diff options
Diffstat (limited to 'doc')
| -rw-r--r-- | doc/Makefile | 126 | ||||
| -rw-r--r-- | doc/bigcenter.sty | 7 | ||||
| -rw-r--r-- | doc/figs/calc_mod.eps | bin | 0 -> 13021 bytes | |||
| -rw-r--r-- | doc/figs/calc_mod.png | bin | 0 -> 12965 bytes | |||
| -rw-r--r-- | doc/figs/conficker_1.eps | bin | 0 -> 16222 bytes | |||
| -rw-r--r-- | doc/figs/conficker_1.png | bin | 0 -> 19420 bytes | |||
| -rw-r--r-- | doc/figs/conficker_2.eps | bin | 0 -> 17230 bytes | |||
| -rw-r--r-- | doc/figs/conficker_2.png | bin | 0 -> 10625 bytes | |||
| -rw-r--r-- | doc/figs/conficker_3.eps | bin | 0 -> 18022 bytes | |||
| -rw-r--r-- | doc/figs/conficker_3.png | bin | 0 -> 11340 bytes | |||
| -rw-r--r-- | doc/figs/conficker_4.eps | bin | 0 -> 42304 bytes | |||
| -rw-r--r-- | doc/figs/conficker_4.png | bin | 0 -> 30877 bytes | |||
| -rw-r--r-- | doc/figs/conficker_5.eps | bin | 0 -> 5162 bytes | |||
| -rw-r--r-- | doc/figs/conficker_5.png | bin | 0 -> 699 bytes | |||
| -rw-r--r-- | doc/figs/gandalf_01.eps | bin | 0 -> 49849 bytes | |||
| -rw-r--r-- | doc/figs/gandalf_01.png | bin | 0 -> 59766 bytes | |||
| -rw-r--r-- | doc/figs/gen_graph.eps | bin | 0 -> 10768 bytes | |||
| -rw-r--r-- | doc/figs/gen_graph.png | bin | 0 -> 9348 bytes | |||
| -rw-r--r-- | doc/figs/ircbot_1.eps | bin | 0 -> 103647 bytes | |||
| -rw-r--r-- | doc/figs/ircbot_1.png | bin | 0 -> 95747 bytes | |||
| -rw-r--r-- | doc/figs/ircbot_2.eps | bin | 0 -> 43182 bytes | |||
| -rw-r--r-- | doc/figs/ircbot_2.png | bin | 0 -> 18120 bytes | |||
| -rw-r--r-- | doc/figs/ishield_unpacked.eps | bin | 0 -> 40447 bytes | |||
| -rw-r--r-- | doc/figs/ishield_unpacked.png | bin | 0 -> 1395 bytes | |||
| -rw-r--r-- | doc/figs/mebroot_0.eps | bin | 0 -> 21292 bytes | |||
| -rw-r--r-- | doc/figs/mebroot_0.png | bin | 0 -> 1357 bytes | |||
| -rw-r--r-- | doc/figs/mebroot_1.eps | bin | 0 -> 9003 bytes | |||
| -rw-r--r-- | doc/figs/mebroot_1.png | bin | 0 -> 8289 bytes | |||
| -rw-r--r-- | doc/figs/mebroot_2.eps | bin | 0 -> 11735 bytes | |||
| -rw-r--r-- | doc/figs/mebroot_2.png | bin | 0 -> 13332 bytes | |||
| -rw-r--r-- | doc/figs/mebroot_3.eps | bin | 0 -> 46136 bytes | |||
| -rw-r--r-- | doc/figs/mebroot_3.png | bin | 0 -> 66841 bytes | |||
| -rw-r--r-- | doc/figs/mebroot_4.eps | bin | 0 -> 4707 bytes | |||
| -rw-r--r-- | doc/figs/mebroot_4.png | bin | 0 -> 675 bytes | |||
| -rw-r--r-- | doc/figs/mebroot_5.eps | bin | 0 -> 4643 bytes | |||
| -rw-r--r-- | doc/figs/mebroot_5.png | bin | 0 -> 588 bytes | |||
| -rw-r--r-- | doc/figs/mebroot_6.eps | bin | 0 -> 23105 bytes | |||
| -rw-r--r-- | doc/figs/mebroot_6.png | bin | 0 -> 31420 bytes | |||
| -rw-r--r-- | doc/figs/mebroot_7.eps | bin | 0 -> 4717 bytes | |||
| -rw-r--r-- | doc/figs/mebroot_7.png | bin | 0 -> 641 bytes | |||
| -rw-r--r-- | doc/figs/mebroot_obf_01.eps | 204 | ||||
| -rw-r--r-- | doc/figs/mebroot_obf_01.png | bin | 0 -> 65045 bytes | |||
| -rw-r--r-- | doc/figs/mebroot_obfdel_01.eps | 205 | ||||
| -rw-r--r-- | doc/figs/mebroot_obfdel_01.png | bin | 0 -> 46641 bytes | |||
| -rw-r--r-- | doc/figs/msgbox.eps | bin | 0 -> 5351 bytes | |||
| -rw-r--r-- | doc/figs/msgbox.png | bin | 0 -> 1363 bytes | |||
| -rw-r--r-- | doc/figs/pe_format.eps | bin | 0 -> 11936 bytes | |||
| -rw-r--r-- | doc/figs/pe_format.gif | bin | 0 -> 7421 bytes | |||
| -rw-r--r-- | doc/figs/xxx_mnemo01.eps | bin | 0 -> 19211 bytes | |||
| -rw-r--r-- | doc/figs/xxx_mnemo01.png | bin | 0 -> 18909 bytes | |||
| -rw-r--r-- | doc/figs/xxx_mnemo02.eps | bin | 0 -> 20579 bytes | |||
| -rw-r--r-- | doc/figs/xxx_mnemo02.png | bin | 0 -> 23846 bytes | |||
| -rw-r--r-- | doc/figs/xxx_mnemo03.eps | bin | 0 -> 14283 bytes | |||
| -rw-r--r-- | doc/figs/xxx_mnemo03.png | bin | 0 -> 12521 bytes | |||
| -rw-r--r-- | doc/figs/xxx_mnemo04.eps | bin | 0 -> 47536 bytes | |||
| -rw-r--r-- | doc/figs/xxx_mnemo04.png | bin | 0 -> 55461 bytes | |||
| -rw-r--r-- | doc/figs/xxx_mnemo05.eps | bin | 0 -> 40588 bytes | |||
| -rw-r--r-- | doc/figs/xxx_mnemo05.png | bin | 0 -> 46199 bytes | |||
| -rw-r--r-- | doc/figs/xxx_mnemo06.eps | bin | 0 -> 34383 bytes | |||
| -rw-r--r-- | doc/figs/xxx_mnemo06.png | bin | 0 -> 40100 bytes | |||
| -rw-r--r-- | doc/figs/xxx_mnemo07.eps | bin | 0 -> 91958 bytes | |||
| -rw-r--r-- | doc/figs/xxx_mnemo07.png | bin | 0 -> 101083 bytes | |||
| -rw-r--r-- | doc/figs/xxx_mnemo08.eps | bin | 0 -> 20055 bytes | |||
| -rw-r--r-- | doc/figs/xxx_mnemo08.png | bin | 0 -> 19663 bytes | |||
| -rw-r--r-- | doc/figs/xxx_mnemo09.eps | bin | 0 -> 14057 bytes | |||
| -rw-r--r-- | doc/figs/xxx_mnemo09.png | bin | 0 -> 13620 bytes | |||
| -rw-r--r-- | doc/figs/xxx_mnemo10.eps | bin | 0 -> 26433 bytes | |||
| -rw-r--r-- | doc/figs/xxx_mnemo10.png | bin | 0 -> 26169 bytes | |||
| -rw-r--r-- | doc/figs/xxx_vm01.eps | bin | 0 -> 16512 bytes | |||
| -rw-r--r-- | doc/figs/xxx_vm01.png | bin | 0 -> 20414 bytes | |||
| -rw-r--r-- | doc/slides.tex | 2243 |
71 files changed, 2785 insertions, 0 deletions
diff --git a/doc/Makefile b/doc/Makefile new file mode 100644 index 00000000..33d125a1 --- /dev/null +++ b/doc/Makefile @@ -0,0 +1,126 @@ +## Makefile for LaTeX presentations. +## +## Will compile the LaTeX file as many times as necessary. +## if FAST=1, always compile once +## +## The postscript : +## make mypres.ps +## The PDF, compile only once, even if the TOC or references are outdated +## make mypres.pdf FAST=1 +## The PDF, 4 slides per page, A4 +## make mypres.a4.4.pdf +## The web page (create a directory, needs album: apt-get install album) +## make mypres.www +## +## <phil(at)secdev.org> + +PSNUPOPTS=-W128mm -H96mm -pa4 -m0.5cm -b0.2cm -d +FORMAT ?= 1 + +XFIG_FIGS=$(patsubst %.fig,%.eps,$(wildcard fig/*.fig)) +DIA_FIGS=$(patsubst %.dia,%.eps,$(wildcard fig/*.dia)) +ALL_FIGS=$(XFIG_FIGS) $(DIA_FIGS) + +all: + @echo 'USAGE: make <filename.ext> [FAST=1]' + @echo 'possible extentions :' + @echo ' .dvi, .ps or .pdf' + @echo ' .www to create a directory with web pages' + @echo ' .a4.n.pdf with n in 1-4,6,8,9,16,32 for n slides per page' + + +.SUFFIXES: .pdf .tex .ps .dvi .www .eps .fig + +# cancel built-in implicit rule tex -> dvi +%.dvi:%.tex + +%.eps: %.fig + fig2dev -L eps $< $@ + +%.eps: %.dia + dia -e $@ $< + +%.pdf: %.ps + ps2pdf $*.ps + +%.ps: %.dvi + dvips -Ppdf $* + +%.dvi: %.tex $(ALL_FIGS) + [ -e $*.aux ] || touch $*.aux + while true; do \ + cp $*.aux $*.aux2 ;\ + echo $(FORMAT) | latex $* || { rm $*.aux2 ; break; }; \ + cmp $*.aux $*.aux2 && break ;\ + [ -z "$(FAST)" ] || break ;\ + done + @# if .aux2 does not exist, there was an error. Next line will be false. + @[ -e $*.aux2 ] && rm $*.aux2 + @echo "#######[ warnings ]#######" + @grep -i warning $*.log + @echo "##########################" + + +%.a4.0.ps: %.dvi + dvips -Ppdf -ta4 $* -o $@ + +%.a4.1.ps: %.a4.0.ps + psnup $(PSNUPOPTS) -1 $< $@ + +%.a4.2.ps: %.a4.0.ps + psnup $(PSNUPOPTS) -2 $< $@ + +%.a4.3.ps: %.a4.0.ps + psnup $(PSNUPOPTS) -3 $< $@ + +%.a4.4.ps: %.a4.0.ps + psnup $(PSNUPOPTS) -4 $< $@ + +%.a4.6.ps: %.a4.0.ps + psnup $(PSNUPOPTS) -6 $< $@ + +%.a4.8.ps: %.a4.0.ps + psnup $(PSNUPOPTS) -8 $< $@ + +%.a4.9.ps: %.a4.0.ps + psnup $(PSNUPOPTS) -9 $< $@ + +%.a4.16.ps: %.a4.0.ps + psnup $(PSNUPOPTS) -16 $< $@ + +%.a4.24.ps: %.a4.0.ps + psnup $(PSNUPOPTS) -24 $< $@ + +%.a4.32.ps: %.a4.0.ps + psnup $(PSNUPOPTS) -32 $< $@ + +%.a4.ps: %.a4.0.ps + mv $< $@ + +%.jpg: %.ppm + convert $< $@ + +# gs or pdftoppm ? pdftoppm : better fonts, graphics not anti-aliased +#gs -dBATCH -dNOPAUSE -dTextAlphaBits=4 -dGraphicsAlphaBits=4 -sDEVICE=png16m -sOutputFile=$@/$@-%04d.png -r150 $< +%.www: %.pdf + [ -e $@ ] && rm -rf $@ || true + mkdir $@ + pdftoppm $< $@/$@ + $(MAKE) alljpg PPMDIR=$@ + rm $@/*.ppm + cd $@ ; album -geometry 200x150 + +alljpg: + @$(MAKE) $(patsubst %.ppm,%.jpg, $(wildcard $(PPMDIR)/*.ppm)) + + +.PRECIOUS: %.dvi %.ps %.pdf %.eps + +.PHONY: clean,test + +clean: + rm -f *.toc *.aux *.vrb *.snm *.log *.out *.nav *.ps *.dvi + + +overclean: clean + rm -f *.pdf diff --git a/doc/bigcenter.sty b/doc/bigcenter.sty new file mode 100644 index 00000000..536c7bd2 --- /dev/null +++ b/doc/bigcenter.sty @@ -0,0 +1,7 @@ +\newskip\@bigflushglue \@bigflushglue = -100pt plus 1fil + +\def\bigcenter{\trivlist \bigcentering\item\relax} +\def\bigcentering{\let\\\@centercr\rightskip\@bigflushglue% +\leftskip\@bigflushglue +\parindent\z@\parfillskip\z@skip} +\def\endbigcenter{\endtrivlist} diff --git a/doc/figs/calc_mod.eps b/doc/figs/calc_mod.eps new file mode 100644 index 00000000..4f3ddfe1 --- /dev/null +++ b/doc/figs/calc_mod.eps Binary files differdiff --git a/doc/figs/calc_mod.png b/doc/figs/calc_mod.png new file mode 100644 index 00000000..40a09804 --- /dev/null +++ b/doc/figs/calc_mod.png Binary files differdiff --git a/doc/figs/conficker_1.eps b/doc/figs/conficker_1.eps new file mode 100644 index 00000000..e3370063 --- /dev/null +++ b/doc/figs/conficker_1.eps Binary files differdiff --git a/doc/figs/conficker_1.png b/doc/figs/conficker_1.png new file mode 100644 index 00000000..73bb2711 --- /dev/null +++ b/doc/figs/conficker_1.png Binary files differdiff --git a/doc/figs/conficker_2.eps b/doc/figs/conficker_2.eps new file mode 100644 index 00000000..115c00ba --- /dev/null +++ b/doc/figs/conficker_2.eps Binary files differdiff --git a/doc/figs/conficker_2.png b/doc/figs/conficker_2.png new file mode 100644 index 00000000..d5f990e5 --- /dev/null +++ b/doc/figs/conficker_2.png Binary files differdiff --git a/doc/figs/conficker_3.eps b/doc/figs/conficker_3.eps new file mode 100644 index 00000000..a8008da6 --- /dev/null +++ b/doc/figs/conficker_3.eps Binary files differdiff --git a/doc/figs/conficker_3.png b/doc/figs/conficker_3.png new file mode 100644 index 00000000..9d9aded2 --- /dev/null +++ b/doc/figs/conficker_3.png Binary files differdiff --git a/doc/figs/conficker_4.eps b/doc/figs/conficker_4.eps new file mode 100644 index 00000000..d41d2cf5 --- /dev/null +++ b/doc/figs/conficker_4.eps Binary files differdiff --git a/doc/figs/conficker_4.png b/doc/figs/conficker_4.png new file mode 100644 index 00000000..a1fce082 --- /dev/null +++ b/doc/figs/conficker_4.png Binary files differdiff --git a/doc/figs/conficker_5.eps b/doc/figs/conficker_5.eps new file mode 100644 index 00000000..91e3ec0b --- /dev/null +++ b/doc/figs/conficker_5.eps Binary files differdiff --git a/doc/figs/conficker_5.png b/doc/figs/conficker_5.png new file mode 100644 index 00000000..5f572e25 --- /dev/null +++ b/doc/figs/conficker_5.png Binary files differdiff --git a/doc/figs/gandalf_01.eps b/doc/figs/gandalf_01.eps new file mode 100644 index 00000000..a03c2ae1 --- /dev/null +++ b/doc/figs/gandalf_01.eps Binary files differdiff --git a/doc/figs/gandalf_01.png b/doc/figs/gandalf_01.png new file mode 100644 index 00000000..ca7cc215 --- /dev/null +++ b/doc/figs/gandalf_01.png Binary files differdiff --git a/doc/figs/gen_graph.eps b/doc/figs/gen_graph.eps new file mode 100644 index 00000000..fb1de3a7 --- /dev/null +++ b/doc/figs/gen_graph.eps Binary files differdiff --git a/doc/figs/gen_graph.png b/doc/figs/gen_graph.png new file mode 100644 index 00000000..a6dc416b --- /dev/null +++ b/doc/figs/gen_graph.png Binary files differdiff --git a/doc/figs/ircbot_1.eps b/doc/figs/ircbot_1.eps new file mode 100644 index 00000000..9795355d --- /dev/null +++ b/doc/figs/ircbot_1.eps Binary files differdiff --git a/doc/figs/ircbot_1.png b/doc/figs/ircbot_1.png new file mode 100644 index 00000000..9da4d445 --- /dev/null +++ b/doc/figs/ircbot_1.png Binary files differdiff --git a/doc/figs/ircbot_2.eps b/doc/figs/ircbot_2.eps new file mode 100644 index 00000000..a75180c0 --- /dev/null +++ b/doc/figs/ircbot_2.eps Binary files differdiff --git a/doc/figs/ircbot_2.png b/doc/figs/ircbot_2.png new file mode 100644 index 00000000..83de6c06 --- /dev/null +++ b/doc/figs/ircbot_2.png Binary files differdiff --git a/doc/figs/ishield_unpacked.eps b/doc/figs/ishield_unpacked.eps new file mode 100644 index 00000000..b866983b --- /dev/null +++ b/doc/figs/ishield_unpacked.eps Binary files differdiff --git a/doc/figs/ishield_unpacked.png b/doc/figs/ishield_unpacked.png new file mode 100644 index 00000000..0784ff27 --- /dev/null +++ b/doc/figs/ishield_unpacked.png Binary files differdiff --git a/doc/figs/mebroot_0.eps b/doc/figs/mebroot_0.eps new file mode 100644 index 00000000..6ec74639 --- /dev/null +++ b/doc/figs/mebroot_0.eps Binary files differdiff --git a/doc/figs/mebroot_0.png b/doc/figs/mebroot_0.png new file mode 100644 index 00000000..4f29c757 --- /dev/null +++ b/doc/figs/mebroot_0.png Binary files differdiff --git a/doc/figs/mebroot_1.eps b/doc/figs/mebroot_1.eps new file mode 100644 index 00000000..a6980bc6 --- /dev/null +++ b/doc/figs/mebroot_1.eps Binary files differdiff --git a/doc/figs/mebroot_1.png b/doc/figs/mebroot_1.png new file mode 100644 index 00000000..48a8f1b0 --- /dev/null +++ b/doc/figs/mebroot_1.png Binary files differdiff --git a/doc/figs/mebroot_2.eps b/doc/figs/mebroot_2.eps new file mode 100644 index 00000000..181a0a5b --- /dev/null +++ b/doc/figs/mebroot_2.eps Binary files differdiff --git a/doc/figs/mebroot_2.png b/doc/figs/mebroot_2.png new file mode 100644 index 00000000..9fe802a8 --- /dev/null +++ b/doc/figs/mebroot_2.png Binary files differdiff --git a/doc/figs/mebroot_3.eps b/doc/figs/mebroot_3.eps new file mode 100644 index 00000000..754c0af3 --- /dev/null +++ b/doc/figs/mebroot_3.eps Binary files differdiff --git a/doc/figs/mebroot_3.png b/doc/figs/mebroot_3.png new file mode 100644 index 00000000..c663f0ed --- /dev/null +++ b/doc/figs/mebroot_3.png Binary files differdiff --git a/doc/figs/mebroot_4.eps b/doc/figs/mebroot_4.eps new file mode 100644 index 00000000..39d1ab70 --- /dev/null +++ b/doc/figs/mebroot_4.eps Binary files differdiff --git a/doc/figs/mebroot_4.png b/doc/figs/mebroot_4.png new file mode 100644 index 00000000..6b152c06 --- /dev/null +++ b/doc/figs/mebroot_4.png Binary files differdiff --git a/doc/figs/mebroot_5.eps b/doc/figs/mebroot_5.eps new file mode 100644 index 00000000..d268e4fe --- /dev/null +++ b/doc/figs/mebroot_5.eps Binary files differdiff --git a/doc/figs/mebroot_5.png b/doc/figs/mebroot_5.png new file mode 100644 index 00000000..e5f31422 --- /dev/null +++ b/doc/figs/mebroot_5.png Binary files differdiff --git a/doc/figs/mebroot_6.eps b/doc/figs/mebroot_6.eps new file mode 100644 index 00000000..c1abf406 --- /dev/null +++ b/doc/figs/mebroot_6.eps Binary files differdiff --git a/doc/figs/mebroot_6.png b/doc/figs/mebroot_6.png new file mode 100644 index 00000000..734b1df9 --- /dev/null +++ b/doc/figs/mebroot_6.png Binary files differdiff --git a/doc/figs/mebroot_7.eps b/doc/figs/mebroot_7.eps new file mode 100644 index 00000000..49f0d8ac --- /dev/null +++ b/doc/figs/mebroot_7.eps Binary files differdiff --git a/doc/figs/mebroot_7.png b/doc/figs/mebroot_7.png new file mode 100644 index 00000000..80124211 --- /dev/null +++ b/doc/figs/mebroot_7.png Binary files differdiff --git a/doc/figs/mebroot_obf_01.eps b/doc/figs/mebroot_obf_01.eps new file mode 100644 index 00000000..47260ddd --- /dev/null +++ b/doc/figs/mebroot_obf_01.eps @@ -0,0 +1,204 @@ +%!PS-Adobe-3.0 EPSF-3.0 +%%Creator: (ImageMagick) +%%Title: (mebroot_obf_01.eps) +%%CreationDate: (2010-01-22T11:25:52+01:00) +%%BoundingBox: 0 0 605 613 +%%HiResBoundingBox: 0 0 605 613 +%%LanguageLevel: 2 +%%Pages: 1 +%%EndComments + +%%BeginDefaults +%%EndDefaults + +%%BeginProlog +% +% Display a color image. The image is displayed in color on +% Postscript viewers or printers that support color, otherwise +% it is displayed as grayscale. +% +/DirectClassImage +{ + % + % Display a DirectClass image. + % + colorspace 0 eq + { + /DeviceRGB setcolorspace + << + /ImageType 1 + /Width columns + /Height rows + /BitsPerComponent 8 + /Decode [0 1 0 1 0 1] + /ImageMatrix [columns 0 0 rows neg 0 rows] + compression 0 gt + { /DataSource pixel_stream /RunLengthDecode filter } + { /DataSource pixel_stream /RunLengthDecode filter } ifelse + >> image + } + { + /DeviceCMYK setcolorspace + << + /ImageType 1 + /Width columns + /Height rows + /BitsPerComponent 8 + /Decode [1 0 1 0 1 0 1 0] + /ImageMatrix [columns 0 0 rows neg 0 rows] + compression 0 gt + { /DataSource pixel_stream /RunLengthDecode filter } + { /DataSource pixel_stream /RunLengthDecode filter } ifelse + >> image + } ifelse +} bind def + +/PseudoClassImage +{ + % + % Display a PseudoClass image. + % + % Parameters: + % colors: number of colors in the colormap. + % + currentfile buffer readline pop + token pop /colors exch def pop + colors 0 eq + { + % + % Image is grayscale. + % + currentfile buffer readline pop + token pop /bits exch def pop + /DeviceGray setcolorspace + << + /ImageType 1 + /Width columns + /Height rows + /BitsPerComponent bits + /Decode [0 1] + /ImageMatrix [columns 0 0 rows neg 0 rows] + compression 0 gt + { /DataSource pixel_stream /RunLengthDecode filter } + { + /DataSource pixel_stream /RunLengthDecode filter + << + /K -1 + /Columns columns + /Rows rows + >> /CCITTFaxDecode filter + } ifelse + >> image + } + { + % + % Parameters: + % colormap: red, green, blue color packets. + % + /colormap colors 3 mul string def + currentfile colormap readhexstring pop pop + currentfile buffer readline pop + [ /Indexed /DeviceRGB colors 1 sub colormap ] setcolorspace + << + /ImageType 1 + /Width columns + /Height rows + /BitsPerComponent 8 + /Decode [0 255] + /ImageMatrix [columns 0 0 rows neg 0 rows] + compression 0 gt + { /DataSource pixel_stream /RunLengthDecode filter } + { /DataSource pixel_stream /RunLengthDecode filter } ifelse + >> image + } ifelse +} bind def + +/DisplayImage +{ + % + % Display a DirectClass or PseudoClass image. + % + % Parameters: + % x & y translation. + % x & y scale. + % label pointsize. + % image label. + % image columns & rows. + % class: 0-DirectClass or 1-PseudoClass. + % colorspace: 0-RGB or 1-CMYK. + % compression: 0-RLECompression or 1-NoCompression. + % hex color packets. + % + gsave + /buffer 512 string def + /pixel_stream currentfile def + + currentfile buffer readline pop + token pop /x exch def + token pop /y exch def pop + x y translate + currentfile buffer readline pop + token pop /x exch def + token pop /y exch def pop + currentfile buffer readline pop + token pop /pointsize exch def pop + /Helvetica findfont pointsize scalefont setfont + x y scale + currentfile buffer readline pop + token pop /columns exch def + token pop /rows exch def pop + currentfile buffer readline pop + token pop /class exch def pop + currentfile buffer readline pop + token pop /colorspace exch def pop + currentfile buffer readline pop + token pop /compression exch def pop + class 0 gt { PseudoClassImage } { DirectClassImage } ifelse +} bind def +%%EndProlog +%%Page: 1 1 +%%PageBoundingBox: 0 0 605 613 +userdict begin +%%BeginData: 1000988 Binary Bytes +DisplayImage +0 0 +605 613 +12.000000 +605 613 +0 +0 +0 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~w +0077 +;;NNdd llII22 +44EEOO +BB77yy +yy!! 貲يfŨ9jjl + +rrOOYYllݼEECC + +GxxLLnn{z˙Ҧ99rrʕԫHF@@kkqqVVӧ.. $$ ;: +3/թѤ//ff۸ttݻ ;;qq + +VV +3.֬ѣС""ϠbbŊddgdtt + -* + +3.֬ѣ Ċ33tt +<<``__ +qq[[uuǷ۷pp||ʎ]]hhӋss ``xxzz߽??kk + + +dduu YYYYiikkoo +3.֬ѣ ||qqssEEtt +ʕȑӊ +3.ԩѤ00ffڶrr[[&&qq + +pp䎎ʟpp䦦kk +%%EndData +end +%%PageTrailer +%%Trailer +%%BoundingBox: 0 0 605 613 +%%HiResBoundingBox: 0 0 605 613 +%%EOF diff --git a/doc/figs/mebroot_obf_01.png b/doc/figs/mebroot_obf_01.png new file mode 100644 index 00000000..ac379c9a --- /dev/null +++ b/doc/figs/mebroot_obf_01.png Binary files differdiff --git a/doc/figs/mebroot_obfdel_01.eps b/doc/figs/mebroot_obfdel_01.eps new file mode 100644 index 00000000..33f379b0 --- /dev/null +++ b/doc/figs/mebroot_obfdel_01.eps @@ -0,0 +1,205 @@ +%!PS-Adobe-3.0 EPSF-3.0 +%%Creator: (ImageMagick) +%%Title: (mebroot_obfdel_01.eps) +%%CreationDate: (2010-01-22T11:26:06+01:00) +%%BoundingBox: 0 0 211 683 +%%HiResBoundingBox: 0 0 211 683 +%%LanguageLevel: 2 +%%Pages: 1 +%%EndComments + +%%BeginDefaults +%%EndDefaults + +%%BeginProlog +% +% Display a color image. The image is displayed in color on +% Postscript viewers or printers that support color, otherwise +% it is displayed as grayscale. +% +/DirectClassImage +{ + % + % Display a DirectClass image. + % + colorspace 0 eq + { + /DeviceRGB setcolorspace + << + /ImageType 1 + /Width columns + /Height rows + /BitsPerComponent 8 + /Decode [0 1 0 1 0 1] + /ImageMatrix [columns 0 0 rows neg 0 rows] + compression 0 gt + { /DataSource pixel_stream /RunLengthDecode filter } + { /DataSource pixel_stream /RunLengthDecode filter } ifelse + >> image + } + { + /DeviceCMYK setcolorspace + << + /ImageType 1 + /Width columns + /Height rows + /BitsPerComponent 8 + /Decode [1 0 1 0 1 0 1 0] + /ImageMatrix [columns 0 0 rows neg 0 rows] + compression 0 gt + { /DataSource pixel_stream /RunLengthDecode filter } + { /DataSource pixel_stream /RunLengthDecode filter } ifelse + >> image + } ifelse +} bind def + +/PseudoClassImage +{ + % + % Display a PseudoClass image. + % + % Parameters: + % colors: number of colors in the colormap. + % + currentfile buffer readline pop + token pop /colors exch def pop + colors 0 eq + { + % + % Image is