TL; DR
Amaphakheji angamashumi amabili e-npm ashicilelwe ezinsukwini ezimbili ngasekupheleni kukaJulayi nasekuqaleni kuka-Agasti 2026 azethula njengamalabhulali ezingxenye ze-UI zangaphakathi kanye nezinsizakusebenza ezabiwe ze-backend. Azikho kuzo ezisebenzisa ukusebenza ezikukhangisayo. Ngayinye ithumela ikilasi le-stub, i-README echaza iphakheji njengeyangaphakathi, kanye nefayela elibizwa ngokuthi _polyfill.js.
Ingxenye ethokozisayo yilapho lelo fayela libizwa khona. Akuyona i-hook yokufaka — ama-manifest amemezela ukuthi akukho ukufakwa kwangaphambili, ukufakwa, noma ukufakwa ngemuva nhlobo. Esikhundleni salokho, umugqa wokugcina we index.js ufunda: try { require("./_polyfill"); } catch (_) {}. Umthwalo wokukhokha usebenza okokuqala lapho ikhodi yesicelo ingenisa iphakheji. Ukufaka nge --ignore-scripts, lo standard iseluleko sokunciphisa ukuvezwa kwe-supply-chain ngesikhathi sokufakwa, akukuvimbeli.
Ini _polyfill.js i-does iwukuthola i-executable ethile yeplatifomu kusuka komunye wemisebenzi emithathu ye-Cloudflare Workers, iyibhalele kufolda yesikhashana ngaphansi kwegama elingahleliwe, iyimake njenge-executable, bese iyiqalisa ihlukanisiwe nenqubo yomzali. Leyo executable ngokwayo iyisilayishi: ibala imikhiqizo yokuphepha kwe-endpoint ngegama lenqubo, ihlola igama lomsebenzisi lamanje ngokumelene nama-akhawunti aziwayo okuhlaziya-imvelo, i-patch i-interface ye-AMSI ne-ETW telemetry kwimemori, ifaka ukuqhubeka ngaphansi kwegama lengxenye yomsindo ye-Windows, futhi ithola i-binary yesithathu yama-megabytes amaningana ngobukhulu. Isigaba sesithathu sifika sibethelwe futhi kukhishwe umbhalo futhi kwenziwa ngenkumbulo kunokuba kubhalwe kudiski.
Ngomhlaka-1 Agasti, cishe emahoreni amane ngemuva kokuqinisekiswa ukuthi amaphakheji anonya ekubuyekezweni mathupha, amagama ayishumi nesishiyagalolunye kwangamashumi amabili asuswa ku-npm ngumshicileli wawo ngokulandelana kwemizuzwana engamashumi amabili nanhlanu. Ngomhlaka-2 Agasti elinye lalawo magama labhaliswa futhi - yi-akhawunti ehlukile, ephethe ikhodi efanayo. Ingqalasizinda yokulethwa yayisebenza kuzo zonke izigaba ezintathu ngesikhathi lokhu kubhalwa.
| Packages | Amagama angu-20 npm, izinguqulo ezingu-~74 ezishicilelwe |
| Ukuqamba izingqikithi | beaver-ui-* (13), accounts-* (3), kanye afisha-storybook-default, bcore-bravo-eslint-config, arbocrate-sla-prober-arbocrate-sla-prober-core, a.poltoradnev-package-c |
| I-Trigger | Ukungenisa imodyuli (require), hhayi iskripthi somjikelezo wokuphila we-npm |
| 1 internship | _polyfill.js - ukubuyisa nokuqalisa |
| 2 internship | Isilayishi esixhunywe ngokuqinile, esigcwele i-UPX ku-Linux; ukubalwa kokuphepha kwe-endpoint, ukufakelwa kwe-AMSI/ETW, ukuqhubeka |
| 3 internship | beacon_linux.bin / beacon_mac.bin / update_win.exe, 4–13 MB; ithunyelwe ibethelwe, yenziwe ngememori |
| Amapulatifomu | I-Linux x64 kanye ne-arm64, i-macOS universal, i-Windows x64 |
| Abashicileli | Ama-akhawunti amabili, i-codebase eyodwa |
| Isimo | Amagama angu-19 kwangu-20 angashicilelwanga ngumqhubi; 1 kushicilelwe kabusha futhi kubukhoma; ingqalasizinda yokulethwa bukhoma |
Ukwakheka komzimba kokuhlasela
Isigaba 1 — iphakheji
Ilungu ngalinye lithumela isimo esifanayo samafayela amathathu. index.js ithumela ngaphandle ikilasi eline- init() lokho kusetha i-boolean, i- inguqulo(), Futhi lungiselela() okuhlanganisa into yezinketho. Akukho okunye. README.md inikeza umugqa wokufaka, zidinga umugqa, kanye nomusho othi “Iphakheji yangaphakathi. Bheka i-CONTRIBUTING.md ukuthola iziqondiso” — CONTRIBUTING.md ayikho ku-tarball.
