430 likes | 512 Views
Binary voyeurism. A decent overview. Who are you. Any experience with Binary reversing ? Debugging? Exploitation ? Python?. Please fill the skill matrix ;). whoami. Nerd ( zombies , cylons …) Geek ( reversing , python …) Consultant :). We are hiring !. Security people
E N D
Binaryvoyeurism A decentoverview
Who areyou • Anyexperiencewith • Binary reversing? • Debugging? • Exploitation? • Python? Pleasefilltheskillmatrix ;)
whoami • Nerd (zombies, cylons…) • Geek (reversing, python…) • Consultant :)
Wearehiring! • Security people • Highlyskilledteam • Hardware, mobile, binary, web, sourcecode, network … • Fun, Research, CONs, etc. • Consultancy / businessoriented • Talk tome!
Today ismybirthday! Beers arepresentstoo!
agenda • Checking out theapplication • Staticanalysis • Not programmaticway • winappdbg • Intel PIN • vdb / vtrace • Drinks & bbq
Setting thescope • This talkisprettylame • Just an introduction • Basically a compilationofthingsvery intelligent peopledid • Anyway a niceoverviewifyoudon‘thave a deepknowledgeofthistopic
Staticanalysis • Ida pro scripts • Idc • in C language • Must recompileevery time • Idapython • Python bindings • Megusta… IDA Pro rocks!
Naivecryptosearch Let‘s check forcryptofunctions
Naivecryptosearch Let‘scomparewith a real plugin… IDA Signsrchfrom Luigi Auriemma
Naivecryptosearch Look atthosejuicy AES constants… So, there was somecrypto after all…
Find special x86 instructions Whyareyoudoingthisfunkystuff? Warning! Malware evasion!
m.i.l.f. plugin My IDA Little Framework IDA Pro Plugin
Not programmaticway • Just using a regulardebugger • Everyoneknowsthis, i guess ;) • Olly / ImmunitydebuggeR • windbg BOOOOORING…
Not programmaticway BOOOOORING… Olly, Immunity, Windbg, etc.
Winappdbg (& a bitpydbg)
keepassada • Followingfunctionsarecalledwhencopyingdatatotheclipboard: • OpenClipboard() • EmptyClipboard() • hClipboardData= GlobalAlloc() // hookthisandgetRetValue • pchData= (char*)GlobalLock(hClipboardData) • strcpy(pchData, LPCSTR(strData)) • GlobalUnlock(hClipboardData) • SetClipboardData(CF_TEXT, hClipboardData) // hookthis • CloseClipboard() Hook thosecalls! Monitoringtheprogramstackatruntime
keepassada Entervideo! Monitoringtheprogramstackatruntime
winappdbg • Tracer.py • Performance problems (-1) • Slow (-1) • Need functionlist (ida) (-1) • Itispython (+500) • Pydotftw (+500) Python rocks!
Tracer & derivatives Whereareyoulittleprocess? Look fortheprocessandattachtoit
Tracer & derivatives The callbackwritestheaddressto a file Breakpoints andcallbacks
Watchingdllloading WTFDLL? Targetingspecificfunctions
Tracer & pydot I <3 pydot A pictureisworth a thousandwords
Tracer & pydot I <3 pydot Binary abstractart, anyone?
INTEL PIN • A moreefficienttracer • Detectbufferoverflows • EIP outside textsection • Valgrind-likefor Windows • Check memoryallocations • Double free(s) Intel PIN rocks big time! THE dynamicbinaryinstrumentationtool
INTEL PIN • A moreefficienttracer Compiledmeansefficient! Itmeanspain in theasstoo
INTEL PIN Check every basic block Instrumentation vs. Runtimefunctions
INTEL PIN SEH overwrite, a classic Let‘sexploitthis
INTEL PIN Youshouldn‘t behere… EIP pointstothestack!
INTEL PIN • DetectEIP outside textsection Save all .textsectionaddresses Youshouldn‘tbehere!
INTEL PIN • DetectEIP outside textsection Compareagainst .textsectiondata EIP police! Show meyourhands!
INTEL PIN • Valgrind-likefor Windows • Check memoryallocations • Double free(s) Keep trackofmallocandfree This couldbeverypoweful
INTEL PIN Free themalloc()s! Somepeopletakeittothe extreme
Vdb / vtrace • Yep, itis Python • Itdoesprettymuchwhatothers do • And Linux… and ARM… and PPC… etc. • Look, I‘m so cool! • NO DOCUMENTATION • READABLE CODE Python still rocks! Whatthe k00l kidzuse
Vdb / vtrace Thanks Mozilla Development Docs! These twofunctionsareinterestingtous
Vdb / vtrace Super Secure Bank Seemslegit.
Vdb / vtrace Read atoffsetsfrom ESP register Prettysimilartothepreviousframeworks
Quick recap • Python based: • Fast prototyping but… • damnslow • Intel pin • Fast and intelligent but… • convoluted Prototype in Python Final project in PIN
Thanksforlistening! Don‘tforgetthebeer! ;)