Automating re with python - WordPress.com · We are hiring! Security people Highly skilled team...
Transcript of Automating re with python - WordPress.com · We are hiring! Security people Highly skilled team...
![Page 1: Automating re with python - WordPress.com · We are hiring! Security people Highly skilled team Hardware, mobile, binary, web, source code, network … Fun, Research, CONs, etc.](https://reader034.fdocuments.in/reader034/viewer/2022050215/5f6109b0d69333268b4d46b9/html5/thumbnails/1.jpg)
Automating re with python
A gentle introduction
![Page 2: Automating re with python - WordPress.com · We are hiring! Security people Highly skilled team Hardware, mobile, binary, web, source code, network … Fun, Research, CONs, etc.](https://reader034.fdocuments.in/reader034/viewer/2022050215/5f6109b0d69333268b4d46b9/html5/thumbnails/2.jpg)
Who are you
I assume some experience with
– Binary reversing?
– Debugging?
– Exploitation?
– Python?
![Page 3: Automating re with python - WordPress.com · We are hiring! Security people Highly skilled team Hardware, mobile, binary, web, source code, network … Fun, Research, CONs, etc.](https://reader034.fdocuments.in/reader034/viewer/2022050215/5f6109b0d69333268b4d46b9/html5/thumbnails/3.jpg)
whoami
Nerd (zombies, cylons…)
Geek (reversing, python…)
Consultant :)
![Page 4: Automating re with python - WordPress.com · We are hiring! Security people Highly skilled team Hardware, mobile, binary, web, source code, network … Fun, Research, CONs, etc.](https://reader034.fdocuments.in/reader034/viewer/2022050215/5f6109b0d69333268b4d46b9/html5/thumbnails/4.jpg)
We are hiring!
Security people
Highly skilled team
Hardware, mobile, binary, web, source
code, network …
Fun, Research, CONs, etc.
Consultancy / business oriented
Talk to me!
![Page 5: Automating re with python - WordPress.com · We are hiring! Security people Highly skilled team Hardware, mobile, binary, web, source code, network … Fun, Research, CONs, etc.](https://reader034.fdocuments.in/reader034/viewer/2022050215/5f6109b0d69333268b4d46b9/html5/thumbnails/5.jpg)
agenda
Checking out the application
Static analysis
winappdbg
Intel PIN
vdb / vtrace
freedom
![Page 6: Automating re with python - WordPress.com · We are hiring! Security people Highly skilled team Hardware, mobile, binary, web, source code, network … Fun, Research, CONs, etc.](https://reader034.fdocuments.in/reader034/viewer/2022050215/5f6109b0d69333268b4d46b9/html5/thumbnails/6.jpg)
agenda
![Page 7: Automating re with python - WordPress.com · We are hiring! Security people Highly skilled team Hardware, mobile, binary, web, source code, network … Fun, Research, CONs, etc.](https://reader034.fdocuments.in/reader034/viewer/2022050215/5f6109b0d69333268b4d46b9/html5/thumbnails/7.jpg)
Setting the scope
• 2 hours is not very long
• Just an introduction
• Basically a compilation of things very
intelligent people did
• a nice overview if you don‘t have a
deep knowledge of this topic
![Page 8: Automating re with python - WordPress.com · We are hiring! Security people Highly skilled team Hardware, mobile, binary, web, source code, network … Fun, Research, CONs, etc.](https://reader034.fdocuments.in/reader034/viewer/2022050215/5f6109b0d69333268b4d46b9/html5/thumbnails/8.jpg)
Static analysis
![Page 9: Automating re with python - WordPress.com · We are hiring! Security people Highly skilled team Hardware, mobile, binary, web, source code, network … Fun, Research, CONs, etc.](https://reader034.fdocuments.in/reader034/viewer/2022050215/5f6109b0d69333268b4d46b9/html5/thumbnails/9.jpg)
![Page 10: Automating re with python - WordPress.com · We are hiring! Security people Highly skilled team Hardware, mobile, binary, web, source code, network … Fun, Research, CONs, etc.](https://reader034.fdocuments.in/reader034/viewer/2022050215/5f6109b0d69333268b4d46b9/html5/thumbnails/10.jpg)
Static analysis
Ida pro scripts
