DOCSLIB.ORG

Analysis of Obfuscation Transformations on Binary Code Matthieu Tofighi Shirazi

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Analysis of Obfuscation Transformations on Binary Code Matthieu Tofighi Shirazi Analysis of obfuscation transformations on binary code Matthieu Tofighi Shirazi To cite this version: Matthieu Tofighi Shirazi. Analysis of obfuscation transformations on binary code. Cryptography and Security [cs.CR]. Université Grenoble Alpes, 2019. English. NNT : 2019GREAM069. tel-02907117 HAL Id: tel-02907117 https://tel.archives-ouvertes.fr/tel-02907117 Submitted on 6 Jan 2021 HAL is a multi-disciplinary open access L’archive ouverte pluridisciplinaire HAL, est archive for the deposit and dissemination of sci- destinée au dépôt et à la diffusion de documents entific research documents, whether they are pub- scientifiques de niveau recherche, publiés ou non, lished or not. The documents may come from émanant des établissements d’enseignement et de teaching and research institutions in France or recherche français ou étrangers, des laboratoires abroad, or from public or private research centers. publics ou privés. THÈSE Pour obtenir le grade de DOCTEUR DE LA COMMUNAUTÉ UNIVERSITÉ GRENOBLE ALPES Spécialité : Mathématiques et Informatique Arrêté ministérial : 25 mai 2016 Présentée par Ramtine TOFIGHI SHIRAZI Thèse dirigée par Philippe ELBAZ-VINCENT préparée au sein du Laboratoire Institut Fourier dans l’École Doctorale MSTII Evaluation des méthodes d’obscurcissement de binaire Thèse soutenue publiquement le 16 décembre 2019, devant le jury composé de : M, Louis GOUBIN Professeur à l’Université Versailles-Saint-Quentin-en-Yvelines, Versailles, Rapporteur M, Aurélien FRANCILLON Professeur associé à EURECOM, Biot, Rapporteur M, Sébastien JOSSE Chercheur à la Direction générale de l’armement, Rennes, Examinateur M, Igor MUTTIK Professeur invité à la Royal Holloway Université de Londres, Londres, Examinateur Mme, Marie-Laure POTET Professeur à l’Université Grenoble Alpes, Grenoble, Présidente M, Guénaël RENAULT Professeur à l’Ecole Polytechnique, Paris, Examinateur Mme, Irina-Mariuca ASAVOAE Consultante à Trusted Labs, Thales Group, Meudon, Encadrante de thèse M, Philippe ELBAZ-VINCENT Professeur à l’Université Grenoble Alpes, Grenoble, Directeur de thèse 2 Remerciements Je souhaite remercier en premier lieu mon directeur de thèse, M. Philippe Elbaz-Vincent, pour m’avoir encadré et soutenu tout au long de cette thèse. Je lui suis également reconnaissant pour le temps conséquent qu’il m’a accordé, ses qualités pédagogiques et scientifiques, sa franchise et sa sympathie. J’ai beaucoup appris à ses côtés et je lui adresse ma gratitude pour tout cela. J’adresse de chaleureux remerciements à ma co-encadrante de thèse, Irina-Marica Asavoae, pour son attention de tout instant sur mes travaux, pour ses conseils avisés et son écoute qui ont été prépondérants pour la bonne réussite de cette thèse. Je remercie également mes anciennes co-encadrantes, Maria Christofi et Thanh Ha Le, avec lesquelles l’experience fut courte mais très enrichissante. Un grand merci à Louis Goubin et à Aurelien Francillon pour avoir accepté de rapporter ma thèse et pour tous leurs conseils, ainsi qu’aux autres membres du jury. Je désire églament remercier Sebastien Josse pour ses remarques, son ouverture d’esprit, sa franchise, et sa gentillesse qui m’ont permis d’atteindre mes objectifs dans le cadre du doctorat. Bien sûr, atteindre ces objectifs n’aurait pas été possible sans l’aide de nombreux collègues. Je souhaite notamment remercier Aline Gouget, pour son soutien tout au long de cette thèse. Enfin, je remercie ma famille pour leur soutien au cours de ces trois années, et plus particulière- ment ma mère sans laquelle je n’en serais pas là aujourd’hui. 3 4 Résumé long Introduction Contexte L’ingénierie inverse, également appelée la rétro-ingénierie, est le processus d’analyse d’un système qui permet d’identifier les composants et leur