_polyfill.js ingaphansi kancane kuka-5 KB futhi ifundeka njengekhodi yengqalasizinda evamile. Ivula ngokuhlolwa kwemvelo okuthathu:
if (process.env.DISABLE_TELEMETRY ||
process.env.ANALYTICS_OPT_OUT ||
process.env.DO_NOT_TRACK)
return;Lezo ziguquguquko ziyizilawuli zobumfihlo ezivamile. Lapha zihlola ukuthi ngabe i-binary iyalandwa futhi iyasebenza. Umshini obeka UNGALANDELI yeqiwe ngokuphelele.
Okulandelayo kuza isitembu esisebenza kanye: ifayela ku- isimo se-/tmp/.analytics_state, noma isimo_sokuhlaziya ngaphansi % TEMP% ku-Windows, lapho isikhathi sokuguqulwa kwayo siqhathaniswa nefasitela lamasekhondi angu-20,357. Ngaphakathi kwalelo fasitela imojuli ibuya ngokushesha, ngakho ukungenisa okuphindaphindiwe ngesikhathi sokwakha kukhiqiza umzamo owodwa wokubuyisa esikhundleni samashumi amaningi.
Ama-host okuya endaweni awekho njengombhalo ongokoqobo. Ahlanganiswa ngesikhathi sokusebenza kusuka ezingcezu:
["oob-worker.cf102-","baf.workers.d","ev"].join("") Ama-host amathathu akhiwe ngale ndlela futhi axutshwe ngaphambi kokusetshenziswa, ngakho-ke i-oda liyahlukahluka ngokusebenza ngakunye. Ukubuyisa kuyi-HTTPS GET ephiniwe ku-IPv4 ene- Umsebenzisi-Umenzeli of i-node-fetch/2.6 — inani elinokwenzeka lenqubo ye-Node ukuze ikhishwe. Impendulo engaphansi kwama-byte ayi-1,000 iyalahlwa bese kuzanywa i-host elandelayo.
Uma konke lokhu kokuthathu kwehluleka, imojuli ibuyela ku-DNS. Ikhipha umbuzo we-TXT we- c. ukuthola inani lezingcezu, bese ucela 0. ngokusebenzisa n. ngamaqoqo ayishumi, ihlanganisa izimpendulo, bese i-base64-inquma umphumela. Le ndlela ine-executable efanayo phezu kwamarekhodi e-DNS TXT, esinda ezindaweni lapho i-HTTP ephumayo ihlungwa khona kodwa isixazululo se-DNS singahlungiwe.
Amabhayithi atholiwe abhalwe ku- /var/tmp/.cache_<8-hex> ku-Unix, noma %TEMP%\dotnet_diag_<8-hex>.exe ku-Windows — igama lefayela elifundeka njenge-.NET diagnostics artifact. Ku-Unix ifayela linikezwa imodi engu-0755. Ukuqaliswa ku- izalela nge okuhlukanisiwe: iqiniso, stdio: “ukunganaki”, Futhi unref(), ngakho-ke ingane iphila isikhathi eside kunenqubo ye-Node eyaqala yona; ku-Windows ukunxusa kuyanezela i-windowsHide: yiqiniso.
