So Cool (PL) 19 th Kang, Sung won 19 th Park, Jong min 19 th Park Gui mong.

Protector of My Digital Contents

So Cool(PL) 19th Kang, Sung won

19th Park, Jong min19th Park Gui mong

Agenda

1. Project Motive

2. Goal3. Architecture4. Detail5. Development Environment6. Division of Work7. Project Schedule8. Q & A

Protector of My Digital Contents Busan Samsung Software Membership

Project Motive

Protector

Prevent Illegal Copy & Use

Unlimited

File Format

(Limited Period)

Regular Players

Entire Architecture

LicensePolicy

Contents

ProviderApplicatio

Web Server

WindowsDriver

ActiveX

LicensePolicy

Contents

WindowsDriver

WebServer Address

Connect(Using WebBrower)

Using ActiveX ( Automatically install Driver &

License )

Contents Transmit

Provider Architecture

ProviderApplicatio

nAdd File

Save String[]

License Setup to File

CAB File Auto Make

Add to Web Server& Running

DownLoader ArchitectureProvider User

Add File

ProviderApplicatio

WebServer DownFile

INCLUDE

WebServer DownFile

DownlaoderFile Down

System Architecture (File System Filter Driver)

Application

I/O Manager

File System Filter

File System

User Level

Kernel Level

FilterManage

System Mini Filter Driver

NetworkMini FilterDriver

Detail (SSDT Hooking)

System Service Dispatch Table

Keeper (Self Defender)

SystemService

Dispather

SystemService

Detail (Process Hide)

Keeper Driver (Self De-fender)

SystemInformationClass

SystemInformation

ReturnLength

SystemInformation-Length

NewZwQuerySystemInforma-tion

Process information

Detail (File Hide)

Keeper Driver (Self De-fender)

hEvent

IoApcContext

FileInfoClass

NewZwQueryDirectoryFile Hide File & Folder inform

Detail (Active X)

.inf File Make

.CAB File Make

Detail (Active X)

Detail (Anti-Reversing)

Anti-Reversing Techniques

Anti-Analysis

BreakPoint Detection

Garbage Code

Anti-Disassembly

Example Code

Anti-Disassembly

Result

Will jump to the wrong memory address.

Garbage Code

Result

Complex code

Detail (Anti-Capture)

Anti-Capture

Empty clipboard

Native Api Hooking

Dll Injection

Ctrl + C, PrintScreen Key to prevent use

BitBlt() Hooking

NtGdiBitBlt() HookingUser

Anti-Capture

Detail (Anti-Capture)

Anti-Capture

Native Api Hooking

NtGdiBitBlt Funtion Hooking

Win32k.sys SystemServiceDescriptorShadowTable Hook-ing

Detail (Device Driver Loader)

Device Driver Loader

Service Control Manager (SCM)

InstallHinfSection

Program Install

Registry Protection

RUNDLL32.EXE SETUPAPI.DLL,InstallHinfSection DefaultInstall 132 Driver.inf

Development Environment

OS : Windows Window XP SP3

IDE : Microsoft Visual Studio 2008 / 6.0

Windows Device Kit 7600.16385.0

Debug Tool : OllyDBG, WinDbg, DbgView

Virtual Machine : VMWare Workstation 6.0

Language : C#, C, C++, Assambly

Division of Work

Kang,Sung won

Provider Application (Protector) - Digital Contents File Management - License Policy - WebSever & WebPage - ActiveX (Automatically install Driver & License)

Anti-Reversing - Garbage Code - Anti-Disassembly - Breakpoint Detection Anti Capture

Park,Jong min

Park,Gui mong

Keeper (Windows Driver) Mini Filter Driver - System Filter Driver - Network Filter Driver Driver Loader

Project Schedule

TASK 08 09 10

1 2 3 4 5 6 7 8 9 10 11 12

Protector

Contents File Manage-ment

License Policy

Web Server & Page

ActiveX (Auto Install)

AntiRevers-

Garbage Code

Anti-Disassembly

Breakpoint Detection

Keeper

Anti Capture

System Filter Driver

Network Filter Driver

Driver Connection Process

Driver Loader

Keeper Driver

Anti-SSDTHooking

Unify Test & Debugging Kang, Sung won

Park, Jong min

Park, Gui mong

Question & Answer

Thank you

So Cool (PL) 19 th Kang, Sung won 19 th Park, Jong min 19 th Park Gui mong.

Documents

Transcript of So Cool (PL) 19 th Kang, Sung won 19 th Park, Jong min 19 th Park Gui mong.

19 th Century England

Back-to-School Night 2013-2014 College Park Elementary Mrs. Lien 4 th/ 5 th Grade College Park Elementary Mrs. Lien 4 th/ 5 th Grade.

Jan 19 th -20 th Winter Event

Market Visit October 19 th & 20 th 2011

19 th Century Railroads

LAKE UNION PARK WEEKLY UPDATE February 8 th – February 15 … · 2015-12-24 · LAKE UNION PARK WEEKLY UPDATE February 8 th – February 15 th, 2009 Forecasting February 16 th –

Project Update Goat Island Park Ph. 2 Town of Cramerton December 19 th, 2013.

Democratic Trends of the Early 19 th CenturyDemocratic Trends of the Early 19 th CenturyDemocratic Trends of the Early 19 th CenturyDemocratic Trends.

19 th Amendment

Wild Park! Opening June 25 th 2014. Welcome to Wild Park! oAs of June 25 th 20114, the brand new, spectacular Wild Park amusement will be open! oEnjoy.

November 18 th and 19 th

19 North Park

9 th International Conference on Intelligent System for Molecular Biology Tivoli Gardens, Copenhagen, Denmark July 19-26, 2001 Park, Ji-Yoon.

19 th Century Victorian Furniture 1830-1901 19 th Century 1J. Byrne 2015.

th 17 - 19

SPRINSPRING PARK BIRTHDAY DRINKS “SNOWED OFF”G PARK ... 0217.pdf · 19 th January – Showreel from Market Harborough Movie Makers Market Harborough in Leicestershire is the location

19 th century Russia

Rookesbury Park Monday 16 th June 2014 – Friday 20 th June 2014.

Oak Park Parade July 4 th , 2011

Furniture Design Influences: 18 th Century Europe Early 19 th Century Europe Early 19 th Century North America Mid 19 th Century Anglo-American Late 19.