Research Article Static and Dynamic Analysis of Android Malware and Goodware Written with Unity Framework
Total Page:16
File Type:pdf, Size:1020Kb
Load more
Recommended publications
-
Towards a Toolchain for Exploiting Smart Contracts on the Ethereum Blockchain
Towards a Toolchain for Exploiting Smart Contracts on the Ethereum Blockchain by Sebastian Kindler M.A., University of Bayreuth, 2011 Thesis Submitted in Partial Fulfillment of the Requirements for the Degree of Bachelor of Science in the Computer Science Program Faculty of Computer Science Supervisor: Prof. Dr. Stefan Traub Second Assessor: Prof. Dr. Markus Schäffter External Assessor: Dr. Henning Kopp Ulm University of Applied Sciences March 22, 2019 Abstract The present work introduces the reader to the Ethereum blockchain. First, on a con- ceptual level, explaining general blockchain concepts, and viewing the Ethereum blockchain in particular from different perspectives. Second, on a practical level, the main components that make up the Ethereum blockchain are explained in detail. In preparation for the objective of the present work, which is the analysis of EVM bytecode from an attacker’s perspective, smart contracts are introduced. Both, on the level of EVM bytecode and Solidity source code. In addition, critical assem- bly instructions relevant to the exploitation of smart contracts are explained in detail. Equipped with a definition of what constitutes a vulnerable contract, further practical and theoretical aspects are discussed: The present work introduces re- quirements for a possible smart contract analysis toolchain. The requirements are viewed individually, and theoretical focus is put on automated bytecode analysis and symbolic execution as this is the underlying technique of automated smart contract analysis tools. The importance of semantics is highlighted with respect to designing automated tools for smart contract exploitation. At the end, a min- imal toolchain is presented, which allows beginners to efficiently analyze smart contracts and develop exploits. -
Latest X64dbg Version Supports Non-English Languges Through a Generic Algorithm That May Or May Not Work Well in Your Language
x64dbg Documentation Release 0.1 x64dbg Jul 05, 2021 Contents 1 Suggested reads 1 1.1 What is x64dbg?.............................................1 1.2 Introduction...............................................1 1.3 GUI manual............................................... 15 1.4 Commands................................................ 31 1.5 Developers................................................ 125 1.6 Licenses................................................. 261 2 Indices and tables 277 i ii CHAPTER 1 Suggested reads If you came here because someone told you to read the manual, start by reading all sections of the introduction. Contents: 1.1 What is x64dbg? This is a x64/x32 debugger that is currently in active development. The debugger (currently) has three parts: • DBG • GUI • Bridge DBG is the debugging part of the debugger. It handles debugging (using TitanEngine) and will provide data for the GUI. GUI is the graphical part of the debugger. It is built on top of Qt and it provides the user interaction. Bridge is the communication library for the DBG and GUI part (and maybe in the future more parts). The bridge can be used to work on new features, without having to update the code of the other parts. 1.2 Introduction This section explains the basics of x64dbg. Make sure to fully read this! Contents: 1 x64dbg Documentation, Release 0.1 1.2.1 Features This program is currently under active development. It supports many basic and advanced features to ease debugging on Windows. Basic features • Full-featured debugging of DLL and EXE files (TitanEngine Community Edition) • 32-bit and 64-bit Windows support from Windows XP to Windows 10 • Built-in assembler (XEDParse/Keystone/asmjit) • Fast disassembler (Zydis) • C-like expression parser • Logging • Notes • Memory map view • Modules and symbols view • Source code view • Thread view • Content-sensitive register view • Call stack view • SEH view • Handles, privileges and TCP connections enumeration. -
Improving Mobile-Malware Investigations with Static and Dynamic Code Analysis Techniques
