Juya fasahar binary tare da cikakken rahoton bincike na PDF

A takaice

Farashi

Daga $124.99

Isarwa

An isar cikin kwanaki 3

Sayar

Sabo

Game da wannan jerin

Mayar da lambar da aka harhada zuwa rahoton da za a iya karantawa

Kuna da fayil ɗin da ake iya aiwatarwa, ɗakin karatu da aka raba ko hoton firmware ba tare da asalin lambar shirin da ke tare da shi ba kuma ba tare da takardu ba, kuma kuna buƙatar sanin yadda yake aiki da kuma ko za a iya amincewa da shi, tura shi ko kiyaye shi lafiya. Muna duba binary ɗin kuma muna dawo da tsarin rahoton PDF wanda ke bayyana abubuwan da aka gano a cikin harshe mai sauƙi maimakon ɗanyen disassembly.

Abin da rahoton ya ƙunsa

• Rahoton PDF mai shafuka 10 zuwa 30, ya danganta da sarƙaƙiyarsa
• Sake gina dabaru azaman pseudo-code da za a iya karantawa: ayyuka, tsarin bayanai, algorithms
• Cikakken taswirar ɗabi'a: wuraren shiga, tsarin aiwatarwa, kiran hanyar sadarwa, shiga tsarin fayil
• Gano matakan kariya: packing, obfuscation, anti-debug, anti-VM, ɓoye bayanan sirri
• Ƙimar haɗari da ke rufe ɗabi'a mai ban sha'awa, ɓoyayyun fasaloli da damuwar tsaro
• Jerin manuniya-na-lalacewa inda ya dace: adiresoshin IP, yankuna, hashes na fayil, maɓallan rajista
• Kiran tattaunawa na mintuna 30 na zaɓi don yin bayani kan abubuwan da aka gano

Yadda aikin ke ci gaba

Aikin yana gudana ne a matakai 4. A rana ta 0 za ku aika fayil ɗin tare da gajeriyar bayani kan manufarku, ko binciken ƙididdiga ne, farfadowa, duba tsaro ko aikin haɗin gwiwa. Ranaku 1 zuwa 2 sun ƙunshi binciken static analysis: warware binary, tsara tsarinsa, gano ɗakunan karatu da matakan kariya, da sake gina ainihin logic. Ranaku 2 zuwa 3 suna ƙara binciken dynamic analysis inda yake da aminci da amfani, gudanar da fayil ɗin a cikin keɓantaccen sandbox don lura da ainihin halayensa a duk faɗin hanyar sadarwa, fayil da ayyukan persistence. Isar da sakamako yana biyo baya a ranaku 3 zuwa 5, yana kawo rahoton PDF tare da gajeriyar imel ɗin taƙaitawa da ke lissafin muhimman bincike guda 5, tare da kiran tattaunawa idan kuna son ci gaba.

Kunshin Ayyuka

Kunshi | Farashi | Iyaka | Rahoto | Isarwa

Basic | $150 | Fayiloli har zuwa 10 MB, static analysis kaɗai | Shafuka 10-15, taƙaitaccen babban logic da ɗabi'a | Kwanakin aiki 3

Standard | $300 | Fayiloli har zuwa 50 MB, static da dynamic analysis a cikin sandbox | Shafuka 15-25, cikakken taswirar ɗabi'a, jerin IOC, binciken hanyoyin kariya | Kwanakin aiki 5

Premium | $500 | Kowane girman fayil, static tare da dynamic da network analysis | Shafuka 25-30+, cikakken sake gina pseudo-code na muhimman ayyuka, binciken tsarin hanyar sadarwa inda ya dace, gami da kiran tattaunawa | Kwanakin aiki 7

Ana samun ƙididdigar farashi na musamman don binary masu matuƙar ɓoye, cunkushe ko masu sassa da yawa.

Abin da muke buƙata daga gare ku

• Fayil ɗin da za a bincika, a tsare-tsare kamar .exe, .dll, .so, .bin, .elf ko kuma firmware dump
• Tabbacin cewa mallakarka ce ko kuma kana da izinin a bincika shi; muna aiki ne kawai a kan binaries ɗin da kake da haƙƙin doka na dubawa
• Taƙaitaccen bayanin manufarka: ɗan gajeren bayani a kan makasudin, ko binciken tsaro ne, dawo da tushen manhaja, aiki tare da wasu tsare-tsare, martani ga matsalar tsaro ko kuma bincike
• Yankin yanar gizo da aka yi wannan oda dominsa

Tushen Bayani

Aikinmu na reverse engineering yana dogaro ne a kan tarwatsa manhaja ta amfani da ingantattun kayan aiki, ciro bayanan ƙwaƙwalwa, buɗe fayiloli da cire ɓoyayyiyar hanyar sadarwa, tare da sake gina hanyoyin sadarwa na musamman, tsare-tsaren ɓoye bayanan sirri da dabarun gudanar da zama. An tabbatar da ingancin dabarun manhajar da aka sake ginawa tare da gwaje-gwaje ta hanyar atomatik sama da 800, kuma aikin ci gaba ya shafi Rust, Python da C/C++ tare da mai da hankali sosai a kan aiki da aminci. Mun taɓa sake gina manhajar tafi-da-gidanka gaba ɗaya daga farko har ƙarshe, tun daga ɓoyayyun bayanan sirri har zuwa ingantattun dabarun kasuwanci masu aiki da aka tabbatar da su a kan ainihin sabis ɗin da ke aiki, kuma muna nuna irin wannan kulawa ga kowane fayil da aka duba.

Abin da ya sa wannan ya bambanta

• Kowane sakamako a cikin rahoton yana samun goyon bayan shaida: adireshi, aiki (function) ko kuma packet
• Sakamakon aiki ya fi ba da fifiko ga pseudo-code da harshe mai sauƙin fahimta maimakon zubar da ɗanyen disassembly
• Rahotanni suna ƙarewa ne da ƙwaƙƙwaran shawarwari maimakon kawai lura da aka yi
• Ana sarrafa fayiloli a cikin keɓantaccen yanayi, ana goge su bayan an gama bayarwa, kuma ba a taɓa raba su da kowa

Faɗi da iyakoki

Muna bincika fayilolin da kuka mallaka ne kawai ko waɗanda kuke da izinin doka don dubawa, kuma ba ma fasa manhaja, tsallake lasisi ko taimakawa wajen kauce wa kariya don amfani mara izini ba. Ana sarrafa samfuran malware ne kawai a cikin keɓantaccen sandbox, ba a taɓa yin hakan a na'urar aiki ta kai tsaye ba. Ana iya samun NDA idan an buƙata. Aika fayil ɗin da bayanin buƙatarku don farawa, kuma za a tabbatar da yiwuwar aiki da lokacin kammalawa a cikin sa'o'i 24.

Tambayoyi da amsoshi