relation afin de créer des représentations du système à un niveau d’abstraction supérieur ou différent. L’ingénierie inverse est utilisée sur des systèmes logiciels afin de comprendre leur fonctionnement interne. Cette pratique est courante concernant le développement de logiciels, l’étude de programmes malveillants, l’audit de sécurité et également dans le but de mettre en échec les systèmes de protection logicielle. Dans ce dernier cas, lorsque des utilisateurs malveillants ont un accès complet à un logiciel, l’ingénierie inverse est utilisée pour les attaques de type Man-At-The-End (MATE). Afin de se protéger contre l’ingénierie inverse, et plus généralement contre les attaques de type MATE, les techniques de protection des logiciels sont largement utilisées de sorte à préserver la valeur commerciale du logiciel. Les algorithmes de protection logicielle appartiennent à quatre catégories: • l’obscurcissement du code pour rendre l’ingénierie inverse plus difficile en les rendant inin- telligibles ; • des méthodes d’inviolabilité utilisées pour se protéger contre des modifications illicites d’un logiciel; • le tatouage numérique insérant des messages de vérification afin d’identifier le propriétaire et ses droits; • le marquage, dit de naissance, utilisé pour extraire les caractéristiques inhérentes au pro- gramme d’origine de maière à en détecter l’originalité. Dans cette thèse, nous nous concentrons principalement sur l’obscurcissement de code en tant que technique de protection des logiciels. 5 Défis Scientifiques L’obscurcissement de code est perçu comme une stratégie de gestion de l’information visant à masquer le sens pouvant être tiré d’un logiciel, tout en préservant ses fonctionnalités d’origines. Actuellement, l’obscurcissement est utilisé comme mécanisme de protection de la propriété in- tellectuelle, mais aussi pour dissimuler les comportements malveillants de certain code binaire. Par conséquent, l’évaluation des méthodes d’obscurcissement est une question ouverte à laquelle il est souvent répondu par des méthodologies de dés-obscurcissement. Le processus de dés- obscurcissement est constitué par des méthodes d’ingénierie inverse qui évaluent la force des protections d’obscurcissement appliquées. Cependant, ces méthodes se concentrent souvent sur des protections spécifiques. Cette thèse porte sur l’évaluation des transformations d’obscurcissement appliquées aux codes binaires. L’objectif est de fournir différentes études et méthodologies afin d’aider les évaluateurs et les rétro-concepteurs durant l’analyse des logiciels obscurcis. Contributions Le processus de dés-obscurcissement peut être vu sous différentes approches, telles que la sup- pression d’une ou plusieurs transformations, la simplification du programme ou encore la collecte d’informations dites « méta-données » à propos du code obscurci. Dans cette thèse, nous contribuons à chaque approche de dés-obscurcissement comme décrit dans les paragraphes suivants. Contribution 1 – DoSE, Dés-obscurcissement basée sur l’équivalence sémantique de code La première contribution consiste en une approche de simplification de programme. Il s’agit d’une méthodologie de dés-obscurcissement basée sur l’équivalence sémantique de code, appelée DoSE. DoSE permet principalement de simplifier le code binaire en vérifiant l’équivalence syntaxique et sémantique de portions d’un code binaire. Cette vérification permet de supprimer les nouvelles transformations d’obscurcissement qui entravent les analyses de dés-obscurcissement de pointe, basées sur l’analyse dynamique et symbolique d’un code. Contribution 2 – L’évaluation des prédicats opaques de manière statique grâce à l’apprentissage automatique et à l’analyse binaire La deuxième contribution consiste en une approche de suppression de transformation d’obscur- cissement. Basée sur une méthodologie d’apprentissage automatique et supervisée, notre approche vise à détecter puis supprimer des schémas d’obscurcissement spécifiques, mais