IMPROVING MOBILE-MALWARE INVESTIGATIONS WITH STATIC AND DYNAMIC CODE ANALYSIS TECHNIQUES Vom Fachbereich Informatik (FB 20) der Technischen Universität Darmstadt zur Erlangung des akademischen Grades eines Doktor-Ingenieurs (Dr.-Ing.) genehmigte Dissertation von Siegfried Rasthofer, M.Sc. geboren in Landshut, Deutschland. Referenten: Prof. Dr. Eric Bodden (Referent) Prof. Dr. Andreas Zeller (Korreferent) Prof. Dr. Mira Mezini (Korreferentin) Tag der Einreichung: 7. November 2016 Tag der Disputation: 22. Dezember 2016 Darmstadt 2017 Hochschulkennziffer: D17 Siegfried Rasthofer: Improving Mobile-Malware Investigations with Static and Dynamic Code Analysis Techniques © January 2017 phd referees: Prof. Dr. Eric Bodden Prof. Dr. Andreas Zeller Prof. Dr. Mira Mezini further phd committee members: Prof. Dr. Reiner Hähnle Prof. Dr. Christian Bischof Prof. Dr. Patrick Eugster Darmstadt, Germany January 2017 ABSTRACT Similar to the PC world, the abundance of mobile malware has become a serious threat to smartphone users. Thousands of new apps or app versions are uploaded to popular app stores every day. All of them need to be analyzed against violations of the app store’s content policy. In particular, one wishes to detect whether an application contains malicious behavior. Similarly, antivirus companies check thousands of apps every day to determine whether or not they are malicious. Both app store operators and antivirus vendors face the same problem: it is generally challenging to tell apart malware from benign applications. This is because malware developers aim to hide their applications’ malicious behavior as long as possible from being detected by applying different obfuscation techniques. The raising sophistication with which such measures are implemented pose a serious problem not just to automated malware detection approaches but also to the manual analysis of potential malware by human experts. -
Intel® Inspector 2020 Update 2 Release Notes Intel® Inspector 2020 Update 2 to Learn More About This Product, See
Intel® Inspector 2020 Update 2 Release Notes 16 July 2020 Intel® Inspector 2020 Update 2 Customer Support For technical support, including answers to questions not addressed in this product, visit the technical support forum, FAQs, and other support information at: • https://software.intel.com/en-us/inspector/support/ • http://www.intel.com/software/products/support/ • https://software.intel.com/en-us/inspector Please remember to register your product at https://registrationcenter.intel.com/ by providing your email address. Registration entitles you to free technical support, product updates and upgrades for the duration of the support term. It also helps Intel recognize you as a valued customer in the support forum. NOTE: If your distributor provides technical support for this product, please contact them for support rather than Intel. Contents 1 Introduction 2 2 What’s New 3 3 System Requirements 3 4 Where to Find the Release 5 5 Installation Notes 5 6 Known Issues 7 7 Attributions 13 8 Legal Information 13 1 Introduction Intel® Inspector helps developers identify and resolve memory and threading correctness issues in their C, C++ and Fortran applications on Windows* and Linux*. Additionally, on Windows platforms, the tool allows the analysis of the unmanaged portion of mixed managed and unmanaged programs and identifies threading correctness issues in managed .NET C# applications. Intel Inspector is a dynamic error checking tool for developing multithreaded applications on Windows or Linux operating systems. Intel Inspector maximizes code quality and reliability by quickly detecting memory, threading, and source code security errors during the development cycle. You can also use the Intel Inspector to visualize and manage Static Analysis results created by Intel® compilers in various suite products. -
Demarinis Kent Williams-King Di Jin Rodrigo Fonseca Vasileios P
sysfilter: Automated System Call Filtering for Commodity Software Nicholas DeMarinis Kent Williams-King Di Jin Rodrigo Fonseca Vasileios P. Kemerlis Department of Computer Science Brown University Abstract This constant stream of additional functionality integrated Modern OSes provide a rich set of services to applications, into modern applications, i.e., feature creep, not only has primarily accessible via the system call API, to support the dire effects in terms of security and protection [1, 71], but ever growing functionality of contemporary software. How- also necessitates a rich set of OS services: applications need ever, despite the fact that applications require access to part of to interact with the