grayscale. + % + currentfile buffer readline pop + token pop /bits exch def pop + /DeviceGray setcolorspace + << + /ImageType 1 + /Width columns + /Height rows + /BitsPerComponent bits + /Decode [0 1] + /ImageMatrix [columns 0 0 rows neg 0 rows] + compression 0 gt + { /DataSource pixel_stream /RunLengthDecode filter } + { + /DataSource pixel_stream /RunLengthDecode filter + << + /K -1 + /Columns columns + /Rows rows + >> /CCITTFaxDecode filter + } ifelse + >> image + } + { + % + % Parameters: + % colormap: red, green, blue color packets. + % + /colormap colors 3 mul string def + currentfile colormap readhexstring pop pop + currentfile buffer readline pop + [ /Indexed /DeviceRGB colors 1 sub colormap ] setcolorspace + << + /ImageType 1 + /Width columns + /Height rows + /BitsPerComponent 8 + /Decode [0 255] + /ImageMatrix [columns 0 0 rows neg 0 rows] + compression 0 gt + { /DataSource pixel_stream /RunLengthDecode filter } + { /DataSource pixel_stream /RunLengthDecode filter } ifelse + >> image + } ifelse +} bind def + +/DisplayImage +{ + % + % Display a DirectClass or PseudoClass image. + % + % Parameters: + % x & y translation. + % x & y scale. + % label pointsize. + % image label. + % image columns & rows. + % class: 0-DirectClass or 1-PseudoClass. + % colorspace: 0-RGB or 1-CMYK. + % compression: 0-RLECompression or 1-NoCompression. + % hex color packets. + % + gsave + /buffer 512 string def + /pixel_stream currentfile def + + currentfile buffer readline pop + token pop /x exch def + token pop /y exch def pop + x y translate + currentfile buffer readline pop + token pop /x exch def + token pop /y exch def pop + currentfile buffer readline pop + token pop /pointsize exch def pop + /Helvetica findfont pointsize scalefont setfont + x y scale + currentfile buffer readline pop + token pop /columns exch def + token pop /rows exch def pop + currentfile buffer readline pop + token pop /class exch def pop + currentfile buffer readline pop + token pop /colorspace exch def pop + currentfile buffer readline pop + token pop /compression exch def pop + class 0 gt { PseudoClassImage } { DirectClassImage } ifelse +} bind def +%%EndProlog +%%Page: 1 1 +%%PageBoundingBox: 0 0 211 683 +userdict begin +%%BeginData: 346429 Binary Bytes +DisplayImage +0 0 +211 683 +12.000000 +211 683 +0 +0 +0 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~P +WW//BBYYeeWWTTAA66OO + +씔ʇh1e 0c%\Ʃ + + + + __!!MM?? JJ}} +<<``__ +3.֬ѣ ||qqssEEtt +ʕȑӊ +3.ԩѤ00ffڶrr[[&&qq +3.ժѤ**jjܻAAqq +놆UU== ԩժkk +3.֬ѣݼ ŋСܺaa<<tt +ʔȐӎ +3.ԩѤ11eeٴppݻÇ99qq +3.֬ѣ۷ Ǐ}}ƌgghett +3.ԨѤ88aaӨ zz;;pp +3.֬Ѥ rrѢܺssKKss +3.֬ѣز!!ɓСܺ\\77tt + +Рǐ߾Νmm ͜ww߾uuFF +3.ԨѤ55bbլ ;;pp +3.֬Ѥ vvѢ66tt +3.֬ѣ Ærrkk??tt + + +%%EndData +end +%%PageTrailer +%%Trailer +%%BoundingBox: 0 0 211 683 +%%HiResBoundingBox: 0 0 211 683 +%%EOF diff --git a/doc/figs/mebroot_obfdel_01.png b/doc/figs/mebroot_obfdel_01.png new file mode 100644 index 00000000..018ea0a4 --- /dev/null +++ b/doc/figs/mebroot_obfdel_01.png Binary files differdiff --git a/doc/figs/msgbox.eps b/doc/figs/msgbox.eps new file mode 100644 index 00000000..c8e8e613 --- /dev/null +++ b/doc/figs/msgbox.eps Binary files differdiff --git a/doc/figs/msgbox.png b/doc/figs/msgbox.png new file mode 100644 index 00000000..8987d6d8 --- /dev/null +++ b/doc/figs/msgbox.png Binary files differdiff --git a/doc/figs/pe_format.eps b/doc/figs/pe_format.eps new file mode 100644 index 00000000..fe9b5ee0 --- /dev/null +++ b/doc/figs/pe_format.eps Binary files differdiff --git a/doc/figs/pe_format.gif b/doc/figs/pe_format.gif new file mode 100644 index 00000000..4757f19e --- /dev/null +++ b/doc/figs/pe_format.gif Binary files differdiff --git a/doc/figs/xxx_mnemo01.eps b/doc/figs/xxx_mnemo01.eps new file mode 100644 index 00000000..da39ef98 --- /dev/null +++ b/doc/figs/xxx_mnemo01.eps Binary files differdiff --git a/doc/figs/xxx_mnemo01.png b/doc/figs/xxx_mnemo01.png new file mode 100644 index 00000000..541112e4 --- /dev/null +++ b/doc/figs/xxx_mnemo01.png Binary files differdiff --git a/doc/figs/xxx_mnemo02.eps b/doc/figs/xxx_mnemo02.eps new file mode 100644 index 00000000..2db59b92 --- /dev/null +++ b/doc/figs/xxx_mnemo02.eps Binary files differdiff --git a/doc/figs/xxx_mnemo02.png b/doc/figs/xxx_mnemo02.png new file mode 100644 index 00000000..2bf7bdeb --- /dev/null +++ b/doc/figs/xxx_mnemo02.png Binary files differdiff --git a/doc/figs/xxx_mnemo03.eps b/doc/figs/xxx_mnemo03.eps new file mode 100644 index 00000000..9ab49443 --- /dev/null +++ b/doc/figs/xxx_mnemo03.eps Binary files differdiff --git a/doc/figs/xxx_mnemo03.png b/doc/figs/xxx_mnemo03.png new file mode 100644 index 00000000..760970f7 --- /dev/null +++ b/doc/figs/xxx_mnemo03.png Binary files differdiff --git a/doc/figs/xxx_mnemo04.eps b/doc/figs/xxx_mnemo04.eps new file mode 100644 index 00000000..ab74529d --- /dev/null +++ b/doc/figs/xxx_mnemo04.eps Binary files differdiff --git a/doc/figs/xxx_mnemo04.png b/doc/figs/xxx_mnemo04.png new file mode 100644 index 00000000..83610c7e --- /dev/null +++ b/doc/figs/xxx_mnemo04.png Binary files differdiff --git a/doc/figs/xxx_mnemo05.eps b/doc/figs/xxx_mnemo05.eps new file mode 100644 index 00000000..f636c3ed --- /dev/null +++ b/doc/figs/xxx_mnemo05.eps Binary files differdiff --git a/doc/figs/xxx_mnemo05.png b/doc/figs/xxx_mnemo05.png new file mode 100644 index 00000000..fe407617 --- /dev/null +++ b/doc/figs/xxx_mnemo05.png Binary files differdiff --git a/doc/figs/xxx_mnemo06.eps b/doc/figs/xxx_mnemo06.eps new file mode 100644 index 00000000..dea835a8 --- /dev/null +++ b/doc/figs/xxx_mnemo06.eps Binary files differdiff --git a/doc/figs/xxx_mnemo06.png b/doc/figs/xxx_mnemo06.png new file mode 100644 index 00000000..fe422111 --- /dev/null +++ b/doc/figs/xxx_mnemo06.png Binary files differdiff --git a/doc/figs/xxx_mnemo07.eps b/doc/figs/xxx_mnemo07.eps new file mode 100644 index 00000000..6935c398 --- /dev/null +++ b/doc/figs/xxx_mnemo07.eps Binary files differdiff --git a/doc/figs/xxx_mnemo07.png b/doc/figs/xxx_mnemo07.png new file mode 100644 index 00000000..d6f620e4 --- /dev/null +++ b/doc/figs/xxx_mnemo07.png Binary files differdiff --git a/doc/figs/xxx_mnemo08.eps b/doc/figs/xxx_mnemo08.eps new file mode 100644 index 00000000..c1dbdc8e --- /dev/null +++ b/doc/figs/xxx_mnemo08.eps Binary files differdiff --git a/doc/figs/xxx_mnemo08.png b/doc/figs/xxx_mnemo08.png new file mode 100644 index 00000000..cfd200c6 --- /dev/null +++ b/doc/figs/xxx_mnemo08.png Binary files differdiff --git a/doc/figs/xxx_mnemo09.eps b/doc/figs/xxx_mnemo09.eps new file mode 100644 index 00000000..9e947f9c --- /dev/null +++ b/doc/figs/xxx_mnemo09.eps Binary files differdiff --git a/doc/figs/xxx_mnemo09.png b/doc/figs/xxx_mnemo09.png new file mode 100644 index 00000000..990ad13f --- /dev/null +++ b/doc/figs/xxx_mnemo09.png Binary files differdiff --git a/doc/figs/xxx_mnemo10.eps b/doc/figs/xxx_mnemo10.eps new file mode 100644 index 00000000..4b838013 --- /dev/null +++ b/doc/figs/xxx_mnemo10.eps Binary files differdiff --git a/doc/figs/xxx_mnemo10.png b/doc/figs/xxx_mnemo10.png new file mode 100644 index 00000000..3c985982 --- /dev/null +++ b/doc/figs/xxx_mnemo10.png Binary files differdiff --git a/doc/figs/xxx_vm01.eps b/doc/figs/xxx_vm01.eps new file mode 100644 index 00000000..e56ac93b --- /dev/null +++ b/doc/figs/xxx_vm01.eps Binary files differdiff --git a/doc/figs/xxx_vm01.png b/doc/figs/xxx_vm01.png new file mode 100644 index 00000000..fc1e7e15 --- /dev/null +++ b/doc/figs/xxx_vm01.png Binary files differdiff --git a/doc/slides.tex b/doc/slides.tex new file mode 100644 index 00000000..cf7057e7 --- /dev/null +++ b/doc/slides.tex @@ -0,0 +1,2243 @@ +\documentclass[ + beamer, +% handout, +% notes=show, +% notes=onlyslideswithnotes, +% notes=only, +% xcolor=pst, + dvips, +]{beamer} + +%\usepackage[francais]{babel} +\usepackage[latin1]{inputenc} +\usepackage{alltt} +\usepackage{pstricks} +\usepackage{pst-node} +\usepackage{listings} +\usepackage{xspace} +\usepackage{xcolor} + + +%Workarround some bugs in marvosym +\let\RescueRightarrow=\Rightarrow +\usepackage{marvosym} +\renewcommand{\Rightarrow}{\RescueRightarrow} + +\usepackage{marvosym} + +\usepackage{tikz} +\usetikzlibrary{matrix,calc,arrows,shapes,snakes,automata,backgrounds,petri,fit,positioning,chains} +\usepackage{verbatim} +\usepackage{bigcenter} +%%\usetikzlibrary{calc} +%%\usetikzlibrary[calc] +%%\usetikzlibrary{shapes,arrows} + +%%\usetikzlibrary{calc,arrows,shapes,snakes,automata,backgrounds,petri,fit} +%% +%%\usetikzlibrary{% +%% arrows,% +%% shapes.misc,% wg. rounded rectangle +%% shapes.arrows,% +%% chains,% +%% matrix,% +%% positioning,% wg. " of " +%% scopes,% +%% decorations.pathmorphing,% /pgf/decoration/random steps | erste Graphik +%% shadows,% +%% fit +%%} +%% + + +\usetikzlibrary{matrix} +\usetikzlibrary{calc,arrows,shapes,snakes,automata,backgrounds,petri,fit} + +\usetikzlibrary{% + arrows,% + shapes.misc,% wg. rounded rectangle + shapes.arrows,% + chains,% + matrix,% + positioning,% wg. " of " + scopes,% + decorations.pathmorphing,% /pgf/decoration/random steps | erste Graphik + shadows% +} + + +\lstset{ + basicstyle=\sffamily\color{darkgray}, + keywordstyle=\bfseries\color{purple}, + identifierstyle=\bfseries\color{black}, + commentstyle=\ttfamily\itshape\color{purple}, + stringstyle=\ttfamily\color{brown}, + moredelim=[is][\color{red}]{==>}{<==}, % overwrited by language setting +% moredelim=**[is][\normalsize]{|}{|}, % overwrited by language setting + stringspaces=true, + showstringspaces=false, + frame=leftline, + numbersep=5pt, + defaultdialect=Python, + language=Python +} + + + +\newcommand{\domain}{\textit} +\newcommand{\tool}{\textsl} + +\newcommand{\scite}[1]{{\footnotesize\cite{#1}}} + +\mode<all> +{ +% \usetheme{Singapore} + \usetheme{Warsaw} + \usecolortheme{crane} + \setbeamercovered{transparent} + \setbeamercolor{background canvas}{bg=} +} + +\setbeamertemplate{footline} +{% + \begin{beamercolorbox}{section in head/foot} + \insertshortauthor\hfill\insertshorttitle{}\hfill\insertframenumber/\inserttotalframenumber +% \vskip2pt\insertnavigation{\paperwidth}\vskip2pt + \end{beamercolorbox}% +} + + + +\mode<presentation> { +% \setbeamertemplate{background canvas}[vertical shading][bottom=blue!30,top=purple!10] +} + + + +\mode<handout> { +} + +\newenvironment{questionblock}{\begin{alertblock}}{\end{alertblock}} +\newenvironment{hintblock}{\begin{block}}{\end{block}} +\newenvironment{answerblock}{\begin{exampleblock}}{\end{exampleblock}} + + +\pgfdeclareimage[height=8mm]{logo-eads}{logo/eads} +\logo{\href{http://www.eads.net}{\pgfuseimage{logo-eads}}} + + +\AtBeginSubsection[] +{ + \begin{frame}<beamer>[shrink] + \frametitle{Outline} + \tableofcontents[currentsection,currentsubsection] + \end{frame} +} + + +%\AtBeginPart{\frame{\partpage}} + +\subject{Binary manipulation with Miasm } +\title{Miasm\\ +(incomprehensible documentation)} +\date{} + + + +\institute[EADS/SE/CS]{ + \texttt{serpilliere at droids-corp 0rg}\\ + EADS Corporate Research Center --- IW/SE/CS\\ + IT sec Lab\\ + Suresnes, FRANCE +} + + +%\beamerdefaultoverlayspecification{<+->} + +\begin{document} + + +\begin{frame} %-=-=-=-=-=- + \titlepage +\end{frame} + + +\begin{frame}[shrink] %-=-=-=-=-=- + \frametitle{Outline} + \tableofcontents +\end{frame} + + + +%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% + +%%box style + +\tikzstyle{block} = [draw, fill=blue!20, rectangle, + minimum height=1em, minimum width=2em, + top color=white, bottom color=blue!20] + +\tikzstyle{block2} = [draw, fill=blue!20, rectangle, + minimum height=1em, minimum width=4em, + top color=white, bottom color=blue!20, + rounded corners=3mm] + +\tikzstyle{block3} = [draw, fill=blue!20, rectangle, + minimum height=2em, minimum width=2em, + top color=white, bottom color=blue!20, + rounded corners=3mm] + +\tikzset{usblayer/.style={ + rectangle,minimum size=6mm,% text width=10em, + very thick,draw=black!50, + top color=white,bottom color=black!20, + node distance = 2em, text centered, + font=\ttfamily}} + + +\tikzstyle{sum} = [draw, fill=blue!20, circle, node distance=1cm] +\tikzstyle{input} = [coordinate] +\tikzstyle{output} = [coordinate] +\tikzstyle{pinstyle} = [pin edge={to-,thin,black}] + + +\tikzset{pfield/.style={ + rectangle,minimum size=6mm, + very thick,draw=black!50, + top color=white,bottom color=black!20, + font=\ttfamily}} + + +\tikzset{conf/.style={ + rectangle,minimum size=6mm, text width=7em, + very thick,draw=black!50, + top color=white,bottom color=black!20, + node distance = 2em, text centered, + font=\ttfamily}} + +\tikzset{confep/.style={ + rectangle,minimum size=6mm, text width=3em, + very thick,draw=black!50, + top color=white,bottom color=black!20, + node distance = 2em, text centered, + font=\ttfamily}} + +\tikzset{usblayer/.style={ + rectangle,minimum size=6mm,% text width=10em, + very thick,draw=black!50, + top color=white,bottom color=black!20, + node distance = 2em, text centered, + font=\ttfamily}} + +\tikzset{epbox/.style={ + rectangle,minimum size=3mm, minimum width=6em, + very thick,draw=black!50, + top color=white,bottom color=black!20, + node distance = 0em, + text badly centered, + text width=8em, + font=\ttfamily}} + +\tikzset{bloc/.style={ + rectangle,minimum size=6mm, minimum width=7em, minimum height=2em, + very thick,draw=black!50, + top color=white,bottom color=black!20, + rounded corners, + font=\scriptsize}} + + + + + + +\section{Random manipulations} +\subsection{PE} + +\begin{frame}[fragile] + \frametitle{Elfesteem use} + + \begin{exampleblock}{EXE reading} + \begin{itemize} + \item EXE parsing + \item (MZ/PE/sections/Directories) + \end{itemize} + \end{exampleblock} + + \lstset{language=Python} + {\tiny\begin{lstlisting}[]{} +>>> from elfesteem import * +>>> e = pe_init.PE(open('calc.exe', 'rb').read()) +# section offset size addr flags rawsize + 0 .text 00000400 0126b0 00001000 60000020 00012800 + 1 .data 00012c00 00101c 00014000 c0000040 00000a00 + 2 .rsrc 00013600 008a88 00016000 40000040 00008c00 + \end{lstlisting}} +\end{frame} + + +\begin{frame}[fragile] + \frametitle{Accesses} + + \begin{exampleblock}{File view} + \lstset{language=Python} + {\tiny\begin{lstlisting}[]{} +>>> e.content[:4] +'MZ\x90\x00' + \end{lstlisting}} + \end{exampleblock} + + \begin{exampleblock}{RVA view} + \lstset{language=Python} + {\tiny\begin{lstlisting}[]{} +>>> e.drva[0x1000:0x1004] +'\xea"\xdaw' + \end{lstlisting}} + \end{exampleblock} + + \begin{exampleblock}{Virtual addesses view} + \lstset{language=Python} + {\tiny\begin{lstlisting}[]{} +>>> e.virt[0x1001000:0x1001004] +'\xea"\xdaw' + \end{lstlisting}} + \end{exampleblock} + +\end{frame} + + + + +\begin{frame}[fragile] + \frametitle{EXE attributes} + + \lstset{language=Python} + {\tiny\begin{lstlisting}[]{} +>>> e.DirImport +<Directory Import> + 0 <SHELL32.dll> <W-ImpDesc=76968/4294967295L/4294967295L/77378/4252> + 0 <148, ShellAboutW> + 1 <msvcrt.dll> <W-ImpDesc=77256/4294967295L/4294967295L/77664/4540> + 0 <82, __CxxFrameHandler> + 1 <71, _CxxThrowException> + 2 <824, wcstoul> + ... + \end{lstlisting}} + + \lstset{language=Python} + {\tiny\begin{lstlisting}[]{} +>>> e.DirRes +<ID RT_ICON subdir: 90192 None> + <ID RT_CURSOR subdir: 90528 None> + <ID 1036 data: 91152 <ResDataEntry=91576/744/1252/0>> + <ID RT_BITMAP subdir: 90552 None> + <ID 1036 data: 91168 <ResDataEntry=92320/296/1252/0>> + <ID RT_ICON subdir: 90576 None> + ... + \end{lstlisting}} + +\end{frame} + + + + + +\begin{frame}[fragile] + \frametitle{Common manipulation} + + \begin{exampleblock}{EXE generation} + \begin{itemize} + \item EXE creation + \item Default characteristics + \end{itemize} + \end{exampleblock} + + \lstset{language=Python} + {\scriptsize\begin{lstlisting}[]{} +e = PE() +open('uu.bin', 'wb').write(str(e)) + \end{lstlisting}} +\end{frame} + + + +\begin{frame}[fragile] + \begin{exampleblock}{Add a section to a binary} + \begin{itemize} + \item read the binary + \item add a section + \item generate binary + \end{itemize} + \end{exampleblock} + + \lstset{language=Python} + {\tiny\begin{lstlisting}[]{} +>>> e = PE(open('calc.exe', 'rb').read()) +# section offset size addr flags rawsize + 0 .text 00000400 0126b0 00001000 60000020 00012800 + 1 .data 00012c00 00101c 00014000 c0000040 00000a00 + 2 .rsrc 00013600 008a88 00016000 40000040 00008c00 +>>> s_XXX = e.SHList.add_section(name='XXX', addr = 0x20000, rawsize = 0x1000) +>>> open('out.bin', 'wb').write(str(e)) + +>>> PE(open('out.bin', 'rb').read()) +# section offset size addr flags rawsize + 0 .text 00000400 0126b0 00001000 60000020 00012800 + 1 .data 00012c00 00101c 00014000 c0000040 00000a00 + 2 .rsrc 00013600 008a88 00016000 40000040 00008c00 + 3 XXX 0001c200 001000 00020000 e0000020 00001000 + \end{lstlisting}} +\end{frame} + + + +\begin{frame}[fragile] + \begin{exampleblock}{Menu edition} + \begin{itemize} + \item read DirRes + \item find menu + \item modify + \item generate the binary + \end{itemize} + \end{exampleblock} + + \lstset{language=Python} + {\tiny\begin{lstlisting}[]{} +>>> e = PE(open('calc.exe', 'rb').read()) +>>> e.DirRes.resdesc.resentries + 0 <ID RT_ICON subdir: 90192 None>ResEntry + 1 <ID RT_MENU subdir: 90272 None>ResEntry + ... +>>> menu = e.DirRes.resdesc.resentries[1] +>>> menu.subdir.resentries + 0 <ID 106 subdir: 90720 None>ResEntry + 1 <ID 107 subdir: 90744 None>ResEntry +... + +>>> e.Opthdr.Optehdr[pe.DIRECTORY_ENTRY_BOUND_IMPORT].rva = 0 +>>> e.Opthdr.Optehdr[pe.DIRECTORY_ENTRY_BOUND_IMPORT].size = 0 + +>>> e.DirRes.resdesc.resentries[1].subdir.resentries[1].\ + subdir.resentries[0].data.s[8:22:2] +'Edition' +>>> e.DirRes.resdesc.resentries[1].subdir.resentries[1].\ + subdir.resentries[0].data.s[8:22] = "\x00".join([x for x in 'Toto'])+'\x00' +>>> open('out.bin.exe', 'wb').write(str(e)) + \end{lstlisting}} +\end{frame} + + +\begin{frame} + \begin{figure}[htp] + \begin{center} + \includegraphics[width=1\textwidth]{figs/calc_mod.eps} + \end{center} + \end{figure} +\end{frame} + + +\begin{frame} + \frametitle{Common case} + + \begin{exampleblock}{EXE generation} + \begin{itemize} + \item create an EXE + \item default characteristics + \item new text section with ``xC3'' (ret) + \item place entry point + \item add some imports + \item $\rightarrow$ The binary is ready + \end{itemize} + \end{exampleblock} + +\end{frame} + + +\begin{frame}[fragile] + + \lstset{language=Python} + {\tiny\begin{lstlisting}[]{} +e = PE() +mysh = "\xc3" +s_text = e.SHList.add_section(name = "text", addr = 0x1000, rawsize = 0x1000, data = mysh) +e.Opthdr.Opthdr.AddressOfEntryPoint = s_text.addr +new_dll = [({"name":"kernel32.dll", + "firstthunk":s_text.addr+0x100}, + ["CreateFileA", "SetFilePointer", "WriteFile", "CloseHandle"] + ) + , + ({"name":"USER32.dll", + "firstthunk":None}, + ["SetDlgItemInt", "GetMenu", "HideCaret"] + ) + ] +e.DirImport.add_dlldesc(new_dll) +s_myimp = e.SHList.add_section(name = "myimp", rawsize = 0x1000) +e.DirImport.set_rva(s_myimp.addr) +open('uu.bin', 'wb').write(str(e)) + \end{lstlisting}} +\end{frame} + +\begin{frame}[fragile] + \frametitle{Ida listing:} + \tiny\begin{verbatim} + ;******************************************************************x + ; section 1 <text> x + ; virtual address 00001000 virtual size 00001000 x + ; file offset 00001000 file size 00001000 x + ;******************************************************************x + x + ;**************************** x + ; program entry point x + ;**************************** x + entrypoint: x + ret x + \end{verbatim} +\end{frame} + + + + + + +\subsection{Assembleur/Dsassembleur} + + + + + +\begin{frame} + \frametitle{Miasm} + + \begin{block}{Goal} + \begin{itemize} + \item Asm/DisAsm x86/PPC/ARM + \item Work on multi sources + \item (str/shellcode txt/PE/ELF/.S) + \item assembly to intermediate language + \item emulate intermediate language (in an environment) + \item Snapshot/restore + \item library of emulation + \item ... + \end{itemize} + \end{block} + +\end{frame} + + +\begin{frame}[fragile] + \frametitle{Common cases} + + \begin{exampleblock}{Dis/Asm} + \begin{itemize} + \item work on bytes/asm text/container + \item mini integrated linker + \item graph generation + \item ... + \end{itemize} + \end{exampleblock} + + + \lstset{language=Python} + {\tiny\begin{lstlisting}[]{} +>>> from x86_escape.x86_escape import * +>>> l = x86_mn.dis('\x90') +>>> str(l) +'nop ' +>>> x86_mn.asm('nop') +['\x90'] +>>> x86_mn.asm('inc eax') +['@', '\xff\xc0'] +>>> str(x86_mn.dis('@')) +'inc eax' +>>> str(x86_mn.dis('\xff\xC0')) +'inc eax' + \end{lstlisting}} +\end{frame} + + + +\begin{frame}[fragile] + \frametitle{assembling x86 bloc} + + \lstset{language=Python} + {\tiny\begin{lstlisting}[]{} +all_bloc, symbol_pool = parse_asm.parse_txt(x86_escape.x86mnemo,r''' +main: + push 0 + push title + push msg + push 0 + call test_call + ret +test_call: + nop + ret +title: +.string "My box" +msg: +.string "My msg!" +''') + + +#fix shellcode addr +symbol_pool.add(asmbloc.asm_label('base_address', 0)) +symbol_pool.getby_name("main").offset = 0 + +####graph sc#### +g = asmbloc.bloc2graph(all_bloc[0]) +open("graph.txt" , "w").write(g) + + \end{lstlisting}} +\end{frame} + +\begin{frame} + \begin{figure}[htp] + \begin{center} + \includegraphics[width=1\textwidth]{figs/gen_graph.eps} + \end{center} + \end{figure} +\end{frame} + + + +\begin{frame}[fragile] + \frametitle{shell code generation} + \lstset{language=Python} + {\tiny\begin{lstlisting}[]{} +f = open('out.bin', 'wb') +for p in patches: + f.seek(p) + f.write(patches[p]) +f.close() + \end{lstlisting}} +\end{frame} + + +\begin{frame}[fragile] + \begin{block}{Dump hexa} + \tiny\begin{verbatim} +x00000000 6a 00 6a 18 6a 10 6a 00-e8 01 00 00 00 c3 90 c3 |j j?j?j ?? ???