Форум АНТИЧАТ - Blue Pill Project

Форум АНТИЧАТ (https://forum.antichat.xyz/index.php)

- Forum for discussion of ANTICHAT (https://forum.antichat.xyz/forumdisplay.php?f=72)

- - Blue Pill Project (https://forum.antichat.xyz/showthread.php?t=45980)

Blue Pill Project

// Intro

Код:

The original Blue Pill proof of concept code has been written by Joanna Rutkowska, while working for COSEINC, and presented at the Black Hat Briefings 2006 in Las Vegas on August 3rd. Joanna Rutkowska then formed a small team of researchers inside COSEINC, Advanced Malware Labs, which was supposed to focus on further research into virtualization based malware. However after just a few months the priorities of work have been shifted, resulting in Blue Pill research activities being ceased.



In April 2007 Joanna Rutkowska decided to quit COSEINC and start her own security consulting firm, Invisible Things Lab. In May 2007 Alexander Tereshkin, a former member of COSEINC AML, joined ITL as a principal researcher. Joanna Rutkowska and Alexander Tereshkin decided to redesign and write from scratch the New Blue Pill rootkit, so that it would be possible to use it for further research and for educational purposes. Most of the New Blue Pill’s code was developed by Alexander Tereshkin.



The New Blue Pill is significantly different from the original Blue Pill, not only because of the various features that it implements, but also because of the different architecture it was based on (HVM-like approach, similar to that used by XEN 3).

// Currently implemented features

Цитата:

* Common HVM layer architecture to support SVM and VT-x
* On the fly loading and unloading
* RDTSC cheating via tracing (simple version)
* Avoiding trusted time source attacks using Blue Chicken Technology
* NBP uses its own private Page Tables (Private CR3)
* Support for nested hypervisors (NBP inside NBP inside NBP...)

// Current limitations

Цитата:

* No support for VT-x (HVM implements only SVM specific functions)
* RDTSC cheating uses a very simple (too simple) cycle emulation
* Blue Chicken TimeBomb setting algorithm seems to contain a mysterious race condition that causes a BSoD from time to time after the timeboms is set
* Virtual PC 2007 (with enabled h/w virtualization) currently crashes when run inside a blue pilled machine
* BP knock feature might casue a crash in a nested scenerio due to CPUID interception.
* No support for "exotic" CPU modes
* No support for intercepting "exotic" high-precision local timers

// Disclaimer

Цитата:

/* * Copyright holder: Invisible Things Lab * * This software is protected by domestic and International * copyright laws. Any use (including publishing and * distribution) of this software requires a valid license * from the copyright holder. * * This software is provided for the educational use only * during the Black Hat training. This software should not * be used on production systems. * */

// Downloads
* nbp-0.11.zip (2007-08-01)
* svm-detectors-0.1.zip (2007-08-01)
* IsGameOver.ppt (2007-08-01)

Цитата:

Оригинальный код PoC "Blue Pill Project" был написан Джаной Рутковской во время работы на COSEINC и был представлен на собрании Black Hats 2006 в Лас-Вегасе 3 августа. Джоана создала небольшой коллектив внутри COSEINC - Advanced Malware Labs, разработки которого были направлены на "виртуализированные" malware (O_O).
Однако, после пары месяцев работы над проектом, их интересы поменялись и проект был закрыт.

В апреле 2007 Джоана решила покинуть COSEINC и создать её собственную новую фирму - Invisible Things Lab. В Мае 2007 Александр Терешкин, в прошлом член COSEINC AML, присоединился к ITL в роли главного исследователя. Джоана и Александр решили вместе сделать новый Blue Pill руткит, для последующих исследований и использования его в целях образования. Большая часть кода нового Blue Pill была написана Александром Терешкиным.

Новый Blue Pill отличался от своего предшественника не только набором функций, но и базовой архитектурой (HVM подобный, система схожа с той, что используется в XEN 3).

Остальное имхо не имеет смысла переводить, вам поможет translate.ru и словарь.

зы уже перенесли в анг раздел =\ рука не поднимаеца удалить :D