OS kernel—and, primarily, they do so the system call API (to function properly), OS kernels allow via the system call (syscall) API [52]—in order to perform full and unrestricted use of the entire system call set. This not useful tasks, such as acquiring or releasing memory, spawning only violates the principle of least privilege, but also enables and terminating additional processes and execution threads, attackers to utilize extra OS services, after seizing control communicating with other programs on the same or remote of vulnerable applications, or escalate privileges further via hosts, interacting with the filesystem, and performing I/O and exploiting vulnerabilities in less-stressed kernel interfaces. process introspection. To tackle this problem, we present sysfilter: a binary Indicatively, at the time of writing, the Linux -
Building Custom Applications on MMA9550L/MMA9551L By: Fengyi Li Applications Engineer
Freescale Semiconductor Document Number: AN4129 Application Note Rev. 0, 01/2012 Building Custom Applications on MMA9550L/MMA9551L by: Fengyi Li Applications Engineer 1Introduction Contents 1 Introduction . 1 The Freescale MMA955xL Xtrinsic family of devices 2 Architecture . 2 are high-precision, intelligent accelerometers built on the 2.1 Top-level diagram . 2 2.2 Memory space. 3 Freescale ColdFire version 1 core. 3 Tools to build custom projects . 6 3.1 MMA955xL template . 6 The MMA955xL family’s microcontroller core enables 3.2 Sensor Toolbox kit. 29 the development of custom applications in the built-in 3.3 MMA955xL reference manuals . 33 4 Template contents . 34 FLASH memory. Programming and debugging tasks are 4.1 Custom applications on the Freescale platform . 34 supported by Freescale’s CodeWarrior Development 4.2 Define RAM memory for custom applications . 36 Studio for Microcontrollers (Eclipse based IDE). 4.3 Set the custom application run rate. 38 4.4 Access accelerometer data . 39 4.5 Gesture functions . 40 The MMA9550L/MMA9551L firmware platform is 4.6 Stream data to FIFO . 43 specifically designed to ease custom application 4.7 Stream events to FIFO . 46 integration. Building custom applications on the built-in 5 Summary . 48 firmware platform provides an organized and more code-efficient sensing system to monitor development tasks, which reduces the application development cycle. This document introduces the code architecture required for creating a custom application, the instructions for binding it with the Freescale firmware platform, and the available tools that support the custom application development on the MMA955xL family of devices. © 2012 Freescale Semiconductor, Inc. -
A Novel Two-Factor Honeytoken Authentication Mechanism
A novel Two-Factor HoneyToken Authentication Mechanism Vassilis Papaspirou Leandros Maglaras Mohamed Amine Ferrag Department of Computer Science Cyber Technology Institute Department of Computer Science University of Thessaly De Montfort University University of Guelma Volos, Greece Leicester, UK Guelma, Algeria [email protected] [email protected] [email protected] Ioanna Kantzavelou Helge Janicke Christos Douligeris Department of Informatics Cyber Security Cooperative Research Centre Department of Informatics University of West of Attica Edith Cowan University University of Piraeus Athens, Greece Australia [email protected] [email protected] [email protected] Abstract—The majority of systems rely on user authentication guessing, etc. Several best practices have been suggested on passwords, but passwords have so many weaknesses and for the use of passwords. Some of them are very difficult widespread use that easily raise significant security concerns, to use and others do not fulfill the security needs of the regardless of their encrypted form. Users hold the same password for different accounts, administrators never check password files organization. To overcome the password problem, two factor for flaws that might lead to a successful cracking, and the lack of authentication using devices such as tokens and ATM cards a tight security policy regarding regular password replacement has been suggested and has been shown to be difficult to hack are a few problems that need to be addressed. The proposed re- [2]. There are several limitations of two-factor authentication, search work aims at enhancing this security mechanism, prevent including the cost of purchasing, issuing, and handling tokens penetrations, password theft, and attempted break-ins towards securing computing systems. -