largement utilisés, 6 nommé prédicat opaque. À notre connaissance, il s’agit de la première méthodologie d’élimination de transformation d’obscurcissement utilisant des techniques d’apprentissage automatique. Contribution 3 – La détection des transformations d’obscurcissement basées sur un ensemble de modèle d’apprentissage et le raisonnement sémantique La troisième contribution de cette thèse se base sur une méthode de collecte de méta-données du code protégé. En utilisant des techniques avancées d’apprentissage automatique et de raison- nement sémantique, la méthodologie proposée permet aux analystes d’identifier plusieurs couches de transformations d’obscurcissement appliquées au code binaire, ce qui représente une étape importante précédent la suppression de ces protections. État de l’art Obscurcissement du code L’obscurcissement de code est une stratégie de gestion de l’information visant à obscurcir la sig- nification du code, tout en préservant ses fonctionnalités. L’objectif principal est de protéger la propriété intellectuelle des auteurs de logiciels. Cependant, l’obscurcissement est également très utilisé par les auteurs de logiciels malveillants pour empêcher la détection et l’analyse de leurs codes. Par conséquent, la capacité d’évaluation de telles transformations d’obscurcissement est une étape importante vers une meilleure protection des logiciels. De ce fait, nous introduisons par la suite différentes définitions de l’obscurcissement. Puis nous décrivons brièvement différentes méthodes d’obscurcissement et de dés-obscurcissement, avant de présenter les outils en lien avec ce domaine d’étude. Obscurcissement en boîte noire virtuelle Une première définition de l’obscurcissement prend en compte la propriété d’indiscernabilité entre deux programmes. La propriété essentielle, appelée boîte noire virtuelle, nécessite
Load more

Recommended publications
  • Fill Your Boots: Enhanced Embedded Bootloader Exploits Via Fault Injection and Binary Analysis
    IACR Transactions on Cryptographic Hardware and Embedded Systems ISSN 2569-2925, Vol. 2021, No. 1, pp. 56–81. DOI:10.46586/tches.v2021.i1.56-81 Fill your Boots: Enhanced Embedded Bootloader Exploits via Fault Injection and Binary Analysis Jan Van den Herrewegen1, David Oswald1, Flavio D. Garcia1 and Qais Temeiza2 1 School of Computer Science, University of Birmingham, UK, {jxv572,d.f.oswald,f.garcia}@cs.bham.ac.uk 2 Independent Researcher, [email protected] Abstract. The bootloader of an embedded microcontroller is responsible for guarding the device’s internal (flash) memory, enforcing read/write protection mechanisms. Fault injection techniques such as voltage or clock glitching have been proven successful in bypassing such protection for specific microcontrollers, but this often requires expensive equipment and/or exhaustive search of the fault parameters. When multiple glitches are required (e.g., when countermeasures are in place) this search becomes of exponential complexity and thus infeasible. Another challenge which makes embedded bootloaders notoriously hard to analyse is their lack of debugging capabilities. This paper proposes a grey-box approach that leverages binary analysis and advanced software exploitation techniques combined with voltage glitching to develop a powerful attack methodology against embedded bootloaders. We showcase our techniques with three real-world microcontrollers as case studies: 1) we combine static and on-chip dynamic analysis to enable a Return-Oriented Programming exploit on the bootloader of the NXP LPC microcontrollers; 2) we leverage on-chip dynamic analysis on the bootloader of the popular STM8 microcontrollers to constrain the glitch parameter search, achieving the first fully-documented multi-glitch attack on a real-world target; 3) we apply symbolic execution to precisely aim voltage glitches at target instructions based on the execution path in the bootloader of the Renesas 78K0 automotive microcontroller.