Idc
in C language
Must recompile every time
Idapython
Python bindings
Me gusta…
![Page 11: Automating re with python - WordPress.com · We are hiring! Security people Highly skilled team Hardware, mobile, binary, web, source code, network … Fun, Research, CONs, etc.](https://reader034.fdocuments.in/reader034/viewer/2022050215/5f6109b0d69333268b4d46b9/html5/thumbnails/11.jpg)
Naive crypto search
![Page 12: Automating re with python - WordPress.com · We are hiring! Security people Highly skilled team Hardware, mobile, binary, web, source code, network … Fun, Research, CONs, etc.](https://reader034.fdocuments.in/reader034/viewer/2022050215/5f6109b0d69333268b4d46b9/html5/thumbnails/12.jpg)
Naive crypto search
![Page 13: Automating re with python - WordPress.com · We are hiring! Security people Highly skilled team Hardware, mobile, binary, web, source code, network … Fun, Research, CONs, etc.](https://reader034.fdocuments.in/reader034/viewer/2022050215/5f6109b0d69333268b4d46b9/html5/thumbnails/13.jpg)
Naive crypto search
![Page 14: Automating re with python - WordPress.com · We are hiring! Security people Highly skilled team Hardware, mobile, binary, web, source code, network … Fun, Research, CONs, etc.](https://reader034.fdocuments.in/reader034/viewer/2022050215/5f6109b0d69333268b4d46b9/html5/thumbnails/14.jpg)
Find special x86 instructions
![Page 15: Automating re with python - WordPress.com · We are hiring! Security people Highly skilled team Hardware, mobile, binary, web, source code, network … Fun, Research, CONs, etc.](https://reader034.fdocuments.in/reader034/viewer/2022050215/5f6109b0d69333268b4d46b9/html5/thumbnails/15.jpg)
Let‘s do it!!!
![Page 16: Automating re with python - WordPress.com · We are hiring! Security people Highly skilled team Hardware, mobile, binary, web, source code, network … Fun, Research, CONs, etc.](https://reader034.fdocuments.in/reader034/viewer/2022050215/5f6109b0d69333268b4d46b9/html5/thumbnails/16.jpg)
IDA Pro Plugin
m.i.l.f. plugin
![Page 17: Automating re with python - WordPress.com · We are hiring! Security people Highly skilled team Hardware, mobile, binary, web, source code, network … Fun, Research, CONs, etc.](https://reader034.fdocuments.in/reader034/viewer/2022050215/5f6109b0d69333268b4d46b9/html5/thumbnails/17.jpg)
IDA Pro Plugins
serious plugins
You can not go without them
![Page 18: Automating re with python - WordPress.com · We are hiring! Security people Highly skilled team Hardware, mobile, binary, web, source code, network … Fun, Research, CONs, etc.](https://reader034.fdocuments.in/reader034/viewer/2022050215/5f6109b0d69333268b4d46b9/html5/thumbnails/18.jpg)
How‘s everyone doing?
![Page 19: Automating re with python - WordPress.com · We are hiring! Security people Highly skilled team Hardware, mobile, binary, web, source code, network … Fun, Research, CONs, etc.](https://reader034.fdocuments.in/reader034/viewer/2022050215/5f6109b0d69333268b4d46b9/html5/thumbnails/19.jpg)
Winappdbg
![Page 20: Automating re with python - WordPress.com · We are hiring! Security people Highly skilled team Hardware, mobile, binary, web, source code, network … Fun, Research, CONs, etc.](https://reader034.fdocuments.in/reader034/viewer/2022050215/5f6109b0d69333268b4d46b9/html5/thumbnails/20.jpg)
keepassada
Copying data to the clipboard:
OpenClipboard()
EmptyClipboard()
hClipboardData = GlobalAlloc() // Get RetValue
pchData = (char*)GlobalLock(hClipboardData)
strcpy(pchData, LPCSTR(strData))
GlobalUnlock(hClipboardData)
SetClipboardData(CF_TEXT, hClipboardData) // Hook this
CloseClipboard()
![Page 21: Automating re with python - WordPress.com · We are hiring! Security people Highly skilled team Hardware, mobile, binary, web, source code, network … Fun, Research, CONs, etc.](https://reader034.fdocuments.in/reader034/viewer/2022050215/5f6109b0d69333268b4d46b9/html5/thumbnails/21.jpg)
keepassada
Enter video!
