Analyse and binary transformation Guillaume Bouffard Analyse and - - PowerPoint PPT Presentation

▶

analyse and binary transformation

Analyse and binary transformation Guillaume Bouffard Analyse and - - PowerPoint PPT Presentation

Nov 03, 2022 376 likes •782 views

Analyse and binary transformation Guillaume Bouffard Analyse and binary transformation Guillaume Bouffard Outline 1 Introduction Profiling step 2 Translation step 3 Binary Modification 4 Proof Of Concept 5 Conclusion 6 2 / 19

slide-1

SLIDE 1

Analyse and binary transformation

Guillaume Bouffard

slide-2

SLIDE 2

Analyse and binary transformation

Guillaume Bouffard

slide-3

SLIDE 3

Outline

1

Introduction

2

Profiling step

3

Translation step

4

Binary Modification

5

Proof Of Concept

6

Conclusion

2 / 19 Limoges, September 8, 2010

slide-4

SLIDE 4

Outline

1

Introduction Technicolor My Internship

2

Profiling step

3

Translation step

4

Binary Modification

5

Proof Of Concept

6

Conclusion

slide-5

SLIDE 5

Technicolor Security and Content Protection Labs

Technicolor

Creating, managing and delivering video For the Communication, Media and Entertainment industries.

Their works

Cryptography Signal processing for security Content protection (DRM) Network security Tamper resistance

3 / 19 Limoges, September 8, 2010

slide-6

SLIDE 6

Context

The Internship Context

Illegal software duplication and intellectual property theft Software protection VS hardware protection Hardware protection?

4 / 19 Limoges, September 8, 2010

slide-7

SLIDE 7

Subject

Binary executable without source code Search sensitive part of the binary application in a generic way Extract the sensitive piece of code Translate the sensitive piece of code Protect the piece

f code in a dongle

Insert instructions to communicate to a dongle Modify binary ex- ecutable without sensitive part

5 / 19 Limoges, September 8, 2010

slide-8

SLIDE 8

Motivation

What was my motivation?

A blend of compilation and smart card problems Discover the computer science underground Think on a research subject

6 / 19 Limoges, September 8, 2010

slide-9

SLIDE 9

Outline

1

Introduction

2

Profiling step

3

Translation step

4

Binary Modification

5

Proof Of Concept

6

Conclusion

slide-10

SLIDE 10

Application Profiling

What do you want to find?

Each executed binary piece of code Found the sensitive parts

What can tools do that?

OProfile Valgrind

7 / 19 Limoges, September 8, 2010

slide-11

SLIDE 11

Outline

1

Introduction

2

Profiling step

3

Translation step

4

Binary Modification

5

Proof Of Concept

6

Conclusion

slide-12

SLIDE 12

Translation step

The Goal

Protect the sensitive pieces of code in a dongle These pieces of code are executed by the dongle => A solution: UQBT

8 / 19 Limoges, September 8, 2010

slide-13

SLIDE 13

Outline

1

Introduction

2

Profiling step

3

Translation step

4

Binary Modification ELF Format Diablo Samples

5

Proof Of Concept

6

Conclusion

slide-14

SLIDE 14

Executable and Linkable Format

... .data .rodata .text Program header table ELF header Section header table

{

{

Executable and Linkable Format

Used by Unices & GNU/Linux Each section are linked How can I modify this file format?

9 / 19 Limoges, September 8, 2010

slide-15

SLIDE 15

Executable and Linkable Format

... .data .rodata .text Program header table ELF header Section header table

{

{

Executable and Linkable Format

Used by Unices & GNU/Linux Each section are linked How can I modify this file format?

9 / 19 Limoges, September 8, 2010

slide-16

SLIDE 16

Diablo

Parser Disassemble Flowgraph Object files (.o) Map file (.map) Linked program Some modifications Disflowgraph Assemble

Modified binary

10 / 19 Limoges, September 8, 2010

slide-17

SLIDE 17

Brief overview of assembler

... some value (%esp) some value (%eax) ...