| +x00000010 4d 79 20 6d 73 67 21 00-4d 79 20 62 6f 78 00 |My msg! My box | + \end{verbatim} + \end{block} + \begin{block}{Disassemble} + \tiny\begin{verbatim} +x00000000 6a00 push 0x0 +x00000002 6a18 push 0x18 +x00000004 6a10 push 0x10 +x00000006 6a00 push 0x0 +x00000008 e801000000 call 0xe +x0000000d c3 ret +x0000000e 90 nop +x0000000f c3 ret + \end{verbatim} + \end{block} + +\end{frame} + + +\begin{frame} + \frametitle{In the next slide...} + + \begin{block}{PE generation} + \begin{itemize} + \item generate a working PE + \item with imports + \item some code + \item which displays a dialog box + \item ... + \end{itemize} + \end{block} + +\end{frame} + + +\begin{frame}[fragile] + \lstset{language=Python} + {\tiny\begin{lstlisting}[]{} +#! /usr/bin/env python +from x86_escape import * +from elfesteem import * + +e = pe_init.PE() +s_text = e.SHList.add_section(name = "text", addr = 0x1000, rawsize = 0x100) +s_iat = e.SHList.add_section(name = "iat", rawsize = 0x100) +new_dll = [({"name":"USER32.dll","firstthunk":s_iat.addr}, ["MessageBoxA"])] + +e.DirImport.add_dlldesc(new_dll) +s_myimp = e.SHList.add_section(name = "myimp", rawsize = len(e.DirImport)) +e.DirImport.set_rva(s_myimp.addr) +all_bloc, symbol_pool = parse_asm.parse_txt(x86_escape.x86mnemo,r''' +main: + push 0 + push title + push msg + push 0 + call [MessageBoxA] + ret +title: +.string "My box" +msg: +.string "My msg!" +''') +symbol_pool.add(asmbloc.asm_label('base_address', 0)) +symbol_pool.getby_name("MessageBoxA").offset = e.DirImport.get_funcvirt('MessageBoxA') +symbol_pool.getby_name("main").offset = e.rva2virt(s_text.addr) +resolved_b, patches = asmbloc.asm_resolve_final(x86_escape.x86mnemo, all_bloc[0], symbol_pool, []) +for p in patches: + e.virt[p] = patches[p] +e.Opthdr.Opthdr.AddressOfEntryPoint = e.virt2rva(symbol_pool.getby_name("main").offset) +open('uu.bin', 'wb').write(str(e)) + \end{lstlisting}} + +\end{frame} + + +\begin{frame} + \begin{figure}[htp] + \begin{center} + \includegraphics[width=0.3\textwidth]{figs/msgbox.eps} + \end{center} + \end{figure} +\end{frame} + +\subsection{Graphe} +\begin{frame} + \begin{figure}[htp] + \begin{center} + \includegraphics[width=0.9\textwidth]{figs/gandalf_01.eps} + \end{center} + \end{figure} +\end{frame} + + +\subsection{Introduction to intermediate language} + +\begin{frame}[fragile] + \frametitle{Instruction semantic} + + \begin{block}{Intermediate language} + \begin{itemize} + \item the instruction is composed of operations + \item each operation is executed in parallel + \item example: cmpsb + \end{itemize} + \end{block} + + \lstset{language=Python} + {\tiny\begin{lstlisting}[]{} +def cmpsb(): + e= [] + e+=l_cmp(ExprMem(esi, 8), ExprMem(edi, 8)) + e.append(ExprAff(edi, ExprCond(df, ExprOp('+', edi, ExprInt(uint32(1))), ExprOp('-', edi, ExprInt(uint32(1)))))) + e.append(ExprAff(esi, ExprCond(df, ExprOp('+', esi, ExprInt(uint32(1))), ExprOp('-', esi, ExprInt(uint32(1)))))) + return e + \end{lstlisting}} +\end{frame} + + +\begin{frame}[fragile] + \frametitle{cmpsb semantic} + + \lstset{language=Python} + {\tiny\begin{lstlisting}[]{} +>>> from x86_escape import ia32_sem +>>> e = ia32_sem.cmpsb() +>>> for x in e: +... print str(x) +... +zf = (== (- @8[esi] @8[edi]) 0x0) +nf = (& (== 0x1 (>> (- @8[esi] @8[edi]) 0x7)) 0x1) +pf = (parity (- @8[esi] @8[edi])) +cf = (| (& (== (== 0x1 (>> @8[esi] 0x7)) 0x0) (== 0x1 (>> @8[edi] 0x7))) (& (== 0x1 (>> (- @8[esi] @8[edi]) 0x7)) (| (== (== 0x1 (>> @8[esi] 0x7)) 0x0) (== 0x1 (>> @8[edi] 0x7))))) +of = (| (& (== (== 0x1 (>> (- @8[esi] @8[edi]) 0x7)) 0x1) (& (== (== 0x1 (>> @8[esi] 0x7)) 0x0) (== 0x1 (>> @8[edi] 0x7)))) (& (== (== 0x1 (>> (- @8[esi] @8[edi]) 0x7)) 0x0) (& (== 0x1 (>> @8[esi] 0x7)) (== (== 0x1 (>> @8[edi] 0x7)) 0x0)))) +af = (== (& (- @8[esi] @8[edi]) 0x10) 0x10) +edi = df?((+ edi 0x1),(- edi 0x1)) +esi = df?((+ esi 0x1),(- esi 0x1)) + \end{lstlisting}} +\end{frame} + + + +\begin{frame}[fragile] + \frametitle{Manipulation example} + + \begin{block}{registers touched by an instruction} + \lstset{language=Python} + {\tiny\begin{lstlisting}[]{} +>>> from analysis_helper import * +>>> r, w = get_rw(ia32_sem.cmpsb()) +>>> r, w +(set_expr[@8[edi], @8[esi], df, edi, esi], set_expr[zf, nf, pf, cf, of, af, edi, esi]) + \end{lstlisting}} + \end{block} +\end{frame} + +\section{Langage intermdiaire} +\subsection{Description du langage} + + +\begin{frame} + \begin{block}{Expressions} + \begin{itemize} + \item ExprInt: interger + \item ExprId: identifier (variable) + \item ExprAff: a = b + \item ExprCond: a?b:c + \item ExprMem: dword ptr [a] + \item ExprOp: op(a, b, ...) + \item ExprSlice: a[0:8] (bits) + \item ExprCompose: slices composition + \item ExprSliceTo: position in a composition + \end{itemize} + \end{block} +That's all. +\end{frame} + +\begin{frame}[fragile] + \begin{exampleblock}{Some expressions} + \lstset{language=Python} + {\tiny\begin{lstlisting}[]{} +>>> from expression import * +>>> a = ExprId('A', 32) +>>> b = ExprId('B', 32) +>>> c = ExprId('C', 32) +>>> o = a+b +>>> print o +(A + B) +>>> print ExprAff(c, o) +C = (A + B) + \end{lstlisting}} + \end{exampleblock} + \begin{exampleblock}{Definition of some instructions} +\begin{tabular}{ l l } + \lstset{language=Python} + {\tiny\begin{lstlisting}[]{} +def mov(a, b): + return [ExprAff(a, b)] + +def xchg(a, b): + e = [] + e.append(ExprAff(a, b)) + e.append(ExprAff(b, a)) + return e + \end{lstlisting}}& + \lstset{language=Python} + {\tiny\begin{lstlisting}[]{} +def update_flag_zf(a): + cast_int = tab_uintsize[a.get_size()] + return [ExprAff(zf, ExprOp('==', + a, + ExprInt(cast_int(0))))] +def update_flag_nf(a): + return [ExprAff(nf, ExprOp('&', + get_op_msb(a), + ExprInt(tab_uintsize[a.get_size()](1))))] + \end{lstlisting}} +\end{tabular} + \end{exampleblock} +\end{frame} + + +\subsection{Module de simplification d'expression} +\begin{frame}[fragile] + \begin{block}{The language has simplification rules} + \begin{itemize} + \item X + Y - Y : X + \item - (-X) : X + \item X +int1 + int2 : X+int3 (=int1 + int2) + \item ... + \end{itemize} + \end{block} + +\begin{exampleblock}{Example} +\begin{tabular}{ l l } + \lstset{language=Python} + {\tiny\begin{lstlisting}[]{} +>>> print o +(A + B) +>>> p = o - b +>>> print p +((A + B) - B) +>>> print expr_simp(p) +A + \end{lstlisting}}& + \lstset{language=Python} + {\tiny\begin{lstlisting}[]{} +>>> q = (a - ExprInt(uint32(1))) + ExprInt(uint32(3)) +>>> print q +((A - 0x1) + 0x3) +>>> print expr_simp(q) +(A + 0x2) + \end{lstlisting}} +\end{tabular} +\end{exampleblock} +\end{frame} + +\subsection{Symbolic execution} +\begin{frame}[fragile] + \begin{block}{Assembly to intermediate language} + \begin{itemize} + \item expressions representing instructions are execution simultaneously + \item affectations are done into a memory representation + \item (a dictionary) + \item the key is the identifier (non reducible) + \end{itemize} + \end{block} + + \begin{block}{interpretation machine} + \begin{itemize} + \item It defines usable registers + \end{itemize} + {\tiny\begin{lstlisting}[]{} +machine = eval_abs({esp:init_esp, ebp:init_ebp, eax:init_eax, ebx:init_ebx, + ecx:init_ecx, edx:init_edx, esi:init_esi, edi:init_edi, + cs:ExprInt(uint32(9)), + zf : ExprInt(uint32(0)), nf : ExprInt(uint32(0)), + pf : ExprInt(uint32(0)), of : ExprInt(uint32(0)), + cf : ExprInt(uint32(0)), tf : ExprInt(uint32(0)),... + tsc1: ExprInt(uint32(0)), dr7:ExprInt(uint32(0)),...}, + mem_read_wrap, + mem_write_wrap, ) + + \end{lstlisting}} + \end{block} + +\end{frame} + + +\begin{frame}[fragile] + \begin{exampleblock}{Example} + \lstset{language=Python} + {\tiny\begin{lstlisting}[]{} +>>> l = x86_mn.dis("\x43") +>>> print l +inc ebx +>>> ex = get_instr_expr(l, eip) +>>> for e in ex: +... print e +... +zf = ((ebx + 0x1) == 0x0) +nf = ((0x1 == ((ebx + 0x1) >> 0x1F)) & 0x1) +... +ebx = (ebx + 0x1) + \end{lstlisting}} + \end{exampleblock} + + \begin{exampleblock}{Example} + \lstset{language=Python} + {\tiny\begin{lstlisting}[]{} +>>> machine = eval_abs(dict(init_state)) +>>> print machine.pool[ebx] +init_ebx +>>> my_eip, mem_dst = emul_full_expr(ex, l, ExprInt(uint32(0)), None, machine) +>>> print machine.pool[ebx] +(init_ebx + 0x1) +>>> print machine.pool[zf] +((init_ebx + 0x1) == 0x0) + \end{lstlisting}} + \end{exampleblock} +\end{frame} + +\section{Jit compilation} +\subsection{Principle} +\begin{frame} + + \begin{block}{Memory} + \begin{itemize} + \item The memory is defined by zones + \item size, accesses and data + \item (for example a binary section) + \item it maps \emph{real addresses} to \emph{virtual addresses} + \end{itemize} + \end{block} + \begin{block}{translation} + \begin{itemize} + \item the code is disassembled + \item translated on the fly using semantic representation + \item and intermediate code is generated to C code and compiled + \end{itemize} + \end{block} +\end{frame} + + +\begin{frame} + \begin{block}{Emulation exception} + \begin{itemize} + \item if a translated bloc is modified, it is deleted from cache + \item and regenerated if pc reach it again (cache miss) + \item if errors, python is called back to deal it + \item for example, we can emulate windows SEH mechanism + \item Emulation des api + \end{itemize} + \end{block} +\end{frame} + + + + +\begin{frame} +\begin{center} + +\begin{tikzpicture}[node distance = 1.2cm, auto] + + \node [bloc] (runtime) {RunTime}; + \node [bloc, xshift=2cm,yshift=-1.5cm] (disasm) at (runtime) {disassemble}; + \node [bloc, below of=disasm] (inter) {intermediate language}; + \node [bloc, below of=inter] (ccode) {C Code}; + \node [bloc, below of=ccode] (python) {Python module}; + + \node [bloc, xshift=-2cm,yshift=-1.5cm] (supprcode) at (runtime) {Suppr code}; + + \draw[->] (runtime) -- (disasm) node[midway] {cache miss}; + \draw[->] (disasm) -- (inter); + \draw[->] (inter) -- (ccode); + \draw[->] (ccode) -- (python); + \draw[->, looseness=1] (python) to [bend right=95] (runtime); + + \draw[->, looseness=3] (runtime) to [out = 135, in=35] (runtime); + + + \draw[->] (runtime) to [bend right=20] node[midway, left] {auto mod} (supprcode) ; + \draw[->] (supprcode) to [bend right=40] (runtime); + +\end{tikzpicture} +\end{center} +\end{frame} + + +\begin{frame}[fragile] + \frametitle{C translation} + \lstset{language=C} + {\tiny\begin{lstlisting}[]{} +unsigned int bloc_0080400B(void) +{ + loc_0080400B: + //pop eax + vmcpu.eax_new = MEM_LOOKUP_32(vmcpu.esp); + vmcpu.esp_new = (((vmcpu.esp&0xffffffff) + (0x4&0xffffffff))&0xffffffff); + + if (vmcpu.vm_exception_flags > EXCEPT_NUM_UDPT_EIP) { + vmcpu.eip = 0x80400B; + return (unsigned int)vmcpu.eip; + } + + vmcpu.eax = vmcpu.eax_new; + vmcpu.esp = vmcpu.esp_new; + + if (vmcpu.vm_exception_flags) { + vmcpu.eip = (vmcpu.vm_exception_flags > EXCEPT_NUM_UDPT_EIP) ? 