![Page 22: Automating re with python - WordPress.com · We are hiring! Security people Highly skilled team Hardware, mobile, binary, web, source code, network … Fun, Research, CONs, etc.](https://reader034.fdocuments.in/reader034/viewer/2022050215/5f6109b0d69333268b4d46b9/html5/thumbnails/22.jpg)
Homework!
![Page 23: Automating re with python - WordPress.com · We are hiring! Security people Highly skilled team Hardware, mobile, binary, web, source code, network … Fun, Research, CONs, etc.](https://reader034.fdocuments.in/reader034/viewer/2022050215/5f6109b0d69333268b4d46b9/html5/thumbnails/23.jpg)
winappdbg
Win32 API wrapper
Fuck Yeah Python!™
Written by mario vilas
This is mario
Buy him a beer if you meet him
![Page 24: Automating re with python - WordPress.com · We are hiring! Security people Highly skilled team Hardware, mobile, binary, web, source code, network … Fun, Research, CONs, etc.](https://reader034.fdocuments.in/reader034/viewer/2022050215/5f6109b0d69333268b4d46b9/html5/thumbnails/24.jpg)
winappdbg
Case studies
Tracer.py
Functions hit?
Wtfdll.py
Dlls loaded at runtime?
Tracer_dot.py
Yay, graphs!
![Page 25: Automating re with python - WordPress.com · We are hiring! Security people Highly skilled team Hardware, mobile, binary, web, source code, network … Fun, Research, CONs, etc.](https://reader034.fdocuments.in/reader034/viewer/2022050215/5f6109b0d69333268b4d46b9/html5/thumbnails/25.jpg)
winappdbg
Tracer.py
Performance problems (-1)
Slow (-1)
Need function list (ida) (-1)
It is python (+500)
Pydot ftw (+500)
![Page 26: Automating re with python - WordPress.com · We are hiring! Security people Highly skilled team Hardware, mobile, binary, web, source code, network … Fun, Research, CONs, etc.](https://reader034.fdocuments.in/reader034/viewer/2022050215/5f6109b0d69333268b4d46b9/html5/thumbnails/26.jpg)
Tracer & derivatives
![Page 27: Automating re with python - WordPress.com · We are hiring! Security people Highly skilled team Hardware, mobile, binary, web, source code, network … Fun, Research, CONs, etc.](https://reader034.fdocuments.in/reader034/viewer/2022050215/5f6109b0d69333268b4d46b9/html5/thumbnails/27.jpg)
Tracer & derivatives
![Page 28: Automating re with python - WordPress.com · We are hiring! Security people Highly skilled team Hardware, mobile, binary, web, source code, network … Fun, Research, CONs, etc.](https://reader034.fdocuments.in/reader034/viewer/2022050215/5f6109b0d69333268b4d46b9/html5/thumbnails/28.jpg)
Let‘s do it!!!
![Page 29: Automating re with python - WordPress.com · We are hiring! Security people Highly skilled team Hardware, mobile, binary, web, source code, network … Fun, Research, CONs, etc.](https://reader034.fdocuments.in/reader034/viewer/2022050215/5f6109b0d69333268b4d46b9/html5/thumbnails/29.jpg)
question
Can you imagine why in hell Could
this be useful to anybody?
FACEBOOK Ctf
Fuzzing!?!?!
