Download presentation
Presentation is loading. Please wait.
1
Reverse Engineering Workshop
Tip: simple SEO adjustments can make your presentation more discoverable. Read this PDF for best practices: Cathal Mullaney / Alan Neville /
2
Agenda 1 Reverse Engineering in Security 2 PE File Format 3
Crash Course in Assembly 4 Tools 5 Challenges Copyright © 2015 Symantec Corporation
3
Reverse Engineering in Security
Video Time! Copyright © 2015 Symantec Corporation
4
A Peek at the PE File Format
Copyright © 2015 Symantec Corporation
5
Let’s start with an example..
9,216 bytes Simple.exe Compiled in VS2015 1. Using Visual Studios, we can write a simple Hello, World! Example in C 2. We compile the code as an application.. This is what it looks like on disk – it takes up 9,216 bytes of space 3. Looking at the assembly code generated by the bytes-code – we have the following block 4. On the left side, you can see the op-codes that are generates. This is what the machine reads 5. And when we run the application, we get the output we expect Copyright © 2015 Symantec Corporation
6
Inside Simple.exe C code translated into op-codes
Op-codes represented by bytes Highlighted bytes represent the C code written for simple.exe Only a total of 20 bytes! But what’s all the other stuff?! PE Format to save the day! Copyright © 2015 Symantec Corporation
7
PE Format Layout Standard binary file format for Windows
Introduced in Windows NT 3.1 Win32 SDK contains file winnt.h Describes the structure and variables used in PE files File imagehlp.dll contains functions to manipulate PE files PE files are broken into regions that can be examined Developed by Mark Zbikowski at MS in 1990 Used to bridge gap between DOS and Windows executables PE File DOS Header PE Header Optional Header Section Table Sections (code, data, imports) Resources Overlay Copyright © 2015 Symantec Corporation
8
DOS Header First two letters always ‘MZ’ (0x4D5A) MS DOS header
Starts at offset 0x0 Aka “magic number” or File Signature Determines the type of file All file types use magic numbers Java – 0xCAFEBABE ZIP – 0x504B – “PK” MS DOS header Ensures backwards compatibility If file executed in the wrong environment, error message is displayed “This program cannot be run in DOS mode.” Copyright © 2015 Symantec Corporation
9
PE Header Known as the ‘File Header’ Contains useful information
Machine what architecture the file was compiled for Number of sections TimeDateStamp when the file was compiled SizeOfOptionalHeader length of following header Characteristics 0x02 – executable file 0x2000 – file is a DLL, not an EXE Copyright © 2015 Symantec Corporation
10
Optional PE Header Despite it’s name, it is not optional
Required in executable files, not COM files Occurs directly after PE Header Contains LOTS of information Version info of the compiler Size of the file Checksum – ensure file integrity And more! AddressOfEntryPoint Most important field here! Copyright © 2015 Symantec Corporation
11
Section Table PE header defines a number of sections
Code is placed in these sections Each section definition is 40 bytes in length Section Name (.text, .data etc) Size of the section once loaded into memory Location of section (RVA) Physical size of section on disk Physical location etc Resource named .rsrc Import named .idata Export named .edata Flags used to describe the type of data in the section PE File DOS Header PE Header Optional Header Section Table Sections (code, data, imports) 1..n Resources Overlay Copyright © 2015 Symantec Corporation
12
Parsing the PE file structure yourself
Pefile – python module - “multi-platform Python module to parse and work with PE files” Self-contained – not dependencies! Access PE header Retrieve embedded data Read strings Identify malformed values Explore all features of the PE format Can be used to manipulate the PE structure Allows writing to some of the fields Experiment by changing the data – see how Windows reacts Copyright © 2015 Symantec Corporation
13
Assembly Crash Course Copyright © 2015 Symantec Corporation
14
Copyright © 2015 Symantec Corporation
15
What is assembly language?
