Slashdot Mirror

This is not the first book about IDA Pro. However, this is the first book I recommend to anyone using IDA Pro because of the following points: * Comprehensive: it describes all major IDA features by starting at the beginning and going all the way to the end. Experienced users may be tempted to skip the first few chapters; resist this temptation and you will discover something new (I did :) * Accurate: it is very difficult to be detailed and precise when describing such a complex product. Chris does it excellently well. * Real: handles real world malware, packers, and obfuscated code * No fillers: it is direct and concise * Profound: this is not just a collection of recipes or tricks, but will give you a better understanding of the IDA architecture, thus saving you from unnecessary frustration. Knowing the limitations of your tool is just as important as knowing its capabilities. It comes tons of code snippets, scripts, and sample modules. Programming for IDA Pro is covered too: from simple plugins to processor modules. http://hexblog.com/2008/08/the_ida_pro_book_1.html ----This is not my blog.

>Have you ever SEEN decompiled code?

Yes.

>It is assembly language, for one thing.

That would make it disassembled code, decompiled typically implies a higher level abstraction/language.

For me, that length==1 trigger is the most convincing evidence.

I don't recall if he mentioned that he was making the actual code available but since it follows the basic idea behind Ilfak's vulnerability test http://www.hexblog.com/index.html. You could probably dig up more information from that point.

But still released many days after independent programmers (e.g. Ilfak Guilfanov) managed to build a fix. At work (a national lab), we were explicitly instructed not to wait for the early windows patch.

I have witnessed first hand how Guilfanov's unofficial patch will break some legaccy apps. The one in question was a 16-bit app (based on Access 2.0). After applying the patch, it was impossible to print some forms (we received an error). Sure, we uninstalled the patch and printing was OK again.

So therefore the interesting thing about the upcoming Microsoft patch is, how are they going to patch the hole without breaking the legitimate uses of the affected gdi functions???

Here's a tool that allows you to check whether you're (still) vulnerable or not.

The source code is now online, too.

I ran the test util on my Win98 box (http://www.hexblog.com/security/files/wmf_checker _hexblog.exe small download)

It said -- Not Vulnerable.

The referring page (which I can't find again offhand but is one of the links from GRC) said not to take it as gospel, since it only tests for one of several possible entry points, but it's better than nothing.

The fix is from Ilfak Guilfanov.

To quote F-Secure (http://www.f-secure.com/weblog/archives/archive-1 22005.html#00000756):

"Now, we wouldn't normally blog about a security patch that is not coming from the original vendor. But Ilfak Guilfanov isn't just anybody. He's the main author of IDA (Interactive Disassembler Pro) and is arguably one of the best low-level Windows experts in the world.

More details from Ilfak's blog: http://www.hexblog.com./"

The guy is legit.

The fix can be applied in the automatic mode using the following command line:

wmffix_hexblog13.exe /VERYSILENT /SUPPRESSMSGBOXES

These switches do not suppress dialog boxes about installation errors.
The /LOG="file" switch can be added to the command line to create a log file.


[from http://www.hexblog.com/2005/12/wmf_vuln.html ]

There's a MSI version in the works as well.

I wouldn't call what they are offering as trusted computing. They are not the manufacturers of the OS, so whatever they are offering is NOT trusted computing.

"Trustworthy" was here used only as a saying. As in "Please, trust us". Please read the ISC diary entry.

Since it's a typical binary patch you have to trust them that this patch won't hose your system or make you pwned by these or other folks.

The patch is distributed by Ilfak Guilfanov, who develops the IDA Pro Disassembler and Debugger. The WMF fix installation package includes source code for the DLL it installs.

Look, when I want to upgrade my box, I just do a apt-get update; followed by either apt-get dist-upgrade or use synaptic. I know my sources (I select them myself), I know that the reality checks exist (gpg keys, outside sources verifying the software, etc.). I know I'm not getting hosed when I install software from my usual Debian repositories.

Sure, you use apt-update when your os vendor has relased a fix. But what do you do when no official fix is yet unavailable, as the situation is now for Windows users?

Here.

I have posted fixes that have been reviewed by SANS (The Intenet Storm Center) at www.HelpProtectMyComputer.com\WMFflaw.html.

I did not develop the fix, Ilfak Guilfanov did, and I found it on Steve Gibson's site.

Please forward the information to as many people as possible to protect their computers and to limit the damage. Thanks. Steve (Smokeydog)

Get a patch here: http://www.hexblog.com/2005/12/wmf_vuln.html

All the necessary information and explanation (plus q/a) is here. This is the only hope at present. Good luck to everyone on Jan 2 when this thing takes over the world.

That's about as helpful as advising tsunami victims that they move.

For those who want actual advice: http://www.hexblog.com/ -- a fix which creates a hook to disable the affected code. The fix has been analyzed by Steve Gibson.

There seems to be a first fix.

There is now a "Windows WMF Metafile Vulnerability HotFix" available from Ilfak Guilfanov. Have a look here http://www.hexblog.com/2005/12/wmf_vuln.html

The problem - and the fix - has been discussed also at GRC.com's Security Now podcast. Check out this link http://www.grc.com/sn/notes-020.htm

It's unofficial, but it works.

http://www.hexblog.com/2005/12/wmf_vuln.html

Caveat emptor ... I have not tried this - Windows WMF Metafile Vulnerability HotFix.

After some hours looking at WMF file format I developed a fix for it:

http://www.hexblog.com/

My fix works for Windows XP systems. I have tested it on my machines.