    [Show full text]
  • Botnets, Cybercrime, and Cyberterrorism: Vulnerabilities and Policy Issues for Congress
    Order Code RL32114 Botnets, Cybercrime, and Cyberterrorism: Vulnerabilities and Policy Issues for Congress Updated January 29, 2008 Clay Wilson Specialist in Technology and National Security Foreign Affairs, Defense, and Trade Division Botnets, Cybercrime, and Cyberterrorism: Vulnerabilities and Policy Issues for Congress Summary Cybercrime is becoming more organized and established as a transnational business. High technology online skills are now available for rent to a variety of customers, possibly including nation states, or individuals and groups that could secretly represent terrorist groups. The increased use of automated attack tools by cybercriminals has overwhelmed some current methodologies used for tracking Internet cyberattacks, and vulnerabilities of the U.S. critical infrastructure, which are acknowledged openly in publications, could possibly attract cyberattacks to extort money, or damage the U.S. economy to affect national security. In April and May 2007, NATO and the United States sent computer security experts to Estonia to help that nation recover from cyberattacks directed against government computer systems, and to analyze the methods used and determine the source of the attacks.1 Some security experts suspect that political protestors may have rented the services of cybercriminals, possibly a large network of infected PCs, called a “botnet,” to help disrupt the computer systems of the Estonian government. DOD officials have also indicated that similar cyberattacks from individuals and countries targeting economic,
    [Show full text]
  • The Downadup Codex a Comprehensive Guide to the Threat’S Mechanics
    Security Response The Downadup Codex A comprehensive guide to the threat’s mechanics. Edition 2.0 Introduction Contents Introduction.............................................................1 Since its appearance in late-2008, the Downadup worm has become Editor’s Note............................................................5 one of the most wide-spread threats to hit the Internet for a number of Increase in exploit attempts against MS08-067.....6 years. A complex piece of malicious code, this threat was able to jump W32.Downadup infection statistics.........................8 certain network hurdles, hide in the shadows of network traffic, and New variants of W32.Downadup.B find new ways to propagate.........................................10 defend itself against attack with a deftness not often seen in today’s W32.Downadup and W32.Downadup.B threat landscape. Yet it contained few previously unseen features. What statistics................................................................12 set it apart was the sheer number of tricks it held up its sleeve. Peer-to-peer payload distribution...........................15 Geo-location, fingerprinting, and piracy...............17 It all started in late-October of 2008, we began to receive reports of A lock with no key..................................................19 Small improvements yield big returns..................21 targeted attacks taking advantage of an as-yet unknown vulnerability Attempts at smart network scanning...................23 in Window’s remote procedure call (RPC) service. Microsoft quickly Playing with Universal Plug and Play...................24 released an out-of-band security patch (MS08-067), going so far as to Locking itself out.................................................27 classify the update as “critical” for some operating systems—the high- A new Downadup variant?......................................29 Advanced crypto protection.................................30 est designation for a Microsoft Security Bulletin.
    [Show full text]
  • Post-Mortem of a Zombie: Conficker Cleanup After Six Years Hadi Asghari, Michael Ciere, and Michel J.G
    Post-Mortem of a Zombie: Conficker Cleanup After Six Years Hadi Asghari, Michael Ciere, and Michel J.G. van Eeten, Delft University of Technology https://www.usenix.org/conference/usenixsecurity15/technical-sessions/presentation/asghari This paper is included in the Proceedings of the 24th USENIX Security Symposium August 12–14, 2015 • Washington, D.C. ISBN 978-1-939133-11-3 Open access to the Proceedings of the 24th USENIX Security Symposium is sponsored by USENIX Post-Mortem of a Zombie: Conficker Cleanup After Six Years Hadi Asghari, Michael Ciere and Michel J.G. van Eeten Delft University of Technology Abstract more sophisticated C&C mechanisms that are increas- ingly resilient against takeover attempts [30]. Research on botnet mitigation has focused predomi- In pale contrast to this wealth of work stands the lim- nantly on methods to technically disrupt the command- ited research into the other side of botnet mitigation: and-control infrastructure. Much less is known about the cleanup of the infected machines of end users. Af- effectiveness of large-scale efforts to clean up infected ter a botnet is successfully sinkholed, the bots or zom- machines. We analyze longitudinal data from the sink- bies basically remain waiting for the attackers to find hole of Conficker, one the largest botnets ever seen, to as- a way to reconnect to them, update their binaries and sess the impact of what has been emerging as a best prac- move the machines out of the sinkhole. This happens tice: national anti-botnet initiatives that support large- with some regularity. The recent sinkholing attempt of scale cleanup of end user machines.
