Applications of the Reverse Engineering Language REIL Hackers to - - PowerPoint PPT Presentation

▶
applications of the reverse
SMART_READER_LITE
LIVE PREVIEW

Applications of the Reverse Engineering Language REIL Hackers to - - PowerPoint PPT Presentation

Jun 20, 2023 369 likes •768 views

Applications of the Reverse Engineering Language REIL Hackers to Hackers Conference 2009, So Paulo Sebastian Porst zynamics GmbH (sebastian.porst@zynamics.com) Talk Overview Necessity of new RE methods Solutions we developed

slide-1
SLIDE 1

Applications of the Reverse Engineering Language REIL

Hackers to Hackers Conference 2009, São Paulo Sebastian Porst zynamics GmbH (sebastian.porst@zynamics.com)

slide-2
SLIDE 2

Talk Overview

  • Necessity of new RE methods
  • Solutions we developed
  • Applications of our solutions
slide-3
SLIDE 3

About zynamics

  • Small German company
  • Unhappy with the state of Reverse

Engineering

  • Needed: New RE tools and methods

–BinDiff, BinNavi, VxClass

slide-4
SLIDE 4

About me

  • Lead Developer of BinNavi
  • Many years of RE experience
  • Try to come up with new RE methods
  • Talk about it at conferences
slide-5
SLIDE 5

What we are doing

  • Build Reverse Engineering tools
  • Try to automize binary file analysis
  • Help people find vulnerabilities
slide-6
SLIDE 6

Good old days Now

Software Complexity Architectural Diversity Microsoft Security Budget

Why we are doing this

slide-7
SLIDE 7

How we are doing this

  • Develop new RE methods

–Platform-Independent –Easy to use

  • Integrate them into our tools
slide-8
SLIDE 8

REIL

  • Reverse Engineering Intermediate

Language

  • Platform-Independent
  • Designed for Reverse Engineering
slide-9
SLIDE 9

Design Principles

  • Very small instruction set
  • Very regular operand structure
  • Very simple operand types
  • No side-effects
slide-10
SLIDE 10

Example

slide-11
SLIDE 11

REIL Usage

Convert native code to REIL Run REIL algorithm Port results back to

  • riginal code
slide-12
SLIDE 12

Advantages

  • Easy to pick up and comprehend
  • Reduces analysis complexity
  • Write once; use everywhere
slide-13
SLIDE 13

MonoREIL

  • Monotone framework for REIL
  • Simplifies analysis algorithm

development

  • Read the book
slide-14
SLIDE 14

Advantages

  • All algorithms have the same regular

structure

  • Simplifies algorithms

–Trade-off: Runtime

slide-15
SLIDE 15

Core Concepts

  • Instruction Graph
  • Lattice
  • Monotone Transformations
slide-16
SLIDE 16

Instruction Graph

1400: add t0, 15, t1 1401: bisz t1, , t2 1402: jcc t2, , 1405 1403: str 8, , t3 1405: str 16, , t3 1406: add t3, t3, t4 1407: jcc 1, , 1420 1404: jcc t2, , 1406

slide-17
SLIDE 17

Lattice

B T

slide-18
SLIDE 18

Transformations

1400: add t0, 15, t1 1401: bisz t1, , t2 1402: jcc t2, , 1405 1403: str 8, , t3 1405: str 16, , t3 1406: add t3, t3, t4 1407: jcc 1, , 1420 1404: jcc t2, , 1406

slide-19
SLIDE 19

Applications

Register Tracking: Helps Reverse Engineers follow data flow through code (Never officially presented) Index Underflow Detection: Automatically find negative array accesses (CanSecWest 2009, Vancouver) Automated Deobfuscation: Make obfuscated code more readable (SOURCE Barcelona 2009, Barcelona) ROP Gadget Generator: Automatically generates return-oriented shellcode (Work in progress; scheduled for Q1/2010)

slide-20
SLIDE 20

Register Tracking

  • Follows interesting register values
  • Keeps track of dependent values
  • Transitive closure of the effects of a

register on the program state

slide-21
SLIDE 21

Lattice

Ø eax ebx ecx OF eax ebx eax ecx ebx ecx ecx OF All

slide-22
SLIDE 22

General Idea

  • Start with the tracked register
  • Follow the control flow
  • Instruction uses register → Add

modified registers to the tracked set

  • Instruction clears register → Remove

cleared register from the set

slide-23
SLIDE 23

Example

{t0} add t0, 4, t1 {t0, t1} bisz t2, , CF {t0, t1} bisz t0, , ZF {t0, t1, ZF} add t2, 4, t1 {t0, ZF}

slide-24
SLIDE 24

Result

slide-25
SLIDE 25

Use

  • Fully integrated into BinNavi
  • Makes it very simple to follow values
  • Helps the reverse engineer to

concentrate on what is important

slide-26
SLIDE 26

Range Tracking

  • Tracks potential ranges for register

values

  • Useful to detect buffer underflows

like MS08-67

  • Intervals are used to cut down on

complexity

slide-27
SLIDE 27

Lattice

  • Complicated to show in a picture
  • Keep track of register values and

pointer dereferences as a list of ranges

  • eax [0 .. 4] [0 .. 10]

– Add a value between 0 and 10 to [eax], [eax + 1], [eax + 2], [eax + 3], or [eax + 4]

slide-28
SLIDE 28

General Idea

  • Track register values relative to their

first use

  • Follow the control flow
  • Calculate maximum range of effects

each instruction has on a register

  • If the range gets negative for

memory accesses, mark the location

slide-29
SLIDE 29

Use

  • Helps bug hunters to find potential

vulnerabilities

  • Automated and effective
  • Not yet fully proven to work
slide-30
SLIDE 30

Deobfuscation

  • Convert obfuscated code into

something more readable

  • Multi-process step with many lattices

–Constant propagation –Dead code elimination –...

slide-31
SLIDE 31

General Idea

  • Take a piece of code
  • Apply the deobfuscation algorithms
  • Repeat until no further

deobfuscation is possible

  • Result: Deobfuscated Code
slide-32
SLIDE 32

Result

Before After

slide-33
SLIDE 33

Problems

  • Turns out that deobfuscation is tricky

for many reasons

  • Further requirements:

–Function that determines the readability of code –Backend that produces executable code from REIL

slide-34
SLIDE 34

ROP Gadget Generator

  • Return-oriented shellcode generator
  • REIL-based but not MonoREIL-based
  • Originally for Windows Mobile but

platform-independent

  • To be presented in 2010
slide-35
SLIDE 35

General Idea

  • Automated analysis of instruction

sequences

  • Automated extraction of useful

instruction sequences

  • Combines gadgets to shellcode
  • Helps the development of return-
  • riented shellcode
slide-36
SLIDE 36

Result

slide-37
SLIDE 37

Future Development

  • BinAudit

–Collection of algorithms for vulnerability research

  • Type Reconstruction

–Figuring out what higher level data types are stored in registers

slide-38
SLIDE 38

Related Work

  • ERESI Project
  • BitBlaze
  • Silvio Cesare
slide-39
SLIDE 39

http://www.flickr.com/photos/marcobellucci/3534516458/