&'()*+%,-&
• .,/,0+,&1-23-,,03-2&
• !$%#4)5#-&.1&%)+7+&
• 830%$)*39)5#-&
• .,2$*)0&:0#;,<%=,$*,0&:0#"*,4&+#*/,0&>0)-7,?&
@A&*#<)**BC&
• D*?&<0)<74,+&E03%,0&)-?&+#*/,0&
Contents)
• What%is%ionCube?%
• Why%Protect?%
• How%does%it%work?%
• VM%Architecture%
• VM%Internals%
• ionCube%Loader%(SAMPLE)%
• Breaking%ionCube%%
– Extracting%RAW%DATA%
– Validating%RAW%DATA%
– Processing%RAW%DATA%
– Interpreting%the%Header%
– Interpreting%the%Extra%Header%
• Conclusion%
• Q%&%A%
F#%&G#/,0,?&
• .,<#/,03-2&%(,&*3<,-+,&H*,&&
• G0)<73-2&%(,&*3<,-+,&?,<0B:5#-&)*2#03%(4&
– I.J&*)E&
• I,<#4:3*)5#-&8J&K)-?*,0+&)-?&0,+%#03-2&
#0323-)*&LKL&+#$0<,&
– D$%&+<#:,&
M()%&3+&3#-G$",N&
• L)<7,0OG#4:0,++#0&
评论0