0x80400B : 0x80400C; + return (unsigned int)vmcpu.eip; + } + + loc_0080400C: + //mov ebx, eax + vmcpu.ebx_new = vmcpu.eax; + + if (vmcpu.vm_exception_flags > EXCEPT_NUM_UDPT_EIP) { + vmcpu.eip = 0x80400C; + return (unsigned int)vmcpu.eip; + } + \end{lstlisting}} +\end{frame} + + +\begin{frame}[fragile] + \frametitle{translation, memory accesses} + + \begin{exampleblock}{Assembly code} + \lstset{language=[x86masm]Assembler} + {\tiny\begin{lstlisting}[]{} +movzx eax, ds:byte_410360[ecx] + \end{lstlisting}} + \end{exampleblock} + + \begin{exampleblock}{C code} + \lstset{language=C} + {\tiny\begin{lstlisting}[]{} +//movzx eax, byte ptr [ecx+{<asmlabel (unsigned int)&tab_00410340[0x20] >: 1}] +eax_new = (((0x0 & (0xFFFFFFFF>>(32-24))) << 8) | ((MEM_LOOKUP(8, (((ecx&0xffffffff) + + ((unsigned int)&tab_00410340[0x20]&0xffffffff))&0xffffffff)) & (0xFFFFFFFF>>(32-8))) << 0)); +eax = eax_new; + \end{lstlisting}} + \end{exampleblock} + + +\end{frame} + + +\subsection{Exemples jit} +\begin{frame}[fragile] + \frametitle{Demo: assembly code} +{\tiny\begin{semiverbatim} +objdump -D -b binary -m i386 -Maddr32,data32,intel sc_test.bin +sc_test.bin: file format binary +Disassembly of section .data: +00000000 <.data>: + 0: b8 ef be 37 13 mov eax,0x1337beef + 5: b9 04 00 00 00 mov ecx,0x4 + a: c1 c0 08 rol eax,0x8 + d: e2 fb loop 0xa + f: c3 ret + \end{semiverbatim}} +\end{frame} + + +\begin{frame}[fragile] + \begin{block}{Memory creation} + \lstset{language=Python} + {\tiny\begin{lstlisting}[]{} +code_ad = 0x20000 +vm_add_memory_page(code_ad, PAGE_READ|PAGE_WRITE|PAGE_EXEC, open("sc_test.bin").read()) +stack_base_ad = 0x1230000 +stack_size = 0x10000 +vm_add_memory_page(stack_base_ad, PAGE_READ|PAGE_WRITE, "\x00"*stack_size) +dump_memory_page_pool_py() + +regs = vm_get_gpreg() +regs['eip'] = code_ad +regs['esp'] = stack_base_ad+stack_size +vm_set_gpreg(regs) +dump_gpregs_py() + + \end{lstlisting}} + \end{block} + + \begin{exampleblock}{Result} + {\tiny\begin{semiverbatim} +Memory +ad 00020000 size 00000025 RWX hpad 0x8cd5000 +ad 01230000 size 00010000 RW_ hpad 0x8ce8000 +Registers +eip 00020000 eax 00000000 ebx 00000000 ecx 00000000 edx 00000000 +esi 00000000 edi 00000000 esp 01240000 ebp 00000000 + \end{semiverbatim}} + \end{exampleblock} + +\end{frame} + +\begin{frame}[fragile] + \begin{block}{Memory creation} + \lstset{language=Python} + {\tiny\begin{lstlisting}[]{} +vm_push_uint32_t(0) +vm_push_uint32_t(0) +vm_push_uint32_t(0x1337beef) + +symbol_pool = asmbloc.asm_symbol_pool() + +known_blocs = {} +code_blocs_mem_range = [] + +log_regs = True +log_mn = True +must_stop = False +def run_bin(my_eip, known_blocs, code_blocs_mem_range): + while my_eip != 0x1337beef: + if not my_eip in known_blocs: + updt_bloc_emul(known_blocs, in_str, my_eip, symbol_pool, code_blocs_mem_range, log_regs = log_regs, log_mn = log_mn) + try: + my_eip = vm_exec_blocs(my_eip, known_blocs) + except KeyboardInterrupt: + must_stop = True + py_exception = vm_get_exception() + if py_exception: + raise ValueEror("except at", hex(my_eip)) + +print "start run" +run_bin(code_ad, known_blocs, code_blocs_mem_range) + \end{lstlisting}} + \end{block} + +\end{frame} + + + + +\begin{frame}[fragile] + + \begin{exampleblock}{Result} + {\tiny\begin{semiverbatim} + eax 00000000 ebx 0000... +mov eax, 0x1337BEEF ... + eax 1337BEEF ebx 0000... +mov ecx, 0x00000004 ... + eax 1337BEEF ebx 0000... +rol eax, 0x00000008 ... + eax 37BEEF13 ebx 0000... +loop loc_0002000A ... +loc_0002000A ... + eax 37BEEF13 ebx 0000... +rol eax, 0x00000008 ... + eax BEEF1337 ebx 0000... +loop loc_0002000A ... +loc_0002000A ... + eax BEEF1337 ebx 0000... +rol eax, 0x00000008 ... + eax EF1337BE ebx 0000... +loop loc_0002000A ... +loc_0002000A ... + eax EF1337BE ebx 0000... +rol eax, 0x00000008 ... + eax 1337BEEF ebx 0000... +loop loc_0002000A ... +loc_0002000F ... + eax 1337BEEF ebx 0000... +ret + \end{semiverbatim}} + \end{exampleblock} + +\end{frame} + + + + + +\begin{frame}[fragile] + \begin{block}{Interaction} + \lstset{language=Python} + {\tiny\begin{lstlisting}[]{} +>>> vm_get_gpreg() +{'eip': 322420463, 'esp': 19136504, 'edi': 0, 'eax': 322420463, + 'ebp': 0, 'edx': 0, 'ebx': 0, 'esi': 0, 'ecx': 0} +>>> vm_get_str(code_ad, 0x10) +'\xb8\xef\xbe7\x13\xb9\x04\x00\x00\x00\xc1\xc0\x08\xe2\xfb\xc3' + \end{lstlisting}} + \end{block} + +\end{frame} + +\section{Exemples} + + + +\subsection{Hooks, gadget finder, ...} + +\begin{frame} + \begin{block}{Goal: hook in calc.exe} + \begin{itemize} + \item spot interesting code + \item find characteristic code + \item generate a hook + \end{itemize} + \end{block} +\end{frame} + +\begin{frame}[fragile] + \frametitle{Code search} + { + \tiny\begin{verbatim} +#op code call[XXX] +p = "\xFF\x15"+ struct.pack('L', ad_setwtext) +p = re.escape(p) +candidates = [x.start() for x in re.finditer(p, e.content)] +candidates = [e.off2virt(x) for x in candidates] + +#search func setdisplaytext +found = False +for c in candidates: + #ad = guess_func_start(e, c) + job_done = set() + symbol_pool = asmbloc.asm_symbol_pool() + try: + all_bloc = asmbloc.dis_bloc_all(x86_mn, in_str, c, job_done, symbol_pool) + except: + continue + #filter on setfocus caller + for b in all_bloc: + l = b.lines[-1] + if not l.m.name == "call" or not x86_afs.imm in l.arg[0]: + continue + if l.arg[0][x86_afs.imm] == ad_setfocus: + found = c +if not found: + raise ValueError("caanot finc setdisplaytext") +ad = guess_func_start(e, found) +print "setdisplaytext:", hex(ad) + \end{verbatim} + } +\end{frame} + + +\begin{frame}[fragile] + \frametitle{Hook example} + { + \tiny\begin{verbatim} +h.add_hook(aes_init_ad, + { + "1_aes_init_key":(0x20, "push ecx"), + }) +... +h.add_hook(rsa_enc_priv_ad, + { + "1_seckey":(0x140, 'push [esp+0x34]'), + "2_txt":(0x80, 'push [esp+0x34]'), + "3_mod":(0x80, 'push [esp+0x34]') + }) +... +h.add_hook(pwd_chk_ad, + {"1_pwd":(''' + push [ebp+8] + call [lstrlenA] + push eax''', 'push ecx'), + "2_stack":(0x80, 'push [esp+0x30]')}) + + \end{verbatim} + } +\end{frame} + + +\begin{frame}[fragile] + \frametitle{Hook creation} + { + \tiny\begin{verbatim} +h = hooks(in_str, symbol_pool, gen_data_log_code = False) + +hname = h.add_hook(ad, + { + "1_DONT_LOG":(''' + mov eax, [ebp+8] + cmp byte ptr [eax], 0x31 + jnz out + cmp byte ptr [eax+2], 0x33 + jnz out + cmp byte ptr [eax+4], 0x33 + jnz out + cmp byte ptr [eax+6], 0x37 + jnz out + cmp byte ptr [eax+6], 0x2c + jnz out + push 0 + push mtitle + push mtxt + push 0 + call [MessageBoxA] + + + out: + ''', 'push [esp+0x30]')}, + ['mtitle:\n.string "title"', 'mtxt:\n.string "txt"']) + \end{verbatim} + } +\end{frame} + +\begin{frame}[fragile] + \frametitle{Binary modification} + { + \tiny\begin{semiverbatim} +all_bloc = h.all_bloc + +symbol_pool.add(asmbloc.asm_label('base_address', 0)) +symbol_pool.getby_name("MessageBoxA").offset = e.DirImport.get_funcvirt('MessageBoxA') +symbol_pool.getby_name(hname).offset = e.rva2virt(sh_ad) + +symb_reloc = {} +\textcolor{blue}{#compilation du patch} +resolved_b, patches = asmbloc.asm_resolve_final(x86mnemo, all_bloc[0], symbol_pool, [(0, sh_ad+e.Opthdr.Opthdr.ImageBase)], symb_reloc) +add_rels = [] +\textcolor{blue}{#ajout des nouvelles relocations} +for l, rels in symb_reloc.items(): + for x in rels: + add_rels.append(e.virt2rva(x+l.offset)) +\textcolor{blue}{#ajout des nouveaux imports} +s_myimp = e.SHList.add_section(name = "myimp", rawsize = len(e.DirImport)) +e.DirImport.set_rva(s_myimp.addr) +\textcolor{blue}{#patch du binaire} +for p in patches: + e.virt[p] = patches[p] +\textcolor{blue}{#reconstruction du binaire} +open('calc_mod.exe', 'wb').write(str(e)) + \end{semiverbatim} + } +\end{frame} + +\begin{frame} +\frametitle{Go Go Gadget} + \begin{block}{Goal: find eip/esp control} + \begin{itemize} + \item binary mapping into memory + \item Memory creation + \item add context informations to a program + \item start interpretation: \begin{itemize} + \item sweep on each code address range + \item execution maximum 10 instruction (for instance) + \item analyzes symbolic memory + \item filter interesting results + \end{itemize} + \end{itemize} + \end{block} +\end{frame} + + +\begin{frame}[fragile] + \begin{exampleblock}{Loading of a binary dump} + \lstset{language=Python} + {\tiny\begin{lstlisting}[]{} +data = open(fname, 'rb').read() +in_str = bin_stream_vm() +init_memory_page_pool_py() +init_code_bloc_pool_py() +vm_add_memory_page(0x10000000, PAGE_READ|PAGE_WRITE, data) + \end{lstlisting}} + \end{exampleblock} + \begin{exampleblock}{variable creation} + \lstset{language=Python} + {\tiny\begin{lstlisting}[]{} +arg1 = ExprId('ARG1', 32, True) +arg2 = ExprId('ARG2', 32, True) +ret1 = ExprId('RET1', 32, True) + \end{lstlisting}} + \end{exampleblock} + \begin{exampleblock}{machine creation} + \lstset{language=Python} + {\tiny\begin{lstlisting}[]{} +machine = eval_abs({esp:init_esp, ebp:init_ebp, eax:init_eax, ebx:init_ebx, + ecx:init_ecx, edx:init_edx, esi:init_esi, edi:init_edi, + cs:ExprInt(uint32(9)), + zf : ExprInt(uint32(0)), nf : ExprInt(uint32(0)), + of : ExprInt(uint32(0)), cf : ExprInt(uint32(0)), + ... +\end{lstlisting}} + \end{exampleblock} +\end{frame} + + +\begin{frame}[fragile] + \begin{exampleblock}{add context execution} + \lstset{language=Python} + {\tiny\begin{lstlisting}[]{} +machine.eval_instr(push(arg2)) +machine.eval_instr(push(arg1)) +machine.eval_instr(push(ret1)) +machine.eval_instr(push(ebp)) +machine.eval_instr(mov(ebp, esp)) +machine.eval_instr(sub(esp, ExprInt(uint32(0x14)))) +machine.eval_instr(mov(eax, ExprMem(ebp + ExprInt(uint32(8))))) +machine.eval_instr(mov(edx, ExprMem(eax + ExprInt(uint32(12))))) +machine.eval_instr(mov(eax, ExprMem(ebp + ExprInt(uint32(12))))) +machine.eval_instr(mov(ExprMem(esp), eax)) +machine.eval_instr(push(ExprInt(uint32(0x1337beef)))) + \end{lstlisting}} +(it could have been emulated as well) + \end{exampleblock} + + \lstset{language=Python} + {\tiny\begin{lstlisting}[]{} +print dump_reg(machine.pool) +eax ARG2 ebx init_ebx ecx init_ecx edx @32[(+ ARG1 0xC)] +esi init_esi edi init_edi esp (init_esp - 0x28) +ebp (init_esp - 0x10) zf ((init_esp - 0x24) == 0x0) + \end{lstlisting}} + +\end{frame} + +\begin{frame}[fragile] + \begin{exampleblock}{Filter results after symbolic execution} + \lstset{language=Python} + {\tiny\begin{lstlisting}[]{} +myesp = machine.pool[esp] +if not ('ARG' in str(myesp) or 'DATA' in str(myesp)): + continue +print "eip", my_eip +print "esp", myesp + \end{lstlisting}} + \end{exampleblock} + \begin{exampleblock}{Result} + {\tiny +\begin{verbatim} +0x10002ccf +eip @32[ARG2] +esp (ARG2 + 0x4) +Instructions: +xchg eax, esp +ret +\end{verbatim} + } + \end{exampleblock} +\end{frame} + + +\subsection{Conficker} +\begin{frame} + + \begin{block}{Binary protection} + \begin{itemize} + \item packed + \item the packer is split with indirect jmps + \end{itemize} + \end{block} + + \begin{block}{Result} + \begin{itemize} + \item Ida knowns each basic bloc + \item but cannot graph + \end{itemize} + \end{block} + + + \begin{exampleblock}{Quick Counter measure} + \begin{itemize} + \item find each indirect jumps + \item find destination + \item patch the binary + \end{itemize} + \end{exampleblock} + +\end{frame} + + +\begin{frame} + \begin{figure}[htp] + \begin{center} + \includegraphics[width=1\textwidth]{figs/conficker_1.eps} + \end{center} + \end{figure} +\end{frame} + + + + + +\begin{frame}[fragile] + \frametitle{indirect jump patching, binary regeneration} + \lstset{language=Python} + {\tiny\begin{lstlisting}[]{} +e = pe_init.PE(open('conficker.ese', 'rb').read()) +s_text = e.getsectionbyname('.text') +s_data = e.getsectionbyname('.data') + +for ad in xrange(ad_start, ad_end-15): + l1 = x86_mn.dis(e.virt[ad:ad+15]) + if not l1: continue + if not l1.m.name == 'jmp': continue + if l1.prefix: continue + + a = l1.arg[0] + if not x86_afs.ad in a or not x86_afs.imm in a: + continue + dst_ptr = a[x86_afs.imm] + if not (data_start <= dst_ptr < data_end): continue + continue + + dst_ad = struct.unpack('L', e.virt[dst_ptr:dst_ptr+4])[0] + if not( ad_start <= dst_ad < ad_end): continue + + e.virt[ad] = '\x90'*l1.l + e.virt[ad] = "\xE9"+struct.pack('l', dst_ad-(ad-1+l1.l)) + +open('out.bin', 'wb').write(str(e)) + + \end{lstlisting}} +\end{frame} + +\begin{frame} + \frametitle{Result: graph ok, but direct basic blocs are still splitted} + \begin{figure}[htp] + \begin{center} + \includegraphics[height=0.9\textheight]{figs/conficker_2.eps} + \end{center} + \end{figure} +\end{frame} + + + +\begin{frame}[fragile] + \frametitle{Disassembling: main function} + \lstset{language=Python} + {\tiny\begin{lstlisting}[]{} + +job_done = [] +symbol_pool = asmbloc.asm_symbol_pool() +all_bloc = asmbloc.dis_bloc_all(x86_mn, in_str, 0x100041f4, job_done, symbol_pool, follow_call = False, patch_instr_symb = False) + +#find call address +for b in all_bloc: + l = b.lines[-1] + if l.m.name != 'call': continue + + a = l.arg[0] + if not x86_afs.symb in a: continue + + dst,off = dict(a[x86_afs.symb]).popitem() + new_bloc = asmbloc.dis_bloc_all(x86_mn, in_str, off, job_done, symbol_pool, follow_call = False, patch_instr_symb = False) + all_bloc+=new_bloc + +lbl_start = symbol_pool.getby_offset(oep) +bloc_merge(all_bloc, symbol_pool, [lbl_start]) + \end{lstlisting}} +\end{frame} + +\begin{frame}[fragile] + \frametitle{clean binary regeneration} + \lstset{language=Python} + {\tiny\begin{lstlisting}[]{} +#code to PIC +for b in all_bloc: + del symbol_pool.s_offset[b.label.offset] + b.label.offset = None + +#patch entry point +all_bloc2, symbol_pool2 = parse_asm.parse_txt(x86_mn,r''' +dllentry: +jmp main +''') + +#fix shellcode addr +#symbol_pool.add(asmbloc.asm_label('base_address', 0)) +symbol_pool2.getby_name("main").offset = 0x10001000 +symbol_pool2.getby_name("dllentry").offset = 0x1000434B + +#merge our sc and disassembled function +all_bloc+=all_bloc2[0] +for x in symbol_pool2.s.keys(): + symbol_pool.add(symbol_pool2.s[x]) +... +open('out.bin', 'wb').write(str(e)) + \end{lstlisting}} +\end{frame} + + +\begin{frame} + \frametitle{Result} + \begin{figure}[htp] + \begin{center} + \includegraphics[height=0.9\textheight]{figs/conficker_3.eps} + \end{center} + \end{figure} +\end{frame} + +\begin{frame} + \frametitle{We can analyze import functions loader} + \begin{figure}[htp] + \begin{center} + \includegraphics[height=0.9\textheight]{figs/conficker_4.eps} + \end{center} + \end{figure} +\end{frame} + + + +\begin{frame}[fragile] + \frametitle{Dump and binary reconstruction} + \lstset{language=Python} + {\tiny\begin{lstlisting}[]{} +e = pe_init.PE() +e.Opthdr.Opthdr.ImageBase = 0x3a0000 + +data = open('_003A0000.mem', 'rb').read() +s_text = e.SHList.add_section(name = "text", addr = 0x0, data = data) +... +e.DirImport.add_dlldesc(new_dll) +s_myimp = e.SHList.add_section(name = "myimp", rawsize = len(e.DirImport)) +e.DirImport.set_rva(s_myimp.addr) + +open('out.bin', 'wb').write(str(e)) + \end{lstlisting}} +\end{frame} + +\begin{frame} + \frametitle{binary reconstruction} + \begin{figure}[htp] + \begin{center} + \includegraphics[width=0.9\textwidth]{figs/conficker_5.eps} + \end{center} + \end{figure} +\end{frame} + + +\subsection{mebroot} + +\begin{frame} + \frametitle{Obfuscated packer} + \begin{figure}[htp] + \begin{center} + \includegraphics[width=1\textwidth]{figs/mebroot_4.eps} + \end{center} + \end{figure} + \begin{figure}[htp] + \begin{center} + \includegraphics[width=1\textwidth]{figs/mebroot_1.eps} + \end{center} + \end{figure} +\end{frame} + +\begin{frame} + \frametitle{Packer obscurci} + \begin{figure}[htp] + \begin{center} + \includegraphics[width=1\textwidth]{figs/mebroot_2.eps} + \end{center} + \end{figure} +\end{frame} + + +\begin{frame} + + \begin{block}{Reconstruction} + \begin{itemize} + \item goal: find non analyzed code + \item Disassemble a bloc + \item guess fake jcc destination + \item group and simplify blocs + \item regenerate binary + \end{itemize} + \end{block} +\end{frame} + + +\begin{frame}[fragile] + \lstset{language=Python} + {\tiny\begin{lstlisting}[]{} +def get_mebbloc_instr(e, b): + if not b.lines: + return None + if b.lines[-1].m.name != "jnz": + return None + if b.lines[-2].m.name != "pop": + return None + if b.lines[-3].m.name != "test": + return None + ... + asmbloc.dis_bloc(x86mnemo, in_str, b, ad, job_done, symbol_pool, follow_call = False, patch_instr_symb = False) +... +asmbloc.bloc_merge(master_bloc, symbol_pool, call_ad) + \end{lstlisting}} +\end{frame} + + +\begin{frame} + \frametitle{Code reconstruit} + \begin{figure}[htp] + \begin{center} + \includegraphics[width=1\textwidth]{figs/mebroot_3.eps} + \end{center} + \end{figure} +\end{frame} + +\begin{frame} + \frametitle{re generated binary mapping} + \begin{figure}[htp] + \begin{center} + \includegraphics[width=1\textwidth]{figs/mebroot_4.eps} + \end{center} + \end{figure} + \begin{figure}[htp] + \begin{center} + \includegraphics[width=1\textwidth]{figs/mebroot_5.eps} + \end{center} + \end{figure} + + +\end{frame} + +\begin{frame} + \frametitle{Entry point} + \begin{figure}[htp] + \begin{center} + \includegraphics[height=0.8\textheight]{figs/mebroot_6.eps} + \end{center} + \end{figure} +\end{frame} + + + +\begin{frame} + \frametitle{Analysis} + \begin{block}{Reconstruction} + \begin{itemize} + \item The binary brute force its own key (hash) + \item Decipher itself + \item and decompress + \end{itemize} + \end{block} + + \begin{exampleblock}{We could borrow its own code} + \begin{itemize} + \item Disassemble deciphering code + \item Disassemble decompression code + \item Generate C code + \item and execute it on another ciphered code + \end{itemize} + \end{exampleblock} + +\end{frame} + + + +\begin{frame}[fragile] + + \begin{exampleblock}{Deciphering function emulation} + {\tiny + \begin{verbatim} +bsize: 33858 +bufs 0x976a000 0xb4bac008 +starting... +dyn_call to B4E6B480 +dyn_call to B4E6B300 +nop func called +... +dyn_call to B4E6B480 +dyn_call to B4E6B300 +nop func called +dyn_call to B4E6B480 +dyn_call to B4E6B300 +nop func called +dyn_call to B4E6B480 +dyn_call to B4E6B300 +nop func called +88B308C5 88B308C5 +C4FB632B C4FB632B +AA94D763 AA94D763 +5C2BB68F 5C2BB68F +end +ret len 33858 + + \end{verbatim} +} + \end{exampleblock} + + +\end{frame} + +\begin{frame}[fragile] + + \begin{exampleblock}{Decompression function code} + {\tiny + \begin{verbatim} +bsize: 33858 +bufs 0x947b000 0xb46b1008 +starting... +dyn_call to B4AFC3F0 +func alloc 828B0 (ret B462E008) +dyn_call to B4AFC5F0 +dyn_call to B4AFC3F0 +func alloc 3E6C (ret 94AF600) +dyn_call to B4AFC9D0 +dyn_call to B4AFC350 +func free 94AF600 (from 401FB5) +ret: 'MZ\x90\x00\x03\x00\x00\x00\x04\x00\x00\x00\xff\xff...' + \end{verbatim} +} + \end{exampleblock} + +\end{frame} + + + +\begin{frame} + \frametitle{Final step} + + \begin{exampleblock}{Second layer} + \begin{itemize} + \item The binary generate a new binary (driver) + \item It is packed as well + \item Redo previous steps + \item or use previous functions to decipher new binary + \end{itemize} + \end{exampleblock} + + \begin{figure}[htp] + \begin{center} + \includegraphics[width=1\textwidth]{figs/mebroot_7.eps} + \end{center} + \end{figure} +\end{frame} + + +\begin{frame} + \frametitle{Obfuscated functions} + \begin{figure}[htp] + \begin{center} + \includegraphics[height=0.8\textheight]{figs/mebroot_obf_01.eps} + \end{center} + \end{figure} +\end{frame} + + + +\tikzset{bloc/.style={ + rectangle,minimum size=6mm, minimum width=6em, + very thick,draw=black!50, + top color=white,bottom color=black!20, + rounded corners, + font=\scriptsize}} + + +\tikzset{mywave/.style={ + snake=expanding waves,segment length=2mm, segment angle=20}} + +\begin{frame} + +\begin{columns} + +\column{0.4\textwidth} + +\begin{bigcenter} +\begin{figure} +\scalebox{0.5}{ +\begin{tikzpicture}[node distance = 3cm,>=latex'] + \node [bloc] (b1) {b1}; + \node [bloc, below right of=b1] (b2) {b2}; + \node [bloc, below left of=b1] (b3) {b3}; + \node [bloc, below left of=b2] (b4) {b4}; + + \draw[->] (b1) -- (b2); + \draw[->] (b1) -- (b3); + \draw[->] (b2) -- (b4); + \draw[->] (b3) -- (b4); + +\end{tikzpicture} +} +\end{figure} +\end{bigcenter} +\column{0.4\textwidth} +\begin{bigcenter} +\scalebox{0.5}{ +\begin{tikzpicture}[node distance = 3cm,>=latex'] + \node [bloc] (b0) {\begin{minipage}{2cm}\begin{center}b0\\e = 0\end{center}\end{minipage}}; + + + \node [bloc, below of=b0] (dispatch) {dispatcher}; + + + \node [bloc, below left of=dispatch] (b2) {\begin{minipage}{2cm}\begin{center}b2\\e = 4\end{center}\end{minipage}}; + \node [bloc, left of=b2] (b1) {\begin{minipage}{2cm}\begin{center}b1\\e = [2,3]\end{center}\end{minipage}}; + \node [bloc, below right of=dispatch] (b3) {\begin{minipage}{2cm}\begin{center}b3\\e = 4\end{center}\end{minipage}}; + \node [bloc, right of=b3] (b4) {\begin{minipage}{2cm}\begin{center}b3\\e = ?