Impress chicks
A lot more
![Page 30: Automating re with python - WordPress.com · We are hiring! Security people Highly skilled team Hardware, mobile, binary, web, source code, network … Fun, Research, CONs, etc.](https://reader034.fdocuments.in/reader034/viewer/2022050215/5f6109b0d69333268b4d46b9/html5/thumbnails/30.jpg)
Watching dlls load
![Page 31: Automating re with python - WordPress.com · We are hiring! Security people Highly skilled team Hardware, mobile, binary, web, source code, network … Fun, Research, CONs, etc.](https://reader034.fdocuments.in/reader034/viewer/2022050215/5f6109b0d69333268b4d46b9/html5/thumbnails/31.jpg)
Tracer & pydot
![Page 32: Automating re with python - WordPress.com · We are hiring! Security people Highly skilled team Hardware, mobile, binary, web, source code, network … Fun, Research, CONs, etc.](https://reader034.fdocuments.in/reader034/viewer/2022050215/5f6109b0d69333268b4d46b9/html5/thumbnails/32.jpg)
Tracer & pydot
![Page 33: Automating re with python - WordPress.com · We are hiring! Security people Highly skilled team Hardware, mobile, binary, web, source code, network … Fun, Research, CONs, etc.](https://reader034.fdocuments.in/reader034/viewer/2022050215/5f6109b0d69333268b4d46b9/html5/thumbnails/33.jpg)
Let‘s do it!!!
![Page 34: Automating re with python - WordPress.com · We are hiring! Security people Highly skilled team Hardware, mobile, binary, web, source code, network … Fun, Research, CONs, etc.](https://reader034.fdocuments.in/reader034/viewer/2022050215/5f6109b0d69333268b4d46b9/html5/thumbnails/34.jpg)
INTEL PIN
![Page 35: Automating re with python - WordPress.com · We are hiring! Security people Highly skilled team Hardware, mobile, binary, web, source code, network … Fun, Research, CONs, etc.](https://reader034.fdocuments.in/reader034/viewer/2022050215/5f6109b0d69333268b4d46b9/html5/thumbnails/35.jpg)
INTEL PIN
Case studies
A more efficient tracer
Detect buffer overflows
EIP outside text section
![Page 36: Automating re with python - WordPress.com · We are hiring! Security people Highly skilled team Hardware, mobile, binary, web, source code, network … Fun, Research, CONs, etc.](https://reader034.fdocuments.in/reader034/viewer/2022050215/5f6109b0d69333268b4d46b9/html5/thumbnails/36.jpg)
INTEL PIN
A more efficient tracer
![Page 37: Automating re with python - WordPress.com · We are hiring! Security people Highly skilled team Hardware, mobile, binary, web, source code, network … Fun, Research, CONs, etc.](https://reader034.fdocuments.in/reader034/viewer/2022050215/5f6109b0d69333268b4d46b9/html5/thumbnails/37.jpg)
INTEL PIN
![Page 38: Automating re with python - WordPress.com · We are hiring! Security people Highly skilled team Hardware, mobile, binary, web, source code, network … Fun, Research, CONs, etc.](https://reader034.fdocuments.in/reader034/viewer/2022050215/5f6109b0d69333268b4d46b9/html5/thumbnails/38.jpg)
INTEL PIN
Let‘s hunt a buffer overflow!
Does Everybody know the seh overwrite
exploiting technique?