    [Show full text]
  • Undergraduate Report
    UNDERGRADUATE REPORT Attack Evolution: Identifying Attack Evolution Characteristics to Predict Future Attacks by MaryTheresa Monahan-Pendergast Advisor: UG 2006-6 IINSTITUTE FOR SYSTEMSR RESEARCH ISR develops, applies and teaches advanced methodologies of design and analysis to solve complex, hierarchical, heterogeneous and dynamic problems of engineering technology and systems for industry and government. ISR is a permanent institute of the University of Maryland, within the Glenn L. Martin Institute of Technol- ogy/A. James Clark School of Engineering. It is a National Science Foundation Engineering Research Center. Web site http://www.isr.umd.edu Attack Evolution 1 Attack Evolution: Identifying Attack Evolution Characteristics To Predict Future Attacks MaryTheresa Monahan-Pendergast Dr. Michel Cukier Dr. Linda C. Schmidt Dr. Paige Smith Institute of Systems Research University of Maryland Attack Evolution 2 ABSTRACT Several approaches can be considered to predict the evolution of computer security attacks, such as statistical approaches and “Red Teams.” This research proposes a third and completely novel approach for predicting the evolution of an attack threat. Our goal is to move from the destructive nature and malicious intent associated with an attack to the root of what an attack creation is: having successfully solved a complex problem. By approaching attacks from the perspective of the creator, we will chart the way in which attacks are developed over time and attempt to extract evolutionary patterns. These patterns will eventually
    [Show full text]
  • Using Static and Dynamic Binary Analysis with Ret-Sync
    Bière sécu Bordeaux 1st event Date 26/02/2020 Place Zytho By Jiss – Daniel – Tiana Combining static and dynamic binary analysis ret-sync Date 26/02/2020 Place Zytho By Jean-Christophe Delaunay Context 2 approaches in reverse-engineering (RE) : static (disass/decompile) IDA, Ghidra, etc. dynamic (debug) x64dbg, WinDbg, LLDB, etc. Possible to combine both worlds in the same tool… … but often painful to use (eg. IDA dbg) Annoying to switch between multiple tools 3 / 29 Context Classical example: I’m debugging using WinDbg, I spot a routine or structure which seems interesting I’d like to know if I’ve already documented it within IDA … I need to compute the offset from the load address of my module (ASLR/relloc) … add it to the preferred load address of my module in my idb Conclusion: straightforward but painful if I have to do that every 2 minutes … even more painful provided that I use x64dbg for usermode and WinDbg for kernelmode 4 / 29 Solutions Code a new tool which would combine both worlds… 5 / 29 Solutions Code a new tool which would combine both worlds… 6 / 29 Solutions Code a new tool which would combine both worlds… Set-up a glue which would create an interface between the disass and the debugger(s)… … ret-sync by Alexandre Gazet https://github.com/bootleg/ret-sync 7 / 29 ret-sync: support Static: IDA Ghidra Dynamic: WinDbg(-preview) GDB LLDB OllyDbg 1.10 OllyDbg v2 x64dbg 8 / 29 ret-sync: features Permits to “follow” the program workflow in IDA/Ghidra view “step” in the dbg “step” in the disass static view Dynamic switching between multiple idbs trace within toto.exe trace within toto.idb toto.exe issues a call in fistouille.dll switch to fistouille.idb Automagical rebase Sending commands to the dbg (bp, hbp, lbl, etc.) Custom commands1 All features are available both in disass AND decompiled views etc.
    [Show full text]
  • Reverse Software Engineering As a Project-Based Learning Tool
    Paper ID #33764 Reverse Software Engineering as a Project-Based Learning Tool Ms. Cynthia C. Fry, Baylor University CYNTHIA C. FRY is currently a Senior Lecturer of Computer Science at Baylor University. She worked at NASA’s Marshall Space Flight Center as a Senior Project Engineer, a Crew Training Manager, and the Science Operations Director for STS-46. She was an Engineering Duty Officer in the U.S. Navy (IRR), and worked with the Naval Maritime Intelligence Center as a Scientific/Technical Intelligence Analyst. She was the owner and chief systems engineer for Systems Engineering Services (SES), a computer systems design, development, and consultation firm. She joined the faculty of the School of Engineering and Computer Science at Baylor University in 1997, where she teaches a variety of engineering and computer science classes, she is the Faculty Advisor for the Women in Computer Science (WiCS), the Director of the Computer Science Fellows program, and is a KEEN Fellow. She has authored and co- authored over fifty peer-reviewed papers. Mr. Zachary Michael Steudel Zachary Steudel is a 2021 graduate of Baylor University’s computer science department. In his time at Baylor, he worked as a Teaching Assistant under Ms. Cynthia C. Fry. As part of the Teaching Assistant role, Zachary designed and created the group project for the Computer Systems course. Zachary Steudel worked as a Software Developer Intern at Amazon in the Summer of 2019, a Software Engineer Intern at Microsoft in the Summer of 2020, and begins his full-time career with Amazon in the summer of 2021 as a software engineer.
