Dynamic, Metamorphic (and opensource) Virtual Machines A. Desnos - - PowerPoint PPT Presentation

▶
dynamic metamorphic and opensource virtual machines
SMART_READER_LITE
LIVE PREVIEW

Dynamic, Metamorphic (and opensource) Virtual Machines A. Desnos - - PowerPoint PPT Presentation

Sep 13, 2022 444 likes •1.22k views

Introduction Obfuscation Virtual Machines Android/Java appplications Conclusion Dynamic, Metamorphic (and opensource) Virtual Machines A. Desnos ESIEA - Operational Cryptology and Virology Laboratory (CVO) 38 rue des Dr Calmette et Gurin,

slide-1
SLIDE 1

Introduction Obfuscation Virtual Machines Android/Java appplications Conclusion

Dynamic, Metamorphic (and opensource) Virtual Machines

  • A. Desnos

ESIEA - Operational Cryptology and Virology Laboratory (CVO) 38 rue des Dr Calmette et Guérin, 53 000 Laval, France desnos@esiea.fr

Hack.lu 2010

  • A. Desnos

Dynamic, Metamorphic (and opensource) Virtual Machines

slide-2
SLIDE 2

Introduction Obfuscation Virtual Machines Android/Java appplications Conclusion

Current section

1

Introduction

2

Obfuscation

3

Virtual Machines

4

Android/Java appplications

5

Conclusion

  • A. Desnos

Dynamic, Metamorphic (and opensource) Virtual Machines

slide-3
SLIDE 3

Introduction Obfuscation Virtual Machines Android/Java appplications Conclusion

Introduction

New techniques to enable efficient software obfuscation and protection Innovative Reusable Opensource

  • A. Desnos

Dynamic, Metamorphic (and opensource) Virtual Machines

slide-4
SLIDE 4

Introduction Obfuscation Virtual Machines Android/Java appplications Conclusion

Current section

1

Introduction

2

Obfuscation

3

Virtual Machines

4

Android/Java appplications

5

Conclusion

  • A. Desnos

Dynamic, Metamorphic (and opensource) Virtual Machines

slide-5
SLIDE 5

Introduction Obfuscation Virtual Machines Android/Java appplications Conclusion

Obfuscation

Impossible? On the (Im)possibility of Obfuscating Programs, CRYPTO 2001 (B. Barak, O. Goldreich R. Impagliazzo, S. Rudich, A. Sahai, S. Vadhan and K. Yang)

Creating an obfuscator is impossible But you can play with the time and the result

  • A. Desnos

Dynamic, Metamorphic (and opensource) Virtual Machines

slide-6
SLIDE 6

Introduction Obfuscation Virtual Machines Android/Java appplications Conclusion

Obfuscation

T-Obfuscation On the possibility of practically obfuscating programs - Towards a unified perspective of code protection (Philippe Beaucamps, Eric Filiol)

You have to estimate the time (τ) required to break your protection

Window of time

But this mainly relates to malwares or cyber attacks

  • A. Desnos

Dynamic, Metamorphic (and opensource) Virtual Machines

slide-7
SLIDE 7

Introduction Obfuscation Virtual Machines Android/Java appplications Conclusion

Obfuscation

Definition of Obfuscation in our context We are not in a context of cyber attacks, We must try to protect a software against evil guys to steal the apps (or part of them ) and to resell them into the market by basic decompilation, and (un)obfuscation, We must use multiple technics, and not only basic packing.

  • A. Desnos

Dynamic, Metamorphic (and opensource) Virtual Machines

slide-8
SLIDE 8

Introduction Obfuscation Virtual Machines Android/Java appplications Conclusion

Obfuscation

Using Virtual Machines? Actually it is one of the most difficult problems for malware analysts But it is not a full VM like Qemu, Bochs, Vmware VMProtect, Themida use VM Of course, it is just one step for the software protection

  • A. Desnos

Dynamic, Metamorphic (and opensource) Virtual Machines

slide-9
SLIDE 9

Introduction Obfuscation Virtual Machines Android/Java appplications Conclusion

Current section

1

Introduction

2

Obfuscation

3

Virtual Machines

4

Android/Java appplications

5

Conclusion

  • A. Desnos

Dynamic, Metamorphic (and opensource) Virtual Machines

slide-10
SLIDE 10

Introduction Obfuscation Virtual Machines Android/Java appplications Conclusion

Virtual Machines

What’s ? Simple code which interprets another one

Easy to use and modify Dynamic Metamorphic Fast

Steps Take the original instruction code (ASM, Bytecodes ...) Transform it into the desired intermediate language (IL) Build the VM Run it!

  • A. Desnos

Dynamic, Metamorphic (and opensource) Virtual Machines

slide-11
SLIDE 11

Introduction Obfuscation Virtual Machines Android/Java appplications Conclusion

Virtual Machines

What’s ? Simple code which interprets another one

Easy to use and modify Dynamic Metamorphic Fast

Steps Take the original instruction code (ASM, Bytecodes ...) Transform it into the desired intermediate language (IL) Build the VM Run it!

