Dedication
Dr. Cyrus Peikari is humbled before Bah'u'llh,the Glory of God. He also thanks his students, teachers, and fellowseekers of knowledge. Dr. Peikari is also grateful to his family fortheir support and encouragement.
Dr. Cyrus Peikari
The part of the book for which I am responsible is dedicated toOlga, who put up with me during all those evenings I spent working onthe book and who actually encouraged me to write when I was gettinglazy.
Dr. Anton Chuvakin
[]
[]
[See ARM][See forensics countermeasures]attacks[See hiding][See honeypots honeynets][See reconnaissance][See social engineering][See SQL injection attacks][See Unix attacks][See WEP][See log analysis]
[]
BIND (Berkeley Internet Name Domain)
[]
[See CMP][See forensics]
[]
[See SQL injection attacks][See also gdb; ptrace]disassembly
[]
[See also Windows CE][See ELF]
[]
firewallsfunctions
[]
[See ptrace]
[]
hard drives
[]
[See incident response framework][See TCP/IP][See IDSs]
[]
[]
[]
Linux[See gdb ptrace][See ELF]logfileslogging
[]
Microsoft[See SOAP][See MOV]
[]
[]
[See also SSH][See OS fingerprinting][See buffer overflows]
[]
packetspassword crackersprocessors[See ARM]programming languages
[]
[]
[See Windows CE][See serial.exe, reverse engineering][See Windows CE][See databases][See RCE]RPC
[]
SANSsecurity[See also serial.exe, reverse engineering][See also Windows CE]commandssoftware developmentsyslog[See also logfiles][See also logfiles, sanitizing]
[]
[]
[See TCT]
[]
UDP[See Unix attacks][See also logfiles]
[]
[]
Windowsreverse code engineering[See SOAP]disassembling programs[See MVC][See ARM][See serial.exe, reverse engineering][See also Kerberos protocol][See WEP]
[]
x86 processor[See Xenc]
[]
[]
|
Reviews |
Reader Reviews |
Errata |
Academic |
Security Warrior |
By Anton Chuvakin, Cyrus Peikari |
Publisher | : O'Reilly |
Pub Date | : January 2004 |
ISBN | : 0-596-00545-8 |
Pages | : 552 |
What's the worst an attacker can do to you? You'd betterfind out, right? That's what SecurityWarrior teaches you. Based on the principle thatthe only way to defend yourself is to understand yourattacker in depth, Security Warrior reveals how your systems can be attacked. Coveringeverything from reverse engineering to SQL attacks, andincluding topics like social engineering, antiforensics, andcommon attacks against UNIX and Windows systems, this bookteaches you to know your enemy and how to be prepared to dobattle.
A.1 SoftICE Commands
Table A-1. Basic SoftICE commands
Command | Meaning |
---|
? | Evaluate expression |
A | Assemble code |
ADDR | Display/change address contents |
BC | Clear breakpoint |
BD | Disable breakpoint |
BE | Enable breakpoint |
BL | List current breakpoints |
BPE | Edit breakpoint |
BPT | Use breakpoint as a template |
BPM, BPMB, BPMW, BPMD | Breakpoint on memory access |
BPR | Breakpoint on memory range |
BPIO | Breakpoint on I/O port access |
BPINT | Breakpoint on interrupt |
BPX | Breakpoint on execution |
BPMSG | Breakpoint on Windows message |
C | Compare two data blocks |
CLASS | Display window class information |
D, DB, DW, DD, DS, DL, DT | Display memory |
DATA | Change data window |
E, EB, EW, ED, EL, ET | Edit memory |
EXIT | Exit |
F | Fill memory with data |
FORMAT | Change format of data window |
G | Go to address |
H | Help on specific function |
HBOOT | System boot (total reset) |
HERE | Go to current cursor line |
HWND | Display Windows handle information |
M | Move data |
MOD | Display Windows module list |
P | Step-skipping calls, interrupts, etc. |
R | Display/change register contents |
S | Search for data |
T | Single-step one instruction |
TASK | Display Windows task list |
THREAD | Display thread information |
U | Un-Assemblers instructions |
VER | SoftICE Version |
WATCH | Add watch |
WHAT | Identify the type of expression |
WMSG | Display Windows messages |
X | Return to host debugger or program |
Table A-2. Advanced SoftICE commands
Command | Meaning |
---|
CPU | Display CPU register information |
GDT | Display global descriptor table |
GENINT | Generate an interrupt |
HEAP | Display Windows global heap |
LHEAP | Display Windows local heap |
IDT | Display interrupt descriptor table |
I, IB, IW, ID | Input data from I/O port |
LDT | Display local descriptor table |
MAP32 | Display 32-bit section map |
MAPV86 | Display v86 memory map |
O, OB, OW, OD | Output data from I/O port |
PAGE | Display page table information |
PCI | Display PCI device information |
PEEK | Read from physical address |
PHYS | Display all virtual addresses for physical address |
POKE | Write to physical address |
PROC | Display process information |
QUERY | Display process virtual address space map |
TSS | Display task state segment |
STACK | Display call stack |
VCALL | Display VxD calls |
VM | Display virtual machine information |
VXD | Display Windows VxD map |
XFRAME | Display active exception frames |
Table A-3. Mode control