    [Show full text]
  • Miscellaneous: Malware Cont'd & Start on Bitcoin
    Miscellaneous: Malware cont’d & start on Bitcoin CS 161: Computer Security Prof. Raluca Ada Popa April 19, 2018 Credit: some slides are adapted from previous offerings of this course Viruses vs. Worms VIRUS WORM Propagates By infecting Propagates automatically other programs By copying itself to target systems Usually inserted into A standalone program host code (not a standalone program) Another type of virus: Rootkits Rootkit is a ”stealthy” program designed to give access to a machine to an attacker while actively hiding its presence Q: How can it hide itself? n Create a hidden directory w /dev/.liB, /usr/src/.poop and similar w Often use invisiBle characters in directory name n Install hacked Binaries for system programs such as netstat, ps, ls, du, login Q: Why does it Become hard to detect attacker’s process? A: Can’t detect attacker’s processes, files or network connections By running standard UNIX commands! slide 3 Sony BMG copy protection rootkit scandal (2005) • Sony BMG puBlished CDs that apparently had copy protection (for DRM). • They essentially installed a rootkit which limited user’s access to the CD. • It hid processes that started with $sys$ so a user cannot disaBle them. A software engineer discovered the rootkit, it turned into a Big scandal Because it made computers more vulneraBle to malware Q: Why? A: Malware would choose names starting with $sys$ so it is hidden from antivirus programs Sony BMG pushed a patch … But that one introduced yet another vulneraBility So they recalled the CDs in the end Detecting Rootkit’s
    [Show full text]
  • Reverse Engineering Digital Forensics Rodrigo Lopes October 22, 2006
    Reverse Engineering Digital Forensics Rodrigo Lopes October 22, 2006 Introduction Engineering is many times described as making practical application of the knowledge of pure sciences in the solution of a problem or the application of scientific and mathematical principles to develop economical solutions to technical problems, creating products, facilities, and structures that are useful to people. What if the opposite occurs? There is some product that may be a solution to some problem but the inner workings of the solution or even the problem it addresses may be unknown. Reverse engineering is the process of analyzing and understanding a product which functioning and purpose are unknown. In Computer Science in particular, reverse engineering may be defined as the process of analyzing a system's code, documentation, and behavior to identify its current components and their dependencies to extract and create system abstractions and design information. The subject system is not altered; however, additional knowledge about the system is produced. The definition of Reverse Engineering is not peaceful though, especially when it concerns to court and lawsuits. The Reverse Engineering of products protected by copyrighting may be a crime, even if no code is copied. From the software companies’ point of view, Reverse Engineering is many times defined as “Analyzing a product or other output of a process in order to determine how to duplicate the know-how which has been used to create a product or process”. Scope and Goals In the Digital Forensics’ scope, reverse engineering can directly be applied to analyzing unknown and suspicious code in the system, to understand both its goal and inner functioning.
    [Show full text]
  • Stanford University
    The first digit of a CS course number indicates its general level of sophistication: 001-099 Service courses for nontechnical majors 100-199 Other service courses, basic undergraduate 200-299 Advanced undergraduate/beginning graduate 300-399 Advanced graduate 400-499 Experimental 500-599 Graduate seminars Emeriti: (Professors) Tom Binford, Edward Feigenbaum, Richard The tens digit indicates the area of Computer Science it addresses: Fikes, Donald E. Knuth,* John McCarthy, Edward J. 00-09 Introductory, miscellaneous McCluskey, William F. Miller, Nils J. Nilsson, Vaughan Pratt,* 10-19 Hardware Systems Jeffrey D. Ullman, Gio Wiederhold* 20-29 Artificial Intelligence Chair: Jennifer Widom 30-39 Numerical Analysis Associate Chair for Education: Mehran Sahami 40-49 Software Systems Professors: Alex Aiken, Dan Boneh, David Cheriton, William J. 50-59 Mathematical Foundations of Computing Dally, David Dill, Hector Garcia-Molina, Leonidas J. Guibas, 60-69 Analysis of Algorithms Patrick Hanrahan, John Hennessy, Mark A. Horowitz, Oussama 70-79 Computational Biology and Interdisciplinary Topics Khatib, Daphne Koller, Monica Lam, Jean-Claude Latombe, 90-99 Independent Study and Practicum Marc Levoy, Zohar Manna, Teresa Meng, John Mitchell, Kunle Olukotun, Yoav Shoham, Sebastian Thrun, Jennifer Widom, Terry Winograd Associate Professors: Serafim Batzoglou, Dawson Engler, Ronald The mission of Stanford‟s undergraduate program in Computer P. Fedkiw, Michael Genesereth, Christoforos Kozyrakis, Chris- Science is to provide a foundation of mathematics, science,