(I read the idea originally at
http://scrammed.blogspot.com)
![Page 39: Automating re with python - WordPress.com · We are hiring! Security people Highly skilled team Hardware, mobile, binary, web, source code, network … Fun, Research, CONs, etc.](https://reader034.fdocuments.in/reader034/viewer/2022050215/5f6109b0d69333268b4d46b9/html5/thumbnails/39.jpg)
INTEL PIN
![Page 40: Automating re with python - WordPress.com · We are hiring! Security people Highly skilled team Hardware, mobile, binary, web, source code, network … Fun, Research, CONs, etc.](https://reader034.fdocuments.in/reader034/viewer/2022050215/5f6109b0d69333268b4d46b9/html5/thumbnails/40.jpg)
INTEL PIN
![Page 41: Automating re with python - WordPress.com · We are hiring! Security people Highly skilled team Hardware, mobile, binary, web, source code, network … Fun, Research, CONs, etc.](https://reader034.fdocuments.in/reader034/viewer/2022050215/5f6109b0d69333268b4d46b9/html5/thumbnails/41.jpg)
INTEL PIN
Detect EIP outside text section
![Page 42: Automating re with python - WordPress.com · We are hiring! Security people Highly skilled team Hardware, mobile, binary, web, source code, network … Fun, Research, CONs, etc.](https://reader034.fdocuments.in/reader034/viewer/2022050215/5f6109b0d69333268b4d46b9/html5/thumbnails/42.jpg)
INTEL PIN
Detect EIP outside text section
![Page 43: Automating re with python - WordPress.com · We are hiring! Security people Highly skilled team Hardware, mobile, binary, web, source code, network … Fun, Research, CONs, etc.](https://reader034.fdocuments.in/reader034/viewer/2022050215/5f6109b0d69333268b4d46b9/html5/thumbnails/43.jpg)
Experimentation time
![Page 44: Automating re with python - WordPress.com · We are hiring! Security people Highly skilled team Hardware, mobile, binary, web, source code, network … Fun, Research, CONs, etc.](https://reader034.fdocuments.in/reader034/viewer/2022050215/5f6109b0d69333268b4d46b9/html5/thumbnails/44.jpg)
INTEL PIN
Valgrind-like for Windows
Check memory allocations
Double free(s)
![Page 45: Automating re with python - WordPress.com · We are hiring! Security people Highly skilled team Hardware, mobile, binary, web, source code, network … Fun, Research, CONs, etc.](https://reader034.fdocuments.in/reader034/viewer/2022050215/5f6109b0d69333268b4d46b9/html5/thumbnails/45.jpg)
INTEL PIN
![Page 46: Automating re with python - WordPress.com · We are hiring! Security people Highly skilled team Hardware, mobile, binary, web, source code, network … Fun, Research, CONs, etc.](https://reader034.fdocuments.in/reader034/viewer/2022050215/5f6109b0d69333268b4d46b9/html5/thumbnails/46.jpg)
Vdb / vtrace
![Page 47: Automating re with python - WordPress.com · We are hiring! Security people Highly skilled team Hardware, mobile, binary, web, source code, network … Fun, Research, CONs, etc.](https://reader034.fdocuments.in/reader034/viewer/2022050215/5f6109b0d69333268b4d46b9/html5/thumbnails/47.jpg)
Vdb / vtrace
Yep, it is Python
It does pretty much what others do
And Linux… and ARM… and PPC… etc.
Look, I‘m so cool!
READABLE CODE
NO DOCUMENTATION
![Page 48: Automating re with python - WordPress.com · We are hiring! Security people Highly skilled team Hardware, mobile, binary, web, source code, network … Fun, Research, CONs, etc.](https://reader034.fdocuments.in/reader034/viewer/2022050215/5f6109b0d69333268b4d46b9/html5/thumbnails/48.jpg)
Vdb / vtrace
![Page 49: Automating re with python - WordPress.com · We are hiring! Security people Highly skilled team Hardware, mobile, binary, web, source code, network … Fun, Research, CONs, etc.](https://reader034.fdocuments.in/reader034/viewer/2022050215/5f6109b0d69333268b4d46b9/html5/thumbnails/49.jpg)
Vdb / vtrace
![Page 50: Automating re with python - WordPress.com · We are hiring! Security people Highly skilled team Hardware, mobile, binary, web, source code, network … Fun, Research, CONs, etc.](https://reader034.fdocuments.in/reader034/viewer/2022050215/5f6109b0d69333268b4d46b9/html5/thumbnails/50.jpg)
Vdb / vtrace
![Page 51: Automating re with python - WordPress.com · We are hiring! Security people Highly skilled team Hardware, mobile, binary, web, source code, network … Fun, Research, CONs, etc.](https://reader034.fdocuments.in/reader034/viewer/2022050215/5f6109b0d69333268b4d46b9/html5/thumbnails/51.jpg)
Experimentation time
![Page 52: Automating re with python - WordPress.com · We are hiring! Security people Highly skilled team Hardware, mobile, binary, web, source code, network … Fun, Research, CONs, etc.](https://reader034.fdocuments.in/reader034/viewer/2022050215/5f6109b0d69333268b4d46b9/html5/thumbnails/52.jpg)
Quick recap
• Python based:
– Fast prototyping but…
– damn slow
• Intel pin
– Fast and intelligent but…
– convoluted