$ ./hello_world hello world

#include <stdio.h> int main ( void ) { ⇒printf("hello world\n"); ⇒return EXIT_SUCCESS ; ⇒} <main >: ⇒mov DWORD PTR [esp],0 x8096188 ⇒call 80486 c0 <_IO_printf > ⇒mov eax ,0x0 ⇒leave ⇒ret

11 / 19 Limoges, September 8, 2010

slide-18

SLIDE 18

Brief overview of assembler

... some value (%esp) some value (%eax) ...

$ ./hello_world hello world

#include <stdio.h> int main ( void ) { ⇒printf("hello world\n"); ⇒return EXIT_SUCCESS ; ⇒} <main >: ⇒mov DWORD PTR [esp],0 x8096188 ⇒call 80486 c0 <_IO_printf > ⇒mov eax ,0x0 ⇒leave ⇒ret

11 / 19 Limoges, September 8, 2010

slide-19

SLIDE 19

Brief overview of assembler

... 0x8096188 (%esp) some value (%eax) ...

$ ./hello_world hello world

#include <stdio.h> int main ( void ) { ⇒printf("hello world\n"); ⇒return EXIT_SUCCESS ; ⇒} <main >: ⇒mov DWORD PTR [esp],0 x8096188 ⇒call 80486 c0 <_IO_printf > ⇒mov eax ,0x0 ⇒leave ⇒ret

11 / 19 Limoges, September 8, 2010

slide-20

SLIDE 20

Brief overview of assembler

... 0x8096188 (%esp) some value (%eax) ...

$ ./hello_world hello world

#include <stdio.h> int main ( void ) { ⇒printf("hello world\n"); ⇒return EXIT_SUCCESS ; ⇒} <main >: ⇒mov DWORD PTR [esp],0 x8096188 ⇒call 80486 c0 <_IO_printf > ⇒mov eax ,0x0 ⇒leave ⇒ret

11 / 19 Limoges, September 8, 2010

slide-21

SLIDE 21

Brief overview of assembler

... printf return value (%esp) some value (%eax) ...

$ ./hello_world hello world

#include <stdio.h> int main ( void ) { ⇒printf("hello world\n"); ⇒return EXIT_SUCCESS ; ⇒} <main >: ⇒mov DWORD PTR [esp],0 x8096188 ⇒call 80486 c0 <_IO_printf > ⇒mov eax ,0x0 ⇒leave ⇒ret

11 / 19 Limoges, September 8, 2010

slide-22

SLIDE 22

Brief overview of assembler

... printf return value (%esp) some value (%eax) ...

$ ./hello_world hello world

#include <stdio.h> int main ( void ) { ⇒printf("hello world\n"); ⇒return EXIT_SUCCESS ; ⇒} <main >: ⇒mov DWORD PTR [esp],0 x8096188 ⇒call 80486 c0 <_IO_printf > ⇒mov eax ,0x0 ⇒leave ⇒ret

11 / 19 Limoges, September 8, 2010

slide-23

SLIDE 23

Brief overview of assembler

... printf return value (%esp) 0x00 (%eax) ...

$ ./hello_world hello world

#include <stdio.h> int main ( void ) { ⇒printf("hello world\n"); ⇒return EXIT_SUCCESS ; ⇒} <main >: ⇒mov DWORD PTR [esp],0 x8096188 ⇒call 80486 c0 <_IO_printf > ⇒mov eax ,0x0 ⇒leave ⇒ret

11 / 19 Limoges, September 8, 2010

slide-24

SLIDE 24

Brief overview of assembler

... printf return value (%esp) 0x00 (%eax) ...