HHL (Java, C, C++ etc) Assembly Op-codes Machine Code Copyright © 2015 Symantec Corporation
16
Registers EAX, EBX, ECX, EDX – all purpose registers
ESI, EDI – source and destination index pointers ESP – stack pointer EBP – base pointer, points to return address Also important is EIP – instruction pointer, points to the next instruction to run Copyright © 2015 Symantec Corporation
17
The Stack Part of memory where program stores variables + function args Last-in-first-out (LIFO) Things are added to the top of the stack push Things are removed from the top of the stack pop It grows backwards Grows from highest memory address to lowest ESP + EBP – registers to work with stack ESP points to top of stack EBP points to local variables Copyright © 2015 Symantec Corporation
18
The Stack – Example int a = 10 int b = 5 int c = 2 push 10 push 5
High address int a = 10 int b = 5 int c = 2 C – esp+16 B – esp+12 push 10 push 5 push 2 call addNums A – esp+8 EBP register Points to top of the current frame This is the same as your return address EBP+4 Points to first argument passed into function EBP-4 Points to first local variable Usually the old value of EBP Can use this to restore the prior frame Return address esp+4 saved ebp ebp-4 EBP result ebp-8 ESP addNums: int result = a+b+c; return result; Low address Copyright © 2015 Symantec Corporation
19
The Stack – Example push ebp This is the standard prologe.
mov ebp, esp sub esp, X This is the standard prologe. X is the total size in bytes of variables used in the function void myfunc() { int a, b, c; … } Local variables can be accessed by referencing ebp e.g. mov eax, [ebp-8] _myfunc: push ebp mov ebp, esp sub esp, 12 Copyright © 2015 Symantec Corporation
20
Basic Instructions mov dst, src Data Movement mov, push, pop, lea
Copyright © 2015 Symantec Corporation
21
Basic Instructions mov eax, 0x3 Data Movement mov, push, pop, lea EAX
00 03 Copyright © 2015 Symantec Corporation
22
Basic Instructions mov ebx, 0x40100000 mov eax, [ebx] Data Movement
mov, push, pop, lea mov ebx, 0x mov eax, [ebx] EAX 00 6F 6C 65 68 Copyright © 2015 Symantec Corporation
23
Basic Instructions push 10 call myfunc Data Movement
mov, push, pop, lea push 10 call myfunc Copyright © 2015 Symantec Corporation
24
push offset aSimpleHello
Basic Instructions Data Movement mov, push, pop, lea push offset aSimpleHello call printf Copyright © 2015 Symantec Corporation
25
Basic Instructions push 10 .. pop Data Movement mov, push, pop, lea
Copyright © 2015 Symantec Corporation
26
Basic Instructions mov eax, 5 push eax .. pop eax Data Movement
mov, push, pop, lea mov eax, 5 push eax .. pop eax EAX 00 05 Copyright © 2015 Symantec Corporation
27
Basic Instructions lea ebx, [eax] call ebx Data Movement
mov, push, pop, lea lea ebx, [eax] call ebx LEA – load effective address Copyright © 2015 Symantec Corporation
28
Basic Instructions mov eax, 2 add eax, 2
Arithmetic and Logic Instructions add, sub – integer addition and subtraction inc, dec – increment, decrement mul, div – integer multiplication and division and, or, xor – bitwise logical and, or and exclusive or not, neg – bitwise logical not and negate shl, shr – shift left and shift right mov eax, 2 add eax, 2 EAX 00 04 Copyright © 2015 Symantec Corporation
29
Basic Instructions mov eax, 65 mov ecx, 4 div ecx
Arithmetic and Logic Instructions add, sub – integer addition and subtraction inc, dec – increment, decrement mul, div – integer multiplication and division and, or, xor – bitwise logical and, or and exclusive or not, neg – bitwise logical not and negate shl, shr – shift left and shift right mov eax, 65 mov ecx, 4 div ecx EDX 00 01 Copyright © 2015 Symantec Corporation
30
Basic Instructions call myfunc cmp eax, 0 jnz fail ..continue..