Arxiv:1611.10231V1 [Cs.CR] 30 Nov 2016 a INTRODUCTION 1
00 Android Code Protection via Obfuscation Techniques: Past, Present and Future Directions Parvez Faruki, Malaviya National Institute of Technology Jaipur, India Hossein Fereidooni, University of Padua, Italy Vijay Laxmi, Malaviya National Institute of Technology Jaipur, India Mauro Conti, University of Padua, Italy Manoj Gaur, Malaviya National Institute of Technology Jaipur, India Mobile devices have become ubiquitous due to centralization of private user information, contacts, messages and multiple sensors. Google Android, an open-source mobile Operating System (OS), is currently the mar- ket leader. Android popularity has motivated the malware authors to employ set of cyber attacks leveraging code obfuscation techniques. Obfuscation is an action that modifies an application (app) code, preserving the original semantics and functionality to evade anti-malware. Code obfuscation is a contentious issue. Theoretical code analysis techniques indicate that, attaining a verifiable and secure obfuscation is impos- sible. However, obfuscation tools and techniques are popular both among malware developers (to evade anti-malware) and commercial software developers (protect intellectual rights). We conducted a survey to uncover answers to concrete and relevant questions concerning Android code obfuscation and protection techniques. The purpose of this paper is to review code obfuscation and code protection practices, and evalu- ate efficacy of existing code de-obfuscation tools. In particular, we discuss Android code obfuscation methods, custom app protection techniques, and various de-obfuscation methods. Furthermore, we review and ana- lyze the obfuscation techniques used by malware authors to evade analysis efforts. We believe that, there is a need to investigate efficiency of the defense techniques used for code protection. This survey would be beneficial to the researchers and practitioners, to understand obfuscation and de-obfuscation techniques to propose novel solutions on Android. -
Linkers and Loaders Do?
Linkers & Loaders by John R. Levine Table of Contents 1 Table of Contents Chapter 0: Front Matter ........................................................ 1 Dedication .............................................................................................. 1 Introduction ............................................................................................ 1 Who is this book for? ......................................................................... 2 Chapter summaries ............................................................................. 3 The project ......................................................................................... 4 Acknowledgements ............................................................................ 5 Contact us ........................................................................................... 6 Chapter 1: Linking and Loading ........................................... 7 What do linkers and loaders do? ............................................................ 7 Address binding: a historical perspective .............................................. 7 Linking vs. loading .............................................................................. 10 Tw o-pass linking .............................................................................. 12 Object code libraries ........................................................................ 15 Relocation and code modification .................................................... 17 Compiler Drivers ................................................................................. -
Verifying the Integrity of Open Source Android Applications Michael Macnair
