Skip to next slide
You can skip to the next slide in
3
Ad
Skip to next slide
You can skip to the next slide in
3
Ad
Skip to next slide
You can skip to the next slide in
3
Ad
Skip to next slide
You can skip to the next slide in
3
Ad
Skip to next slide
You can skip to the next slide in
3
Ad
Skip to next slide
You can skip to the next slide in
3
Ad
Skip to next slide
You can skip to the next slide in
3
Ad
Skip to next slide
You can skip to the next slide in
3
Ad
Skip to next slide
You can skip to the next slide in
3
Ad
Skip to next slide
You can skip to the next slide in
3
Ad
Skip to next slide
You can skip to the next slide in
3
Ad
×
Your browser does not support the video tag.
Skip to next slide
Ad
×
Share Slideshare
LinkedIn
Facebook
Twitter
Embed
Size (px)
Show related Slideshows at end
WordPress Shortcode
Link
Share
Email
2007년 6월 악성코드 최신 동향과 대응
by Youngjun Chang
1405 views
恶性代码的最新动向和手法
by Youngjun Chang
850 views
3.ahn report를 이용한 악성코드 대응
by Youngjun Chang
2644 views
2. 악성코드 분석 방법론과 기법
by Youngjun Chang
1895 views
1. 악성코드 진단 기법 개론
by Youngjun Chang
1967 views
3. 악성코드 분석 사례
by Youngjun Chang
1470 views
View on Slideshare
1
of
33
Ad
View on Slideshare
1
of
33
Ad
![11
4. 进程分析
Process Explorer – 分析系统上生成的进程变化
TaskInfo – 分析进程变化以及系统状态
[Process Explorer] [TaskInfo]
2. 恶性代码的分析Utility(4/10)](https://image.slidesharecdn.com/2cn1225anboshi-130619034642-phpapp02/75/-11-2048.jpg?cb=1670202205)
![12
5. Registry (Registry)分析
Registar Lite – Registry 分析以及编辑
Reg.exe – DOS模式Registry 编辑程序
[Reg.exe][Registar Lite]
2. 恶性代码的...](https://image.slidesharecdn.com/2cn1225anboshi-130619034642-phpapp02/75/-12-2048.jpg?cb=1670202205)
![13
6. 网络packet分析
Ethereal –网络packet分析
Analyzer –网络packet分析
[Ethereal] [Analyzer]
2. 恶性代码的分析Utility(6/10)](https://image.slidesharecdn.com/2cn1225anboshi-130619034642-phpapp02/75/-13-2048.jpg?cb=1670202205)
![14
7. 网络端口分析
TCPView – 实时网络端口分析
Active Ports – 实时网络端口分析
Fport – DOS模式网络端口分析
[TCPView] [Active ports]
2. 恶性代码的分析Utility(7/1...](https://image.slidesharecdn.com/2cn1225anboshi-130619034642-phpapp02/75/-14-2048.jpg?cb=1670202205)
![15
10. 系统监控
FileMon – 特定进程的文件访问(access)
RegMon – 特定进程的Registry 访问
TDIMon – 特定进程的网络访问
API Monitor – 特定进程的API使用
[FileMon执行] ...](https://image.slidesharecdn.com/2cn1225anboshi-130619034642-phpapp02/75/-15-2048.jpg?cb=1670202205)
![16
12. 执行文件的分解(disassembling)
W32Dasm – 执行文件的分解和调试(debuging)
IDA – 执行文件的分解
[W32Dasm执行]
[IDA执行]
2. 恶性代码的分析Utility(9/10)](https://image.slidesharecdn.com/2cn1225anboshi-130619034642-phpapp02/75/-16-2048.jpg?cb=1670202205)
![17
13. 执行文件的调试
WinDBG – 执行文件的调试器
SoftIce – 强有力的内核模式调试器
OllyDbg – 泛用执行文件的调试器
[OllyDbg执行] [SoftICE执行]
2. 恶性代码的分析Utility(10/1...](https://image.slidesharecdn.com/2cn1225anboshi-130619034642-phpapp02/75/-17-2048.jpg?cb=1670202205)