Control Flow instructions jmp – jump to location j<condition> - jump to location when condition met je, jne, jz, jg, jge, jl, jle cmp – compare call, ret – subroutine call and return call myfunc cmp eax, 0 jnz fail ..continue.. Copyright © 2015 Symantec Corporation
31
Basic Instructions mov eax, 3 incFunc: push eax push ebp call incFunc
Control Flow instructions jmp – jump to location j<condition> - jump to location when condition met je, jne, jz, jg, jge, jl, jle cmp – compare call, ret – subroutine call and return mov eax, 3 push eax call incFunc cmp eax jz error call printf incFunc: push ebp mov ebp, esp add eax, 1 mov esp, ebp pop ebp retn Copyright © 2015 Symantec Corporation
32
Opcode map Copyright © 2015 Symantec Corporation
33
Experiment Play around and experiment! Write programs, decompile them
Windows, Linux, Android Other architectures – AMD, ARM gdb./prog disas main Play around with other file formats ELF, Mach-O, Java etc Netwide Assembler for 80x86 - NASM Adam Stanislav - Lots of tutorials online! Copyright © 2015 Symantec Corporation
34
Tools Copyright © 2015 Symantec Corporation
35
Hiew Hex editor for windows. Curses based interface.
Understands and is capable of parsing the PE Format. Easily allows you to navigate through the PE Format. Allows simple manipulation of Hex bytes/opcodes, Assembly language and Ascii strings embedded in the binary. A handy tool to quickly triage a new binary. Copyright © 2015 Symantec Corporation
36
Hiew Contains three distinct views of the Binary.
Pure hex, with Ascii strings displayed on the RHS. Disasembly view of the binary. Binary presented in a plaintext view. Looks old fashioned and ugly but very powerful and extremely fast. Lots of nice features and great shortcuts. Bind it to a shortcut key or in a context menu for ease of use. Copyright © 2015 Symantec Corporation
37
Hiew Copyright © 2015 Symantec Corporation
38
Ollydbg OllyDbg is a 32-bit assembler level analysing debugger for Microsoft Windows. Emphasis on binary code analysis makes it particularly useful in cases where source is unavailable. A go to tool for malware analysis tool for reverse engineers. Can be used to reverse engineer and debug all binaries for which you don’t have the original source code. Immediately lets you see disassembly, registers, stack and arbitrary memory locations. Allows you to rename functions, locations and add comments to the disassembly to ease analysis. Allows you to add breakpoints directly to the disassembly. Contains a number of very useful plugins which can ease malware analysis and prevent nasty tricks in the code. “Smart” debugger that recognises loops, API calls, switches etc. Allows you to debug tricky applications easily. Copyright © 2015 Symantec Corporation
39
Disasm view Displays disassembly, opcodes and some useful hints of the binary/executable. Allows single stepping into (F7) or over (F8) commands or sequences of commands. Allows setting breakpoints (F2) on “interesting” instructions you want execution to break at (breakpoints are highlighted in red). Easily displays Jumps (highlighted in yellow) and function Calls (highlighted in turquoise). Copyright © 2015 Symantec Corporation
40
Registers view Displays the common x86 registers: EAX, EBX, ECX, EDX, ESI, EDI and allows direct modification of the registers. Useful to modify the current program’s state during execution. Can also be useful to redirect current instructions to point at new sections of memory. Displays the X86 flag registers and allows toggling of the flags (can be used to control conditional jumps). Copyright © 2015 Symantec Corporation
41
Stack View Displays the current stack of the debugged program allows modification of entries in the stack. Allows a user to easily track stack frames for current functions and procedures. Can be used to modify stack frames and alter stack memory directly. Copyright © 2015 Symantec Corporation
42
Memory View Allows an arbitrary view of memory from the currently debugged program. Allows a user to easily manipulate memory in the current program. Can be used to quickly jump all over the program’s memory layout using CTRL-G and an address! Copyright © 2015 Symantec Corporation
43
Frequently used shortcuts
Ctrl+F2 Restart program Alt+F2 Close program F3 Open new program F5 Maximize/restore active window Alt+F5 Make OllyDbg topmost F7 Step into (entering functions) Ctrl+F7 Animate into (entering functions) F8 Step over (executing function calls at once) Ctrl+F8 Animate over (executing function calls at once) F9 Run Shift+F9 Pass exception to standard handler and run Ctrl+F9 Execute till return Alt+F9 Execute till user code Ctrl+F11 Trace into F12 Pause Ctrl+F12 Trace over Alt+B Open Breakpoints window Alt+C Open CPU window Alt+E Open Modules window Alt+L Open Log window Alt+M Open Memory window Alt+O Open Options dialog Ctrl+T Set condition to pause Run trace Alt+X Close OllyDbg Copyright © 2015 Symantec Corporation
44
Frequently used shortcuts
Toggle breakpoint Shift+F2 Set conditional breakpoint F4 Run to selection Alt+F7 Go to previous reference Alt+F8 Go to next reference Ctrl+A Analyse code Ctrl+B Start binary search Ctrl+C Copy selection to clipboard Ctrl+E Edit selection in binary format Ctrl+F Search for a command Ctrl+G Follow expression Ctrl+J Show list of jumps to selected line Ctrl+K View call tree Ctrl+L Repeat last search Ctrl+N Open list of labels (names) Ctrl+O Scan object files Ctrl+R Find references to selected command Ctrl+S Search for a sequence of commands Asterisk (*) Origin Enter Follow jump or call Plus (+) Go to next location/next run trace item Minus (-) Go to previous location/previous run trace item Space ( ) Assemble Colon (:) Add label Semicolon (;) Add comment Copyright © 2015 Symantec Corporation
45
IDA Free Free version of the IDA program.