\end{center}\end{minipage}}; + + + \draw[->] (b0) -- (dispatch); + \draw[->] (dispatch) -- (b1); + \draw[->] (dispatch) -- (b2); + \draw[->] (dispatch) -- (b3); + \draw[->] (dispatch) -- (b4); + + \draw[->] (b1) to [out = 135, in=180] (dispatch); + \draw[->] (b2) to [out = 135, in=180] (dispatch); + \draw[->] (b3) to [out = 45, in=0] (dispatch); + \draw[->] (b4) to [out = 45, in=0] (dispatch); + + + +\end{tikzpicture} +} +\end{bigcenter} +\end{columns} +\end{frame} + +\begin{frame} + \begin{block}{Reconstruction} + \begin{itemize} + \item disassemble a function + \item get semantic of each bloc + \item symbolic execution + \item get each bloc result of the automata + \item patch jcc + \item regenerate binary + \end{itemize} + \end{block} +\end{frame} + +\begin{frame} + \frametitle{Rsultat} + \begin{figure}[htp] + \begin{center} + \includegraphics[height=0.8\textheight]{figs/mebroot_obfdel_01.eps} + \end{center} + \end{figure} +\end{frame} + + + +\subsection{VM Study} + +\begin{frame} + \frametitle{first layer} + \begin{block}{Packer} + \begin{itemize} + \item The binary is ciphered by layers. + \item Just create an environment and emulate it with miasm. + \end{itemize} + \end{block} + \begin{center} + \includegraphics[width=0.7\textwidth]{figs/xxx_vm01.eps} + \end{center} +\end{frame} + + +\begin{frame} + \frametitle{First disassembling of vm mnemonic parsing} + \begin{center} + \includegraphics[width=0.7\textwidth]{figs/xxx_mnemo02.eps} + \end{center} +\end{frame} + +\begin{frame} + \frametitle{Obfuscation} + \begin{center} + \includegraphics[width=1.0\textwidth]{figs/xxx_mnemo03.eps} + \end{center} +\end{frame} + +\begin{frame} + \begin{block}{Solution} + \begin{itemize} + \item Callback is the disassembler engine + \item symbolic execution of its parents + \item Test if jcc is always true/false + \item and delete fake edges + \end{itemize} + \end{block} + +\end{frame} + +\begin{frame} + \frametitle{Result: simplified mnemonic parser} +\begin{tabular}{p{5cm} p{5cm} } + \includegraphics[width=0.08\textwidth]{figs/xxx_mnemo08.eps} + & + \includegraphics[width=0.13\textwidth]{figs/xxx_mnemo09.eps} +\end{tabular} + +\end{frame} + +\begin{frame} + \frametitle{End of parser: instruction dispatcher} + \begin{center} + \includegraphics[width=0.8\textwidth]{figs/xxx_mnemo10.eps} + \end{center} +\end{frame} + + +\begin{frame}[fragile] + \begin{exampleblock}{symbolic execution: touched variables} + {\tiny\begin{semiverbatim} +eax = ((((@8[init_esi] ^ init_ebx[0:8]) - 0xA8) ^ 0x1)_to[0:8], 0x0_to[8:32]) +ebx = ((init_ebx[0:8] - (((@8[init_esi] ^ init_ebx[0:8]) - 0xA8) ^ 0x1))_to[0:8], init_ebx[8:32]_to[8:32]) +esi = (init_esi + 0x1) +DST @32[((((((@8[init_esi] ^ init_ebx[0:8]) - 0xA8) ^ 0x1)_to[0:8], 0x0_to[8:32]) * 0x4) + init_edi)] + \end{semiverbatim}} + \end{exampleblock} + \begin{block}{Note} + \begin{itemize} + \item We need to follow modifications of ebx, esi, edi in each vm mnemonic + \item Those modifications are needed to known where disassembling next mnemonic + \end{itemize} + \end{block} +\end{frame} + +\begin{frame} + \frametitle{Disassembling correction} + \begin{center} + \includegraphics[width=0.8\textwidth]{figs/xxx_mnemo04.eps} + \end{center} +\end{frame} + +\begin{frame} + \frametitle{Bloc grouping} + \begin{center} + \includegraphics[width=1.0\textwidth]{figs/xxx_mnemo05.eps} + \end{center} +\end{frame} + +\begin{frame} + \frametitle{More than 150 vm mnemonic} + \begin{center} + \includegraphics[width=1.0\textwidth]{figs/xxx_mnemo07.eps} + \end{center} +\end{frame} + +\begin{frame} + \frametitle{Bloc analysis: erf} + \begin{center} + \includegraphics[width=0.6\textwidth]{figs/xxx_mnemo06.eps} + \end{center} +\end{frame} + + +\begin{frame}[fragile] + \frametitle{But symbolic execution (again :p)} +{\tiny\begin{semiverbatim} +Registers after a bloc execution + eax init_eax + ebx init_ebx + ecx (@16[init_esp]_to[0:16], init_ecx[16:32]_to[16:32]) + edx init_edx + esi init_esi + edi init_edi + esp (init_esp-0x2) + ebp init_ebp + +stack modification: + @16[(init_esp+0x2)] (@16[(init_esp+0x2)]<<(@8[init_esp]&0x1F)) + @32[(init_esp-0x2)] ((@8[init_esp]&0x1F)?(0x0,((@16[(init_esp+0x2)]>>(0x10-(@8[init_esp]&0x1F)))&0x1))_to[0:1], 0x1_to[1:2], (parity (@16[(init_esp+0x2)]<<(@8[init_esp]&0x1F)))_to[2:3], 0x0_to[3:4], (((init_esp+0x2)&0x10)==0x10)_to[4:5], 0x0_to[5:6], ((@16[(init_esp+0x2)]<<(@8[init_esp]&0x1F))==0x0)_to[6:7], ((0x1==((@16[(init_esp+0x2)]<<(@8[init_esp]&0x1F))>>0xF))&0x1)_to[7:8], 0x2_to[8:11], ((0x1==((@16[(init_esp+0x2)]<<(@8[init_esp]&0x1F))>>0xF))^((@16[(init_esp+0x2)]>>(0x10-(@8[init_esp]&0x1F)))&0x1))_to[11:12], 0x0_to[12:32]) + +Result: +\textcolor{blue}{a = pop16 +b = pop16 +push16(a<<b) +push32(eflag)} + \end{semiverbatim}} +\end{frame} + + +\begin{frame}[fragile] + \frametitle{Another example} +{\tiny\begin{semiverbatim} +---------- 12 0x6fab03 ---------- +eax = @32[init_esp] +@32[(init_esp+0x4)] (@32[(init_esp+0x4)]-@32[init_esp]) +@32[init_esp] (flags(@32[(init_esp+0x4)]-@32[init_esp])) +---------- 13 0x6fb100 ---------- +eax = @32[init_esp] +esp = (init_esp+0x4) +@32[(init_esp+0x4)] (@32[(init_esp+0x4)]^@32[init_esp]) +---------- 15 0x6fb3b2 ---------- +@32[(init_edi+0x1C)] (@32[(init_edi+0x1C)]&0xFFFFFBFF) +---------- 19 0x6fb6b8 ---------- +ecx = @32[init_esp] +esp = (init_esp+0x4) +@32[(init_esp+0x4)] (@32[(init_esp+0x4)]<<(@8[init_esp]&0x1F)) +---------- 21 0x6fb97e ---------- +eax = @32[init_esp] +@32[init_esp] @32[@32[init_esp]] +---------- 24 0x6fc3d1 ---------- +eax = ((((@16[init_esi]_to[0:16], init_eax[16:32]_to[16:32])+init_ebx)^0x18EE5784)-0x12C0A81E) +ebx = (init_ebx^((((@16[init_esi]_to[0:16], init_eax[16:32]_to[16:32])+init_ebx)^0x18EE5784)-0x12C0A81E)) +edx = (init_edx^((((@16[init_esi]_to[0:16], init_eax[16:32]_to[16:32])+init_ebx)^0x18EE5784)-0x12C0A81E)) +esi = (init_esi+0x2) +---------- 28 0x6fc935 ---------- +... +esp = (init_esp-0x4) +@32[(init_esp+0x4)] (@32[(init_esp+0x4)] umul32_hi @32[init_esp]) +@32[init_esp] (@32[(init_esp+0x4)] umul32_lo @32[init_esp]) +@32[(init_esp-0x4)] (0x2_to[0:2], (parity init_edi)_to[2:3], 0x0_to[3:4], (((init_esp+0x4)&0x10)==0x10)_to[4:5], 0x0_to[5:6], (init_edi==0x0)_to[6:7], ((0x1==(init_edi>>0x1F))&0x1)_to[7:8], 0x2_to[8:32]) + \end{semiverbatim}} +\end{frame} + +\begin{frame}[fragile] + \begin{block}{Instruct the interpreter} + \begin{itemize} + \item \verb?@32[(init_edi+0x1C)]? is the vm eflagest le eflag de la vm + \item we replace \verb?@8[(init_edi+0x28)]?, by REG1, REG2, ... + \item we replace \verb?esp+X? by registers \verb?arg32_0?, ... + \end{itemize} + \end{block} +\end{frame} + +\begin{frame}[fragile] + \frametitle{Instruction} + \lstset{language=Python} + {\tiny\begin{lstlisting}[]{} +known_vm_e = { + init_edi + ExprInt(uint32(0x1C)): regflag, + init_edi + ExprInt(uint32(0x20)): reg1, + init_edi + ExprInt(uint32(0x24)): reg2, + init_edi + ExprInt(uint32(0x28)): reg3, + init_edi + ExprInt(uint32(0x2C)): reg4, + init_edi + ExprInt(uint32(0x30)): reg5, + init_edi + ExprInt(uint32(0x34)): reg6, + init_edi + ExprInt(uint32(0x38)): reg7, + init_edi + ExprInt(uint32(0x3C)): reg8, + init_edi + ExprInt(uint32(0x40)): reg9, + + ExprMem(init_esp-ExprInt(uint32(4))): argm1_32, + ExprMem(init_esp-ExprInt(uint32(2))): argm1_16, + ExprMem(init_esp): arg0_32, + ExprMem(init_esp+ExprInt(uint32(4))): arg1_32, + ExprMem(init_esp, size = 16): arg0_16, + ExprMem(init_esp+ExprInt(uint32(2)), size=16): arg1_16, + ExprMem(init_esp, size = 8): arg0_08, + ExprMem(init_esp+ExprInt(uint32(4)), size=8): arg1_08, +} + \end{lstlisting}} +\end{frame} + +\begin{frame}[fragile] + \frametitle{Results} +{\tiny\begin{semiverbatim} +---------- 143 0x70a4f5 ---------- +esp = (init_esp - 0x4) +arg-1_32 = @32[init_edx] +\textcolor{blue}{=> push 32@[edx]} +---------- 151 0x70b1e1 ---------- +eax = arg1_32 +ecx = (arg1_32_to[0:8], ((0x1 == (arg1_08 >> 0x7)) == 0x1)?(0x0,0xFFFFFFFF)_to[8:32]) +esp = (init_esp + 0x4) +arg1_32 = (arg1_32_to[0:8], ((0x1 == (arg1_08 >> 0x7)) == 0x1)?(0x0,0xFFFFFFFF)_to[8:32]) +\textcolor{blue}{=> pop dum + pop X + movsx X, X8 + push X} +---------- 154 0x70b8b4 ---------- +ecx = (arg0_16_to[0:16], init_ecx[16:32]_to[16:32]) +esp = (init_esp - 0x2) +arg1_16 = (arg1_16 a>> (arg0_08 & 0x1F)) +arg-1_16 = ... flags of op ... +\textcolor{blue}{=> push arg1_16 >> arg0_08 + push eflags} +---------- 158 0x70bb56 ---------- +esp = (init_esp - 0x4) +arg-1_32 = @32[reg4] +\textcolor{blue}{=> push @32[reg4]} +---------- 155 0x70ba09 ---------- +arg0_32 = (! arg0_32) +DST 0x6F88F1 +\textcolor{blue}{=> not @32[esp]} + \end{semiverbatim}} +\end{frame} + +\begin{frame} + \begin{block}{Multi bloc mnemonic} + \begin{itemize} + \item A mnemonic can have a complex graph + \item we can evaluate a bloc, and propagate its state to its sons + \item and so on + \item No loop for the moment + \end{itemize} + \end{block} +\end{frame} + +\begin{frame}[fragile] + \frametitle{Result: multiple vm exit} +\begin{tabular}{p{5cm} p{5cm}} +\multicolumn{2}{c}{ teste si reg7 == 0x0} +\\ +{\tiny\begin{semiverbatim} + +\textcolor{blue}{---------- state 1 ----------} +eax = @32[(init_esp + 0x1C)] +ebx = @32[(init_esp + 0x10)] +ecx = @32[(init_esp + 0x18)] +edx = @32[(init_esp + 0x14)] +esi = arg1_32 +edi = arg0_32 +\textcolor{blue}{the vm does not unstack args} +esp = (init_esp + 0x28) +ebp = @32[(init_esp + 0x8)] +@32[reg5] = 0x0 +DST @32[(init_esp + 0x24)] + \end{semiverbatim}} +& +{\tiny\begin{semiverbatim} +\textcolor{blue}{---------- state 2 ----------} +eax = @32[(init_esp + 0x1C)] +ebx = @32[(init_esp + 0x10)] +ecx = @32[(init_esp + 0x18)] +edx = @32[(init_esp + 0x14)] +esi = arg1_32 +edi = arg0_32 +\textcolor{blue}{the vm unstack reg7 arguments} +esp = ((init_esp + @32[reg7]) + 0x28) +ebp = @32[(init_esp + 0x8)] +@32[reg7] = 0x0 +@32[reg5] = 0x0 +arg-1_32 = ((init_esp + @32[reg7]) + 0x24) +DST @32[(init_esp + 0x24)] + \end{semiverbatim}} +\end{tabular} +\end{frame} + +\end{document} + + |