Imininingwane emibili iqedela isithombe. Umsizi ochazwa njengo const _l = (…a) => inqubo.stderr.write(“”) ibizwa esigabeni ngasinye sokubuyisa — ibhala umucu ongenalutho bese ilahla izimpikiswano zayo, ithathe indawo lapho ukuloba kuzohlala khona. Futhi iphakheji ngayinye ithumela ifayela elingu-81 KB ku- lib/telemetry.js ukuphawula kwesihloko sakhe kuchaza “i-Analytics SDK” ene-“HTTPS transport with endpoint rotation and retry” kanye ne-“DNS-based service discovery for failover”. Ekwakheni kwamanje akukho okukudingayo.
Isigaba 2 — isilayishi
I-binary ye-Linux x64 iyi-ELF exhunywe ngokwezibalo ecindezelwe nge-UPX 3.96. I-macOS build iyi-binary ehlanganisa i-x86_64 kanye ne-arm64; i-Windows build iyi-console ye-PE32+ ehlutshiwe esebenzisekayo. Zonke ezine zathathwa futhi zahlolwa ngokwezibalo; azikho ezasetshenziswa.
Ithebula lokungenisa kanye nelezintambo ze-Windows build lichaza ukuziphatha kwalo ngokucacile. Lixazulula inkinga IsDebuggerPresent, I-CheckRemoteDebuggerYethula, Futhi Inqubo Yolwazi lwe-NtQuery, futhi ifundeka kanje I-SYSTEM\CurrentControlSet\Services\Disk\Enum — indlela yokubhalisa enamanani akhomba abalawuli bediski ebonakalayo. Ibiza I-GetDiskFreeSpaceExW futhi I-GlobalMemoryStatusEx, okuhambisana nokuhlola ukuthi izinsiza zomsingathi ziyahambisana yini nesibonelo sokuhlaziya sesikhashana.
Iqukethe uhlu lwamagama abasebenzisi: Umsebenzisi Wamanje, Ukuphatha kwe-IT, UHong Lee, IBHOKISI LOKUHLOLA, ama-hapubw, ama-miloz, Timmy, admin, I-malware, Context, igciwane, imveloEziningana zalezi ziyizinto zobuciko zezindawo zokuhlaziya ezibhalwe phansi emphakathini.
Futhi inohlu lwemikhiqizo yokuphepha kwe-endpoint kanye namagama ezinqubo zayo, abhalwe nge- CreateToolhelp32Snapshot futhi Inqubo32FirstW/I-Process32NextW:
- I-CrowdStrike Falcon (
csfalconservice,CSFalconContainer) - I-Carbon Black (
cb.exe) - I-Cylance (
cylancesvc.exe) - Bitdefender (
bdagent.exe) - Kaspersky (
avp.exe,kavfs.exe) - Ukuphepha Okuncane Nokujulile Kwe-Trend (
coreServiceShell,ds_agent.exe) - I-FireEye/i-Trellix (
xagt.exe) - I-Tanium (
taniumclient.exe) - Hitmanpro (
hmpalert.exe) - Nokunwebeka (
elastic-agent.exe,elastic-endpoint,filebeat.exe,winlogbeat.exe) - UWazuh kanye ne-OSSEC (
wazuh-agent.exe,ossec-agent.exe) - Hlola i-Point
- Windows Defender
Kukhona ezinye izimpawu ezimbili: I-AmsiScanBuffer, indawo yokungena iWindows eveza ukuskena okuqukethwe okusememori, kanye I-EtwEventWrite, umsebenzi lapho i-Event Tracing ye-Windows iqopha khona imicimbi. Zombili ziyizinhloso ezivamile zokuguqulwa kwenqubo ecindezela i-telemetry lezo zixhumi ezingayikhiqiza.