    [Show full text]
  • X86 Disassembly Exploring the Relationship Between C, X86 Assembly, and Machine Code
    x86 Disassembly Exploring the relationship between C, x86 Assembly, and Machine Code PDF generated using the open source mwlib toolkit. See http://code.pediapress.com/ for more information. PDF generated at: Sat, 07 Sep 2013 05:04:59 UTC Contents Articles Wikibooks:Collections Preface 1 X86 Disassembly/Cover 3 X86 Disassembly/Introduction 3 Tools 5 X86 Disassembly/Assemblers and Compilers 5 X86 Disassembly/Disassemblers and Decompilers 10 X86 Disassembly/Disassembly Examples 18 X86 Disassembly/Analysis Tools 19 Platforms 28 X86 Disassembly/Microsoft Windows 28 X86 Disassembly/Windows Executable Files 33 X86 Disassembly/Linux 48 X86 Disassembly/Linux Executable Files 50 Code Patterns 51 X86 Disassembly/The Stack 51 X86 Disassembly/Functions and Stack Frames 53 X86 Disassembly/Functions and Stack Frame Examples 57 X86 Disassembly/Calling Conventions 58 X86 Disassembly/Calling Convention Examples 64 X86 Disassembly/Branches 74 X86 Disassembly/Branch Examples 83 X86 Disassembly/Loops 87 X86 Disassembly/Loop Examples 92 Data Patterns 95 X86 Disassembly/Variables 95 X86 Disassembly/Variable Examples 101 X86 Disassembly/Data Structures 103 X86 Disassembly/Objects and Classes 108 X86 Disassembly/Floating Point Numbers 112 X86 Disassembly/Floating Point Examples 119 Difficulties 121 X86 Disassembly/Code Optimization 121 X86 Disassembly/Optimization Examples 124 X86 Disassembly/Code Obfuscation 132 X86 Disassembly/Debugger Detectors 137 Resources and Licensing 139 X86 Disassembly/Resources 139 X86 Disassembly/Licensing 141 X86 Disassembly/Manual of Style 141 References Article Sources and Contributors 142 Image Sources, Licenses and Contributors 143 Article Licenses License 144 Wikibooks:Collections Preface 1 Wikibooks:Collections Preface This book was created by volunteers at Wikibooks (http:/ / en.
    [Show full text]
  • INFILTRATE Ghidra
    Three Heads Are Better Than One: Mastering NSA's Ghidra Reverse Engineering Tool Alexei Bulazel Jeremy Blackthorne @0xAlexei @0xJeremy github.com/0xAlexei/INFILTRATE2019 Disclaimer This material is based on the publicly released Ghidra, there is no classified information in this presentation Alexei Bulazel @0xAlexei ● Senior Security Researcher at River Loop Security ● Research presentations and publications: ○ Presentations at REcon (MTL & BRX), SummerCon, DEFCON, Black Hat, etc. ○ Academic publications at USENIX WOOT and ROOTS ○ Cyber policy in Lawfare, etc. ● Collaborated with Jeremy on research at RPI, MIT Lincoln Laboratory, and Boston Cybernetics Institute ● Proud RPISEC alumnus Jeremy Blackthorne @0xJeremy ● Instructor at the Boston Cybernetics Institute ● PhD candidate at RPI focused on environmental keying ● Former researcher at MIT Lincoln Laboratory ● United States Marine Corps 2002 - 2006 ● RPISEC alumnus Outline 1. Intro 2. Interactive Exercises a. Manual Static Analysis b. Scripting Ghidra 3. P-Code & SLEIGH 4. Discussion 5. Conclusion Participating 1. Install OpenJDK 11, add its bin directory to your PATH ● jdk.java.net/11 2. Download Ghidra ● ghidra-sre.org ● github.com/NationalSecurityAgency/ghidra/releases 3. Download our demo scripts and binaries ● github.com/0xAlexei/INFILTRATE2019 Ghidra ● Java-based interactive reverse engineering tool developed by US National Security Agency - similar in functionality to IDA Pro, Binary Ninja, etc… ○ Static analysis only currently, debugger support promised to be coming soon ○ Runs on Mac, Linux, and Windows ● All credit for creating Ghidra goes to the developers at NSA ● Released open source at RSA in March 2019 ○ 1.2M+ lines of code ● NSA has not discussed the history of the tool, but comments in source files go as far back as February 1999 Outline 1.
    [Show full text]