BHUSA09-Metula-ManagedCodeRootkits-PAPER英文版本.pdfVIP

.NET Framework Rootkits: Backdoors inside your Framework March, 2009 (Revised) Erez Metula ErezMetula@2bsecure.co.il ErezMetula@ 1 .NET Framework Rootkits – Backdoors Inside Your Framework Table of content TABLE OF CONTENT 2 ABSTRACT 3 INTRODUCTION 4 HOW CAN THE FRAMEWORK BE CHANGED?4 MODIFYING THE FRAMEWORK CORE 6 OVERVIEW - STEPS TOOLS FOR CHANGING THE FRAMEWORK 6 LOCATE THE DLL IN THE GAC 6 ANALYZE THE DLL7 DECOMPILE THE DLL USING