Ukuphikelela kuvela kabili ku-Windows. I-binary ikopishwe ku- %APPDATA%\Microsoft\Windows\Themes\SystemSoundsService.exe, futhi izindlela ezimbili ziyibhekisela kuyo: inani elingaphansi ISOFTWARE\Microsoft\Windows\CurrentVersion\Run, kanye nomsebenzi ohleliwe obhaliswe njengo
schtasks /Create /F /SC ONLOGON
/TN "\Microsoft\Windows\Multimedia\SystemSoundsService"
/TR "\"%s\""
/RL HIGHESTIndlela yomsebenzi, igama lomsebenzi, kanye negama elisebenzisekayo konke kubonisa ingxenye yomsindo we-Windows yangempela. /RL OKUPHEZULU KUNABO BONKE icela izinga eliphezulu kakhulu lamalungelo atholakalayo.
Isakhiwo se-macOS silandela iphethini efanayo namagama afanele ipulatifomu: sibhala uhlu lwezakhiwo ku ~/Ilabhulali/Ama-LaunchAgents/com.apple.windowserver.helper.plist futhi ibeka ukusebenza kwayo ku- ~/.local/share/runtime/com.apple.runtimeIyahlola /Izicelo/VMware Fusion.app futhi /Usekelo Lwelabhulali/Uhlelo Lokusebenza/Amathuluzi e-VMware.
Amandla enethiwekhi ahlanganisa ukuthuthwa okuthathu: I-WININET.dll ye-HTTPS ene- https://%s:%d%s ifomethi yentambo, WS2_32.dll amasokhethi, kanye I-DNSAPI.dll nge I-DnsQuery_A eceleni a c.%s.%s i-format string — isimo esifanayo sombuzo wokubalwa kwezingxenye esisetshenziswa yisigaba sokuqala.
Incazelo engenhla yilokho okuboniswa yizindlela zokungenisa, izintambo, kanye nezindlela zokubhalisa ze-binary lapho kuhlolwa. Ukuhlaziywa kwezinjini eziningi zomphakathi kwesampula efanayo ye-Windows kunezela imininingwane ukufundwa okungaguquki kwethebula lokungenisa elingenakukwazi ukuyisungula ngokwalo, futhi kubhekwa lapha kunokuba kuphindwe njengokubonwa mathupha. Lokho kuhlaziywa kubika ukuthi izinkomba ze-AMSI kanye ne-ETW azixazululwa nje kuphela kodwa zilungisiwe — I-AmsiScanBuffer in amsi.dll futhi I-EtwEventWrite in ntdll.dll — okuvimbela ukuskena okuqukethwe okusememorini kanye nokulandelela imicimbi yenqubo. Ibika ukuhlolwa okulwa nokuhlaziywa njengokusekelwe esikhathini ngaphezu kwalokho I-CheckRemoteDebuggerYethula, futhi ikhomba Thola i-ThreadContext shayela njengokuhlola kwe-hardware-breakpoint okufunda amarejista okulungisa iphutha. Iphinde ibike i-mutex yesibonelo esisodwa, Global\{7A3B9E1F-C2D4-4F8A-B5E6-D7A1F0C3E2B9}, namagama Isevisi yeSystemSounds njengenani le-Run-key. Lelo nani le-mutex lalingekho phakathi kwezintambo ezitholwe lapha — isihlungi sokukhipha esisebenzise amathokheni e-hex ahlanganisiwe anezinhlamvu ezinkulu — futhi liqoshwe kuthebula lezinkomba ngamandla alokho kuhlaziywa komphakathi kunokubuka okuqondile.
3 internship
I-loader ibhekisela kwezinye izindlela eziku-host ezifanayo. Zonke zazifinyeleleka ngesikhathi sokuhlaziywa: i-beacon_linux.bin ku-5.3 MB, i-beacon_mac.bin ku-13.3 MB, buyekeza_win.exe ku-10.3 MB, futhi i-arm.bin ku-4.3 MB. Lezi azitholakalanga, futhi ukuziphatha kwazo akwaziwa.