$ ./hello_world hello world

#include <stdio.h> int main ( void ) { ⇒printf("hello world\n"); ⇒return EXIT_SUCCESS ; ⇒} <main >: ⇒mov DWORD PTR [esp],0 x8096188 ⇒call 80486 c0 <_IO_printf > ⇒mov eax ,0x0 ⇒leave ⇒ret

11 / 19 Limoges, September 8, 2010

slide-25

SLIDE 25

Brief overview of assembler

... printf return value (%esp) 0x00 (%eax) ...

$ ./hello_world hello world

#include <stdio.h> int main ( void ) { ⇒printf("hello world\n"); ⇒return EXIT_SUCCESS ; ⇒} <main >: ⇒mov DWORD PTR [esp],0 x8096188 ⇒call 80486 c0 <_IO_printf > ⇒mov eax ,0x0 ⇒leave ⇒ret

11 / 19 Limoges, September 8, 2010

slide-26

SLIDE 26

Hello World

HELL bbl at 0x80481f0 (in main at 0x80481f0) ... 0x8048200 : movl DWORD PTR [%esp],0x8096188 0x8048207 : call 80486c0 _IO_printf (0x80486c0) bbl at 0x804820c (in main at 0x80481f0) 0x804820c : movl %eax,0x0 0x8048211 : leave 0x8048212 : ret EXIT HELL int MyFunction (char *msg) { FILE * file = fopen ( "output" , "w" ); fprintf(file,msg); fclose(file); return EXIT_SUCCESS; } MyFunction.o

12 / 19 Limoges, September 8, 2010

slide-27

SLIDE 27

Hello World

HELL bbl at 0x80481f0 (in main at 0x80481f0) ... 0x8048200 : movl DWORD PTR [%esp],0x8096188 0x8048207 : call 80486c0 _IO_printf (0x80486c0) bbl at 0x804820c (in main at 0x80481f0) 0x804820c : movl %eax,0x0 0x8048211 : leave 0x8048212 : ret EXIT HELL <MyFunction>: mov DWORD PTR [esp+4],0x0 mov DWORD PTR [esp],0x0 call 16 <MyFunction+0x16> mov DWORD PTR [ebp-4],eax mov eax,DWORD PTR [ebp+8] mov DWORD PTR [esp+4],eax mov eax,DWORD PTR [ebp-4] mov DWORD PTR [esp],eax call 2b <MyFunction+0x2b> mov eax,DWORD PTR [ebp-4] mov DWORD PTR [esp],eax call 36 <MyFunction+0x36> mov eax,0x0 leave ret

12 / 19 Limoges, September 8, 2010

slide-28

SLIDE 28

Hello World

HELL bbl at 0x80481f0 (in main at 0x80481f0) ... 0x8048200 : movl DWORD PTR [%esp],0x8096188 0x8048207 : call 80486c0 _IO_printf (0x80486c0) bbl at 0x804820c (in main at 0x80481f0) 0x804820c : movl %eax,0x0 0x8048211 : leave 0x8048212 : ret EXIT HELL <MyFunction>: mov DWORD PTR [esp+4],0x0 mov DWORD PTR [esp],0x0 call 16 <MyFunction+0x16> mov DWORD PTR [ebp-4],eax mov eax,DWORD PTR [ebp+8] mov DWORD PTR [esp+4],eax mov eax,DWORD PTR [ebp-4] mov DWORD PTR [esp],eax call 2b <MyFunction+0x2b> mov eax,DWORD PTR [ebp-4] mov DWORD PTR [esp],eax call 36 <MyFunction+0x36> mov eax,0x0 leave ret

12 / 19 Limoges, September 8, 2010

slide-29

SLIDE 29

CouCou World

HELL bbl at 0x80481f0 (in main at 0x80481f0) ... 0x8048200 : movl DWORD PTR [%esp],0x8096188 0x8048207 : call 80486c0 MyFunction bbl at 0x804820c (in main at 0x80481f0) 0x804820c : movl %eax,0x0 0x8048211 : leave 0x8048212 : ret EXIT HELL ... .data .rodata .text Program header table ELF header Section header table

