Directions

Hi,

In this little post I want to expose, what should be my future works and topics in which I’ll invest my efforst.

Actually I’m developing a Device Driver Fuzzer for Windows 2k, XP, 2k3.

This DeviceDriver Fuzzer that I’ll call Klystron, is similar to Kartoffel Driver Fuzzer, but it has a GUI based on MFC with the possibility to Mantain Trace of the used IOCTLs by hooking DeviceIoControl().

Particular attention will be revolved to IOCTLs with METHOD_NEITHER, this because the major part of device drivers Bugs come from this kind of ControlCodes that does not performs any check on the received buffer. It’s easy to decode what IOCTL use this method, due to the base encoding algorithm we can see that

0x00000003

0x00000007

0x0000000B

0x0000000F

All catched IOCTLs will be saved and next, parsed and loaded into a ListBox that will be the launcher for the Fuzz part.

The fuzz engine will be essentially based over Kartoffel, but I did not exclude that I’ll insert other fuzz options.

With Klystron its all..

In the next month I’ll be also studing, How the Presence of a Rootkits Could Affect Performance Graphics and if good results come out I’ll publish a little paper about that.

Another target will be a study paper + src code of NtSectionDebug() undocumented function

Surely I’ll also write some new Malware Reversing story, actually I’m working on Silent Banker Trojan which is a really intersting subject for a Rce Paper 😉

Frozen (not Dead) projects are:

MultiCryptoProtector

MultiStegoProtector

StegoDetector

I’ve also in plain to Translate my Elgamal Paper, and in the end of year to write A Reverse Engineering Approach to AES.

In this period I’m also a bit bored of people (cause a ligth touch of Socio-Delusion-Depression) and pointless discussions all over the so called New Internet, or better known Web 2.0, so I’ll limit at the maximum my presence on IRC/MSN and Skype.

My sopportation level is over also about Vulgarity and Obscenity that every day I’ve to hear, one of the great things of internet is the Liberty Real, or for less experienced persons, Apparent..

And for liberty I talk about the possibility to choise, the ambient that make you feel more Relaxed and Serene..and the massive vulgarity, arrogance and egoism with heavy touches of egocentrism, make me feel not so Clear not so Serene.

Surely I’m sociopatic, but now STOP, I want to exist on internet but without hearing 24/24 people that thinks to be God and talks as a porky-pig.

Some channels seems to know who you are, only when you have something to give to the others, but in other hands people is truly attentive to disclose you Resources, Sources or Links (links in all acceptions of the term).

Its really frustrating to see that, and to se how people what (implicitly) you to know that you’re not a part of a Group..

So I think the best cure for my 0Tollerance of people is to disappear a bit from all “Chat” Scenes..

See you to the next post..

Evilcry