14-10-2010, 10:24 AM
السلام عليكم و رحمة الله
بالتوفق ان شاء الله
This is my last episode (the end of the adventure) with Prevx, no more time to devoted to this product.
Prevx uses "csidb.csi" to store user's preferences, I expected to see it after analysis, elaborate and better protected,
because it contains very important information, like user's password, Enabling or disabling specific option, controling self protection levels and others.
Unfortunately this was not the case.
Location: \%Documents and Settings%\%All Users%\%Application Data%\PrevxCSI\csidb.csi
Prevx.exe, at first time loads the configuration file in memory, and any actual and effective changes are in memory,
the file on the disk used to store changes to read at the next startup.
Prevx uses a very basic approach:
- Stores and checks a simple '01' or '00' value at constant offsets for her options.
Below X86 platform offsets, for X64 platform a small shift offsets positions.
SELF PROTECTION:
Offset: 000017BC
Minimum = 00
Medium = 02
Maximum = 01
USER'S PASSWORD:
Only MD5 hash for user's password without any additional encryption.
Eg. 8B1A9953C4611296A827ABF8C47804D7 = MD5(Hello)
Offset : 000031A0 (Stored MD5 hash user's password)
Offset : 0000319C (Enable/Disable password checks option)
Val = 00 : (Disable password check)
Val = 01 : (Enable password check)
OTHER OPTIONS:
Offset: 00003380 Enable/Disbale SafeOnLine. 01 = Disabled.
Offset: 00000B88 Enable/Disable "Right Click" Scanning in Windows Explorer. 00 = Disabled.
Offset: 000017DC Enable/Disable Automatically download and apply updates.
Offset: 000017A8 Enable/Disable Enhanced Rootkit Detection.
Offset: 00000B9C Enable/Disable Realtime Master Boot Record Scanning.
Offset: 0000323C Show the Authenticating files screen when a file being scanned.
Offset: 00000B98 Disable heuristics. 00 = Disbaled
Offset: 000017E4 Enable Scheduled Scans. 00 = Disbaled
How to modify Prevx options manually:
- Open "csidb.csi" with any HexEditor.
- Go to desired offset and change the option you want,
- Then restart your System for Prevx loads the file into memory with the new options.
Attachement:
PxPassCorrupter.exe - Corrupt any stored password.
PxPassLocker.exe - Lock config without any password.
PxPassRevealer.exe - Display MD5 hash for stored password.
PxPassUnLocker.exe - Unlock protected config password.
PxSafeOnLineDisabler.exe - Disable safe online.
PxSelfProtectionLimiter.exe - Set minimum level for self protection.
Readme.txt
IMPORTANT: Vulnerability published only for educational purposes.
Prevx uses "csidb.csi" to store user's preferences, I expected to see it after analysis, elaborate and better protected,
because it contains very important information, like user's password, Enabling or disabling specific option, controling self protection levels and others.
Unfortunately this was not the case.
Location: \%Documents and Settings%\%All Users%\%Application Data%\PrevxCSI\csidb.csi
Prevx.exe, at first time loads the configuration file in memory, and any actual and effective changes are in memory,
the file on the disk used to store changes to read at the next startup.
Prevx uses a very basic approach:
- Stores and checks a simple '01' or '00' value at constant offsets for her options.
Below X86 platform offsets, for X64 platform a small shift offsets positions.
SELF PROTECTION:
Offset: 000017BC
Minimum = 00
Medium = 02
Maximum = 01
USER'S PASSWORD:
Only MD5 hash for user's password without any additional encryption.
Eg. 8B1A9953C4611296A827ABF8C47804D7 = MD5(Hello)
Offset : 000031A0 (Stored MD5 hash user's password)
Offset : 0000319C (Enable/Disable password checks option)
Val = 00 : (Disable password check)
Val = 01 : (Enable password check)
OTHER OPTIONS:
Offset: 00003380 Enable/Disbale SafeOnLine. 01 = Disabled.
Offset: 00000B88 Enable/Disable "Right Click" Scanning in Windows Explorer. 00 = Disabled.
Offset: 000017DC Enable/Disable Automatically download and apply updates.
Offset: 000017A8 Enable/Disable Enhanced Rootkit Detection.
Offset: 00000B9C Enable/Disable Realtime Master Boot Record Scanning.
Offset: 0000323C Show the Authenticating files screen when a file being scanned.
Offset: 00000B98 Disable heuristics. 00 = Disbaled
Offset: 000017E4 Enable Scheduled Scans. 00 = Disbaled
How to modify Prevx options manually:
- Open "csidb.csi" with any HexEditor.
- Go to desired offset and change the option you want,
- Then restart your System for Prevx loads the file into memory with the new options.
Attachement:
PxPassCorrupter.exe - Corrupt any stored password.
PxPassLocker.exe - Lock config without any password.
PxPassRevealer.exe - Display MD5 hash for stored password.
PxPassUnLocker.exe - Unlock protected config password.
PxSafeOnLineDisabler.exe - Disable safe online.
PxSelfProtectionLimiter.exe - Set minimum level for self protection.
Readme.txt
IMPORTANT: Vulnerability published only for educational purposes.
بالتوفق ان شاء الله