Kwindlela ye-Windows, ukuhlaziywa komphakathi kwesilayishi kuchaza ukuthi leso sigaba sesithathu siphathwa kanjani: siyalandwa nge-WinINet, sifike sibhalwe ngekhodi, bese sisuswa ekubhalweni ngekhodi bese senziwa ngendlela ebonakalisayo — inkumbulo yabelwe, ukungenisa kuxazululwe, ukuthuthwa kuyacutshungulwa, kanye nokulawulwa kudluliselwe kuchungechunge olusha nge Dala UchungechungeNgenxa yalokho isigaba sesithathu asikaze sibhalwe ohlelweni lwefayela, ngakho-ke ukutholwa okusekelwe kufayela kanye ne-post-incident disk forensics akunalutho olungaluthola kukho. Kusho futhi ukuthi ukubuyisa ama-byte ku-delivery host kuzoveza i-ciphertext, hhayi i-executable ehlaziywayo.
esibekelwe
Zonke izitembu zesikhathi ziyi-UTC futhi zivela ku-npm registry metadata, eqopha ukudalwa kwephakheji kanye nokukhishwa kwayo ngaphandle kokusekelwa yinoma yimuphi umbukeli.
Okubili kwalokhu okufakiwe kufanelekile ukukucabanga.
Ukuqhuma kwe-13:04 kubeke amaphakheji ayisishiyagalolunye kurejista ngemizuzwana emine, ngalinye linenguqulo eyodwa kuma-twelve futhi akukho 0.0.1 ngaphansi kwayo. Izinombolo zenguqulo kulesi sikali, ngamagama akhona ngosuku olulodwa, azichazi umlando wokukhishwa.
Uchungechunge lokungashicileli lufana nolwemishini: amagama ayishumi nesishiyagalolunye, imizuzwana engamashumi amabili nanhlanu, ngisho nesikhala. i-npm iqopha lokhu njengemicimbi evamile yokungashicileli esikhundleni sesibambi sendawo esishiywa ukususwa okuqalwe ukubhalisa, okubeka isenzo ne-akhawunti yokushicilela kunokuba nerejista.
Izinkomba zokuvumelana
Ama-Host kanye nezindlela ziyaphambuka. Ungazixazululi noma uzilande ohlelweni lokukhiqiza.
Amagama ephakheji
Ukuchazwa kanye nokuziphatha okubonwayo
Kuhileleke ama-akhawunti amabili e-npm. Amagama ayishumi nesishiyagalolunye angashicilelwanga ashicilelwe yi-akhawunti eyodwa; a.poltoradnev-iphakheji-c yabhaliswa kabusha ngomhlaka-2 Agasti ngaphansi kwegama le-akhawunti elihlukile kanye nesizinda se-imeyili esihlukile. Ikhodi iwuhlu olufanayo kuzo zombili, futhi ukubhaliswa kwesibili kunezindawo ezifanayo zokulethwa, izizinda ezifanayo ze-DNS fallback, ukwakhiwa okufanayo kwendlela yokulahla, kanye nesitembu esifanayo sokusebenza kanye.
Lezi zibili ezishicilelwe kabusha zibonisa nendlela ezahlanganiswa ngayo. 0.0.2 futhi 33.9.5 ziyafana nge-byte ngaphandle kwentambo yenguqulo ku iphakethe.json, Kanye index.js kuthunyelwe njenge 0.0.2 limenyezelwe Inguqulo ye-const = “33.9.5”Zombili izinto zobuciko zasikwa emthini owodwa futhi zafakwa izinombolo kamuva. Akukho 0.0.2 umlando wentuthuko we 0.0.2 ukukhululwa ukuze kumelelwe.
Ukufakwa kwezinombolo kwenguqulo kulo lonke isethi kulandela umqondo ofanayo. Amagama ephakheji kulo mkhankaso afundeka njengezinto ezizoba khona ngaphakathi kwenhlangano kunokuba zibe serejista yomphakathi: isethi yengxenye ye-UI, ukucushwa kwe-ESLint, i-SLA prober, iphakheji eqanjwe ngomuntu. Lapho isakhiwo sixazulula ukuncika ngegama futhi sibheka irejista yomphakathi kanye neyangasese, inombolo yenguqulo ephezulu yileyo ewinayo. Igama elidalwe ku 0.0.1 ngoMsombuluko nokuthwala 12.9.6 ngoLwesibili ibekwe endaweni yokuqhathanisa lokho.