13 / 19 Limoges, September 8, 2010

slide-30

SLIDE 30

CouCou World

HELL bbl at 0x80481f0 (in main at 0x80481f0) ... 0x8048200 : movl DWORD PTR [%esp],0x8096188 0x8048207 : call 80486c0 MyFunction bbl at 0x804820c (in main at 0x80481f0) 0x804820c : movl %eax,0x0 0x8048211 : leave 0x8048212 : ret EXIT HELL ... .data .rodata .text Program header table ELF header Section header table

13 / 19 Limoges, September 8, 2010

slide-31

SLIDE 31

CouCou World

HELL bbl at 0x80481f0 (in main at 0x80481f0) ... 0x8048200 : movl DWORD PTR [%esp],0x8096188 0x8048207 : call 80486c0 MyFunction bbl at 0x804820c (in main at 0x80481f0) 0x804820c : movl %eax,0x0 0x8048211 : leave 0x8048212 : ret hello world\n EXIT HELL ... .data .rodata .text Program header table ELF header Section header table

13 / 19 Limoges, September 8, 2010

slide-32

SLIDE 32

CouCou World

HELL bbl at 0x80481f0 (in main at 0x80481f0) ... 0x8048200 : movl DWORD PTR [%esp],????????? 0x8048207 : call 80486c0 MyFunction bbl at 0x804820c (in main at 0x80481f0) 0x804820c : movl %eax,0x0 0x8048211 : leave 0x8048212 : ret hello world\n CouCou World\n EXIT HELL ... .data .rodata .text Program header table ELF header Section header table

13 / 19 Limoges, September 8, 2010

slide-33

SLIDE 33

Outline

1

Introduction

2

Profiling step

3

Translation step

4

Binary Modification

5

Proof Of Concept Java Card Side Communication Binary Application ⇔ the Smart Card Binary Modification

6

Conclusion

slide-34

SLIDE 34

Integers Multiplication

Main Idea

Use a simple product matrix Make each multiplication operation on a smart card Search & replace each multiplication instruction

An Integers Multiplication on a Java Card

Java Card cannot make a 32-bit number multiplication

14 / 19 Limoges, September 8, 2010

slide-35

SLIDE 35

Communication Binary Application ⇔ the Smart Card

Smart Card Manager Smart Card Smart card connected Select multiplication applet Multiplication applet selected Send numbers to multiply Get multiplication result Deselect multiplication applet Multiplication applet deselected msc

Implementation

Using a framework made by laboratory members Override libpcsc-lite to add some features Just a little bit complex. . .

15 / 19 Limoges, September 8, 2010

slide-36

SLIDE 36

The Last Binary Modification with Diablo

Modified application Smart Card Manager Smart Card Get stacked up values Smart card connected Select multiplication applet Multiplication applet selected Send numbers to multiply Get multiplication result Deselect multiplication applet Multiplication applet deselected Stack up the result msc

Problems

Diablo cannot parse the C++

framework. . .

. . . and it cannot parse libpcsc-lite

16 / 19 Limoges, September 8, 2010

slide-37

SLIDE 37

Outline

1

Introduction

2

Profiling step

3

Translation step

4

Binary Modification

5

Proof Of Concept

6

Conclusion

slide-38

SLIDE 38

Internship conclusion

Objectives accomplished

Can found each executed instruction without source code Modify binary executable with Diablo

To Do list

Realize the translation step Make a complete proof of concept Don’t use Java Card! Obfuscate the APDU request Upgrade Diablo toolchain

17 / 19 Limoges, September 8, 2010

slide-39

SLIDE 39

Personal Conclusion

Personal impact

Discover a private laboratory With a research project

18 / 19 Limoges, September 8, 2010

slide-40

SLIDE 40

The End. . .

Thank you for your attention! Any questions?

19 / 19 Limoges, September 8, 2010