More emphasis on binary code analysis makes it particularly useful in cases where source is unavailable. A go to tool for malware analysis tool for reverse engineers. Can be used to reverse engineer and debug all binaries for which you don’t have the original source code. Immediately lets you see disassembly, registers, stack and arbitrary memory locations. Complicated program, lots of options (has an entire book devoted to it). More of a static file analysis tool than Ollydbg, but contains a brilliant debugger that is well worth learning. The free version is a slightly crippled but more than enough for our simple programs. Has a lot more features for static analysis of programs than Olly, using Olly side by side with IDA is very powerful. Use IDA as a database for all analysis performed with Olly. Use Olly to fill in any “blanks” you may have while statically analysing programs with IDA. Code that looks like gibberish with IDA will make more sense when executed with Olly. Copyright © 2015 Symantec Corporation
46
Disasm View Displays disassembly, opcodes and some useful hints of the binary/executable. Has “smart” code recognition, helps to identify loops, stack variables, functions (including parameters) and return values. Will track variables deep into assembly code allowing you to identify their use accurately. Allows commenting of almost every line of code. Has a number (loads) of shortcuts for: renaming code, setting bookmarks, getting cross references to specific parts of code and memory locations. Copyright © 2015 Symantec Corporation
47
Copyright © 2015 Symantec Corporation
48
Overview Navigator Represents a linear view of the whole address space of the loaded program. Colour coded so you can quickly see interesting parts of memory. Turquoise: Library function. Blue: Regular function. Red: Instruction. Grey: Data Item. Pink: External Symbol. Allows you to jump to a part of memory with left click. Allows you to zoom in with right click. Copyright © 2015 Symantec Corporation
49
Strings View Strings present in the binary and associated data section addresses. Allows you to jump directly to the location where the string is defined. Then allows you to take an Xref, by pressing shortcut X, to see where the string is referenced from. Can be useful for tracking interesting parts of code. Copyright © 2015 Symantec Corporation
50
Functions View All functions and associated address in the binary.
Useful for tracking interesting functions in the binary. When used in conjunction with function renaming makes the binary simple to navigate. Try using it to find the _main function in each of the challenges! Once you find the _main function you can then set a breakpoint on the first instruction using Olly! Copyright © 2015 Symantec Corporation
51
Challenges Demo! Copyright © 2015 Symantec Corporation
52
Copyright © 2015 Symantec Corporation
53
Alan Neville / anev@rb Cathal Mullaney / nemo@rb
54
Additional Resources Campaign imagery, logos and enhanced slides are located here: Alternate background pictures for Title slides and Transition slides are located on the Brand, Digital and Advertising site: ons/globalbrand/powerpoint-templates.asp If you are interested in additional training, specifically designing visual messages in PowerPoint please contact The Presentation Company LLC Copyright © 2015 Symantec Corporation
Similar presentations
© 2025 SlidePlayer.com. Inc.
All rights reserved.