Amagagasi amabili okushicilelwa nawo ahlukile ngendlela ephakamisa ukuphindaphinda. Ikhodi yangaphambilini yaqamba ifayela layo lokulayisha setha.js futhi kufakwe ohlwini ama-host okulethwa amahlanu; ifayela lamanje liqanjwe ngegama _polyfill.js futhi ibala ezintathu. Inguqulo yangaphambilini isuse ifayela elilahliwe imizuzwana emihlanu ngemva kokuqaliswa, ishiya inqubo isebenza kusuka ku-inode esusiwe; inguqulo yamanje ayisebenzi. Okungabhekiselwanga lib/telemetry.js ihlala ku-tarball kuzo zombili, isathunyelwa, ayisaxhunywanga.
Ukuphawula okukodwa mayelana nokushintsha kokubulala kufanelekile ukukusho ngaphambicisely, ngoba ihlukanisa ukufundwa okuvamile. KHUBAZA_I-TELEMETRY, I-ANALYTICS_OPT_OUT, Futhi UNGALANDELI ziyahlonishwa, futhi ziyahlolwa ngaphambi kokuba kwenzeke noma yini enye. Umcwaningi onendawo yokuhlaziya ebeka noma iyiphi yazo ubona iphakheji engenzi lutho nhlobo.
Umthelela kanye nalokho abavikeli abangakwenza
Umphumela osebenzayo we-import-time trigger mncane futhi kufanelekile ukuwusho wodwa. ukufaka i-npm -ukungazi-izikripthi ivimbela izikripthi zomjikelezo wokuphila ukuthi zisebenze, futhi kuyiseluleko esihle. Ayinawo umphumela lapha, ngoba le khodi ayisebenzisi iskripthi somjikelezo wokuphila. Umthwalo wokukhokha usebenza lapho ikhodi yohlelo lokusebenza, ukugijima kokuhlola, i-bundler, noma i-linter kuqala ingenisa imojula. Ku-runner ye-CI efaka bese yakha ngokushesha, lokhu kokubili kuqhelelene ngemizuzwana.
Ekuzingeleni, izimpawu eziqinile zihlelekile kunokuba zingokoqobo. Ama-host, igama lefayela, kanye nezindlela zokulahla kuzoshintsha; lezi zimo kunzima ukuhlukahluka:
- Indawo yokungena yemojuli esitatimende sayo sokugcina siyi- zama { require(“./x”); } catch (_) {} ezungeze ifayela elingeyona ingxenye ye-API ethunyelwe. Iphakheji ene-polyfill yangempela iyingenisa phezulu futhi isebenzisa umphumela wayo. Ukugwinya wonke amaphutha avela ekungenisweni kwefayela elingezansi akusikho ukuphatha amaphutha.
- Izintambo zokusingatha ezihlanganiswe yi- .joyina(“”) kusuka kuhlu lwezingcezu. Ikhodi esemthethweni ayinaso isizathu sokuhlukanisa igama le-hostname kuzo zonke izakhi ze-array.
- Iphakheji okuncike kuyo okumenyezelwe ukuthi ayinalutho kodwa efinyelela ku https, dns, Futhi inqubo_yengane ngesikhathi sokungenisa. Ukutholwa kanye nokusebenza kwephakheji ekhangisa ingxenye ye-UI yikona okutholakele.
- Izinombolo zenguqulo azihambisani nobudala bephakheji. Igama elishicilelwe okokuqala ezinsukwini ezedlule enguqulweni enkulu enamadijithi amabili, ngaphandle kokukhishwa okungenelelayo, lichaza okunye ngaphandle kokuthuthuka kwalo.
