Shared Engineering Services APJ Ghostdetect ver 1.0 for SPC Donghyun Seo Dec 12, 2008

Shared Engineering Services APJ Development Request SPC(Korea Software Property-right Council) requested Symantec Korea sales team to make a 3-rd part tool to detect Ghost fingerprint. SPC are planning to make another audit program which support Ghost fingerprint sometime next year. so separate detecting/reporting tool was necessary until release new Audit program. 2

Shared Engineering Services APJ Development Requirement 1 Ghost usage detect function ( provided by GCR SES) Create output file as result, every time it runs. Save output file per each PC g_Audit.exe runs with/without Audit.exe(SPC’s) file in same folder. g_Audit.exe UI will be hidden to users. one exe file No limitation of file size g_Audit.exe ’s output files will be supported by exist Audit viewer. (if we cannot get the latest audit source from SPC we have to make another viewer) 3

Shared Engineering Services APJ Development Requirement 2 With Audit source case –g_Audit.exe tool’s output files will be supported by exist Audit viewer. Without Audit source case (we have done by this case) –G_Audit.exe tool’s output files will not be supported by exist Audit viewer. –Different encryption will be applied. –Different viewer can be provided to SPC to summarize the Ghost audit results. –1 additional week of dev time is required for the viewer 4

Shared Engineering Services APJ Development Schedule / Resource Schedule –2008/Oct/21 – Start Development process –2008/Nov/07 – Release Beta (v0.1) version to SPC –2008/Nov/14 – Receive Feedback from SPC –2008/Nov/21 – Release PreBeta (v0.15) version to SPC –2008/Nov/28 – Release Beta(v0.2) version to SPC –2008/Dec/03 – Received Feedback from SPC –2008/Dec/10 – Release v1.0 to SCP Resource –GCR SES – GhostLib.lib ( usage detect function provided) –Donghyun Seo / Minyong Park – Dev –Minyoung Park / Wooyong Shim - SQA 5

Shared Engineering Services APJ How to use Ghostdetect tool 6 1. Run g_Audit.exe (this file should be located in the same folder with SPC Audit tool 2. SPC Audit tool will run automatically and user cannot see the UI of ‘g_Audit.exe’

Shared Engineering Services APJ How to use Ghostdetect tool 7 3. Close SPC audit tool then two result files will create. ‘.ret’ from SPC audit tool and ‘.gret’ from g_Audit.exe 4. Run Ghostdetect.exe to detect/read/view/print/save

Shared Engineering Services APJ How to use Ghostdetect tool 8 5. Open/Detect

Shared Engineering Services APJ How to use Ghostdetect tool 9 6. Print/Save Print Csv save

Shared Engineering Services APJ 10 Copyright © 2007 Symantec Corporation. All rights reserved. Symantec and the Symantec Logo are trademarks or registered trademarks of Symantec Corporation or its affiliates in the U.S. and other countries. Other names may be trademarks of their respective owners. This document is provided for informational purposes only and is not intended as advertising. All warranties relating to the information in this document, either express or implied, are disclaimed to the maximum extent allowed by law. The information in this document is subject to change without notice. Thank you. DongHyun Seo Shared Engineering Services APJ