BlackHat Las Vegas Briefing 2008
Windows
In November 2007, Nicolas and I presented “Enter SandMan” in Tokyo at PacSec during its development phase. You can get the materials we used for this lecture here in English and here in Japanese.
Some months later, an alpha version formally called 1.0.080226, of Sandman Framework has been released as an open source project. — you can find the current version here. Please consider, as Volatility Team has kindly reminded SandMan is a GPL3 project then don’t imitate Vendor “X” which don’t even waited a final version of SandMan to violate the GPL and then implemented a bugged version into his commercial products :).
Furthermore, in March Cedric presented and commented the SandMan proof of concept video during lightning talks at CanSecWest 2008 in Vancouver.
Anyway, at the upcoming Black Hat Vegas 2008, I’m going to give a talk entitled “Windows hibernation file for fun and profit“. This talk aims to discuss about both forensics and offensics uses through the hibernation file (hiberfil.sys) with SandMan.
For your information, Alex is also giving a talk at BH called “Of Pointers and Handles A Story of Unchecked Assumptions in the Windows Kernel”.
You can take a look at the full schedule here.
X-Files. Episode 2. *Squeeze*
Articles, Law, SandManAs said previously, it’s really easy to find proof of plagiarism when an open-source tool is released and whan this source is reimplemented into a commercial software without compliance. Andreas published a new article called The implementation by Vendor “S”. In this article, he has explained what are the differences between the implementation of XpressDecode in SandMan and the Microsoft OS Loader’s one.
X-Files. Episode 1. *Deep throat*
Articles, Forensics, LawAndreas, recently published an interesting article called “The 3 Vendors”. This article is talking about GPL rights violation against researchers who share their knowledge. And also demonstrate, how this kind of violation can be easily identified through code flowchart. It sounds like the beginning of a series…
Google Summer of Code & NT debugging Puzzler #3
WindowsAs you probably know, Google launch every year the Summer of Code. Yesterday, Google published official 2008 result and I’ll be part of the Samba Team. My work is to implement compression functions into Samba.
Microsoft Advanced Windows Debugging Team published their third puzzler: Matrix Edition #3 . It looks they’ll publish one puzzler per week. As far I understand, the goal of this puzzler is to translate a function from Assembly to C.
Here is my solution:
-
void myfun(char *string)
-
{
-
int lenString, countLoop, index;
-
char savedByte;
-
lenString = strlen(string);
-
for (countLoop = lenString; countLoop; countLoop–)
-
{
-
for(index = 0; index < (countLoop - 1); index++)
-
{
-
if (string[index] > string[index + 1])
-
{
-
savedByte = string[index];
-
string[index] = string[index + 1];
-
string[index + 1] = savedByte;
-
}
-
}
-
}
-
}
Samba eXPerience conference - Germany
Blogging, Law, Presentations, Programming
8.00 PM (yeah it’s late)
I had almost 7 hours of time travel in Train from Paris to Goettigen. It was really exhausting but it was a good opportunity to talk with pretty girls visiting Europa :)
This year, SambaXP conference hold in Freizeit Hotel (Free time in English) in Goettingen (Germany) from 14th to 18th April.
During the dinner, I met Samba Team, OpenChange Team and sponsors people.
I had a really interesting discussion with the folks of Samba about Protocol Freedom Information Foundation (PFIF).
My main question was : What’s the difference between semi-private documentation provided by PFIF since December 2007 and public documentation provided by MSDN since March?
Technically, the content is the same. But if you look the law part PFIF grants extra patents protections.
For instance, if someone uses PFIF docs then Microsoft has a limited number of patents they can assert against the developer but if he uses MSDN docs then he doesn’t have patent protection.
I strongly recommend you to read links I posted above. That’s really an impressive work they did since 1992.
Weather in Germany is cold! I even wonder if it’s colder than North France one.
During the dinner, I had the occasion to meet Tom Hanrahan from Port 25 (MSFT) who works as Director of Linux Interoperability.
I’d like to share an interesting reference from Dan to a speech of Eben Moglen about “The Global Software Industry in Transformation: After GPLv3″. (Audio, Txt).
Andrew Tridgell (Samba Team), Samba and the PFIF renamed Samba and Microsoft to focus on new relationship between Samba and Microsoft engineers.
Andrew gave a quick review of the relationship with Microsoft timeline from early 90’s to now including the antitrust action in Europe during (99 - 07), WSPP/PFIF agreement (late 2007) to actual open cooperation publicly release of documentation MSDN (MSFT interoperability initiative).
PFIF (Protocol Freedom information foundation) has been introduced. For people who never heard about PFIF, it’s a legal entity that allows free software projects to take advantage of the WSPP protocol program. It makes protocol documentation available under a NDA but compatible with GPL. With an additional guarantees provided for at least 5 years of updates and corrections. Andrew also talked about the recent errors discovered in the documentation and the fact that Microsoft is now close to developers to fix it.
As you probably know, WSPP and MCPP documents are now public under a liberal license. It means Samba can now build an open community for cooperation on protocol knowledge. All previous secret on WSPP/PFIF is finished because the documentation is now available to everyone. PFIF also provides some additional guarantees on documentation updates and corrections.
As Andrew said, it means a good technical cooperation because lawyers are now sidelined and engineers have taken over. He also mentioned there is now a public forum for protocol discussion where PFIF members and MS Engineers can talk.
Tridge also highlighted two notable events for 2008:
- Samba’ll be participing file system plugfest at Microsoft in June.
- Microsoft will actively participate in the CIFS plugfest in August.
Julien Kerihuel (OpenChange): When OpenChange assimilates the Borg
OpenChange is 5 years old project build over Samba 4 infrastructure, two members of Openchange belong to Samba Team. Julien mostly talks about the libmapi client implementation This library provides an interface for NSPI & EMSMDB protocol.
*Party!*
This day is composed of three simultaneous room for three simultaneous talks.
There is a presentation I really appreciated, entitled Samba Encryption by Jeremy Allison (Google & Samba Team). The talk was about SMB protocol internal and some programming stuff.