- Ubhalela ku / var / tmp or % TEMP% kulandelwa a chmod kuya ku-0755 kanye nokuzala okuhlukanisiwe. Uchungechunge lufushane, luhlelekile, futhi aluvamile ukuba luhle ndawonye.
Kuma-Windows hosts kunezindlela ezimbili zokuhlola ezishibhile nezinokwethenjelwa okuphezulu. Izinto eziqhubekayo ziyizintambo eziqinile futhi azikho kuzo ezifanele uhlelo oluhlanzekile: umsebenzi ohleliwe ku- \Microsoft\Windows\Multimedia\SystemSoundsService, inani le-Run-key eliqanjwe ngokuthi Isevisi yeSystemSounds, kanye nesenzo esisebenzisekayo salelo gama ngaphansi %APPDATA%\Microsoft\Windows\Themes\. Isevisi yomsindo we-Windows yangempela ayihlali kunoma iyiphi yalezo zindawo. Okwesibili, i-loader isebenzisa i-mutex ehleliwe enesimo esisodwa, Global\{7A3B9E1F-C2D4-4F8A-B5E6-D7A1F0C3E2B9}; ukuba khona kwayo kumphathi kuyinkomba, futhi ngenxa yokuthi i-loader iphatha i-mutex ekhona njengokuthi “isivele isebenza”, ukuyidala kusengaphambili kuyindlela yokugoma yesikhashana esebenzayo ngenkathi ukulungiswa kuhleliwe.
Ukutholwa kwesigaba sesithathu kuyinkinga enzima futhi kufanele icaciswe. Ngokwe-akhawunti enikezwe ukuhlaziywa komphakathi, isusiwe futhi ifakwe kumephu yememori kunokuba ibhalwe kudiski, ngakho-ke ukuskena amafayela kanye ne-disk forensics ngeke kukubone. Okuhlala kubonakala yizinyathelo zomlayishi uqobo — okufakiwe okuqhubekayo, i-mutex, kanye nezicelo eziphumayo eziya kubasingathi bokulethwa noma izizinda ze-DNS-TXT.
Ezindaweni ezixazulula ukuncika kokubili kurejista yangasese kanye nerejista yomphakathi, ukuncishiswa akushintshi nganoma yini lapha: hlanganisa amagama angaphakathi ukuze igama lomphakathi lingakwazi ukuwanelisa, bese unamathisela isinqumo kurejista yangaphakathi yalezo zinkundla. Ukuziphatha kwenguqulo-ukwehla kwamandla emali okuchazwe ngenhla kusebenza kuphela lapho inguqulo yomphakathi ephezulu ingawina igama.
Okokugcina, ukungashicilelwa kwalokhu kufanele kufundwe ngokucophelela kunokuba kube yisiphetho. Amagama ayishumi nesishiyagalolunye ashiye irejista ngemizuzwana engamashumi amabili nanhlanu kanti elilodwa labuya ngosuku olulandelayo ngaphansi kwe-akhawunti entsha, ingqalasizinda yokulethwa ingakathintwa kuyo yonke indawo. Ukususwa kwamaphakheji akukhona ukususwa komsebenzi; ababungazi baqhubeka nokusebenza kuzo zonke izigaba ngenkathi lokhu kubhalwa. Noma yimuphi umuthi wokuthembela owaxazulula elinye lala magama phakathi kuka-31 Julayi no-1 Agasti kufanele uphathwe njengokuthi ube nethuba lokuqalisa isigaba sokuqala, kungakhathaliseki ukuthi igama lisakhona noma cha.
Okubhekwayo
- Ukuhlaziywa kwezinjini eziningi ze-Windows loader — umthombo wokulungiswa kwe-AMSI/ETW, ukwenziwa kwememori okubonakalayo, kanye nemininingwane ye-mutex ekhonjiswe ngenhla.
- imibhalo yezikripthi ze-npm — izehlakalo zomjikelezo wokuphila kwalo mkhankaso ezingazisebenzisi.
- ukufaka imibhalo ye-npm — izembozo –Ziba-imibhalo kanye nobubanzi bayo.