Verifying the Integrity of Open Source Android Applications Michael Macnair Technical Report RHUL–MA–2015–4 4 March 2015 Information Security Group Royal Holloway University of London Egham, Surrey, TW20 0EX United Kingdom www.ma.rhul.ac.uk/tech Michael Macnair Student number: 100761605 Verifying the Integrity of Open Source Android Applications 28th August 2014 Supervisor: Keith Mayes Submitted as part of the requirements for the award of the MSc in Information Security at Royal Holloway, University of London. I declare that this assignment is all my own work and that I have acknowledged all quotations from published or unpublished work of other people. I also declare that I have read the statements on plagiarism in Section 1 of the Regulations Governing Examination and Assessment Offences, and in accordance with these regulations I submit this project report as my own work. Signature: Contents Executive Summary 1 1 Introduction 3 1.1 Android and Android Applications . 3 1.2 Reverse Engineering . 4 1.3 Obfuscation . 4 1.4 Verifying Integrity of Binary Distributions . 5 1.5 Objectives . 5 1.6 Report Structure . 6 2 Use Cases for Reversing and Obfuscation 7 2.1 Use Cases . 7 2.2 Conclusion . 10 3 Reverse Engineering Android Applications 11 3.1 The APK File Format . 11 3.2 Techniques . 12 3.3 Tools . 14 4 Verifying Android Application Integrity 23 4.1 APKDiff . 23 4.2 AppIntegrity . 26 5 Analysis of Applications on the Play Store 35 5.1 RedPhone . 35 5.2 ChatSecure . 37 5.3 Telegram . 38 5.4 TextSecure . 40 5.5 Lil’ Debi: Debian Installer . -
VSI Openvms Linker Utility Manual
VSI OpenVMS Linker Utility Manual Document Number: DO–DLKRRM–01A Publication Date: August 2019 This manual describes the OpenVMS Linker utility. The linker creates images containing binary code and data that run on OpenVMS x86-64, OpenVMS I64, OpenVMS Alpha, or OpenVMS VAX systems. These images are primarily executable images activated at the DCL command line. The linker also creates shareable images that can be called by executable or by other shareable images. Revision Update Information: This is a new manual. Operating System and Version: VSI OpenVMS x86-64 Version 9.0 VSI OpenVMS I64 Version 8.4-1H1 VSI OpenVMS Alpha 8.4-2L1 VMS Software, Inc., (VSI) Bolton, Massachusetts, USA Linker Utility Manual: Copyright © 2019 VMS Software, Inc. (VSI), Bolton, Massachusetts, USA Legal Notice Confidential computer software. Valid license from VSI required for possession, use or copying. Consistent with FAR 12.211 and 12.212, Commercial Computer Software, Computer Software Documentation, and Technical Data for Commercial Items are licensed to the U.S. Government under vendor's standard commercial license. The information contained herein is subject to change without notice. The only warranties for VSI products and services are set forth in the express warranty statements accompanying such products and services. Nothing herein should be construed as constituting an additional warranty. VSI shall not be liable for technical or editorial errors or omissions contained herein. HPE, HPE Integrity, HPE Alpha, and HPE Proliant are trademarks or registered trademarks of Hewlett Packard Enterprise. Intel, Itanium, and IA-64 are trademarks or registered trademarks of Intel Corporation or its subsidiaries in the United States and other countries. -
Openvms Debugger Manual
OpenVMS Debugger Manual Order Number: AA–QSBJD–TE April 2001 This manual explains the features of the OpenVMS Debugger for programmers in high-level languages and assembly language. Revision/Update Information: This manual supersedes the OpenVMS Debugger Manual, Version 7.2. Software Version: OpenVMS Alpha Version 7.3 OpenVMS VAX Version 7.3 Compaq Computer Corporation Houston, Texas © 2001 Compaq Computer Corporation Compaq, VAX, VMS, and the Compaq logo Registered in the U.S. Patent and Trademark Office. OpenVMS is a trademark of Compaq Information Technologies Group, L.P. in the United States and other countries. Microsoft, Windows, and Windows NT are trademarks of Microsoft Corporation in the United States and other countries. Intel is a trademark of Intel Corporation in the United States and other countries. Motif, Open Software Foundation, OSF/1, and UNIX are trademarks of The Open Group in the United States and other countries. All other product names mentioned herein may be the trademarks of their respective companies. Confidential computer software. Valid license from Compaq required for possession, use, or copying. Consistent with FAR 12.211 and 12.212, Commercial Computer Software, Computer Software Documentation, and Technical Data for Commercial Items are licensed to the U.S. Government under vendor’s standard commercial license. Compaq shall not be liable for technical or editorial errors or omissions contained herein. The information in this document is provided "as is" without warranty of any kind and is subject to change without notice. The warranties for Compaq products are set forth in the express limited warranty statements accompanying such products.