  • A. Desnos

Dynamic, Metamorphic (and opensource) Virtual Machines

slide-12
SLIDE 12

Introduction Obfuscation Virtual Machines Android/Java appplications Conclusion

Virtual Machines

Which IL? Plainty of IL ... But we can use anyone! REIL Zynamics

REIL: A platform-independent intermediate language of disassembled code for static code analysis Thomas Dullien and Sebastian Porst http://www.zynamics.com/downloads/csw09.pdf

  • A. Desnos

Dynamic, Metamorphic (and opensource) Virtual Machines

slide-13
SLIDE 13

Introduction Obfuscation Virtual Machines Android/Java appplications Conclusion

Virtual Machines

Which IL? Plainty of IL ... But we can use anyone! REIL Zynamics

REIL: A platform-independent intermediate language of disassembled code for static code analysis Thomas Dullien and Sebastian Porst http://www.zynamics.com/downloads/csw09.pdf

  • A. Desnos

Dynamic, Metamorphic (and opensource) Virtual Machines

slide-14
SLIDE 14

Introduction Obfuscation Virtual Machines Android/Java appplications Conclusion

Virtual Machines

REIL 17 instructions (ADD, AND, BISZ, BSH, DIV, JCC, LDM, MOD, MUL, NOP, OR, STM, STR, SUB, UNDEF, UNKN, XOR) 3 operands (but some instructions use 0 or 2 operands) Operand can be a:

REIL REGISTER (no limit about the number of registers), REIL INTEGER, REIL OFFSET.

Each operand has a specific size and the third operand is classicaly the output operand

  • A. Desnos

Dynamic, Metamorphic (and opensource) Virtual Machines

slide-15
SLIDE 15

Introduction Obfuscation Virtual Machines Android/Java appplications Conclusion

Virtual Machines

REIL Format INSTR (X, bX), (Y, bY), (Z, bZ) REIL example ADD (t0, b4), (0x90, b4), (t1, b4)

  • A. Desnos

Dynamic, Metamorphic (and opensource) Virtual Machines

slide-16
SLIDE 16

Introduction Obfuscation Virtual Machines Android/Java appplications Conclusion

Virtual Machines

REIL Format INSTR (X, bX), (Y, bY), (Z, bZ) REIL example ADD (t0, b4), (0x90, b4), (t1, b4)

  • A. Desnos

Dynamic, Metamorphic (and opensource) Virtual Machines

slide-17
SLIDE 17

Introduction Obfuscation Virtual Machines Android/Java appplications Conclusion

Virtual Machines

REIL example Assembly instruction : "push ebp"

⇒ SUB (esp, b4, 0, 0), (0x4, b4, 1, 0), (esp, b4, 0, 0) ⇒ STM (ebp, b4, 0, 0), , (esp, b4, 0, 0)

  • A. Desnos

Dynamic, Metamorphic (and opensource) Virtual Machines

slide-18
SLIDE 18

Introduction Obfuscation Virtual Machines Android/Java appplications Conclusion

Virtual Machines

Transformation Each operand :

type size

Types, Sizes, OP_CODE, O1, O2, O3 1320229, 262148, 233, 3049, 0, 49

  • A. Desnos

Dynamic, Metamorphic (and opensource) Virtual Machines

slide-19
SLIDE 19

Introduction Obfuscation Virtual Machines Android/Java appplications Conclusion

Virtual Machines

Dynamic bytecodes At each generation of a VM

the format is different the encoding is different

  • pcodes (instructions + registers) are different
  • A. Desnos

Dynamic, Metamorphic (and opensource) Virtual Machines

slide-20
SLIDE 20

Introduction Obfuscation Virtual Machines Android/Java appplications Conclusion

Virtual Machines

Dynamic functions Implicit by the format and opcodes But it is possible to find "static" patterns

⇒ We must generate more dynamic code for the VM

  • A. Desnos

Dynamic, Metamorphic (and opensource) Virtual Machines

slide-21
SLIDE 21

Introduction Obfuscation Virtual Machines Android/Java appplications Conclusion

Virtual Machines

Dynamic functions Implicit by the format and opcodes But it is possible to find "static" patterns

⇒ We must generate more dynamic code for the VM

  • A. Desnos

Dynamic, Metamorphic (and opensource) Virtual Machines

slide-22
SLIDE 22

Introduction Obfuscation Virtual Machines Android/Java appplications Conclusion

Virtual Machines

Metamorphism Classical metamorphism transformation

On our bytecodes On the original assembly code?

Polymorphism ? It is impossible with classical VM

⇒ But we can provide such features with our bytecodes

  • A. Desnos

Dynamic, Metamorphic (and opensource) Virtual Machines

slide-23
SLIDE 23

Introduction Obfuscation Virtual Machines Android/Java appplications Conclusion

Virtual Machines

Metamorphism Classical metamorphism transformation

On our bytecodes On the original assembly code?

Polymorphism ? It is impossible with classical VM

⇒ But we can provide such features with our bytecodes

  • A. Desnos

Dynamic, Metamorphic (and opensource) Virtual Machines

slide-24
SLIDE 24

Introduction Obfuscation Virtual Machines Android/Java appplications Conclusion

Virtual Machines

Metamorphism Classical metamorphism transformation

On our bytecodes On the original assembly code?

Polymorphism ? It is impossible with classical VM

⇒ But we can provide such features with our bytecodes

  • A. Desnos

Dynamic, Metamorphic (and opensource) Virtual Machines

slide-25
SLIDE 25

Introduction Obfuscation Virtual Machines Android/Java appplications Conclusion

Virtual Machines

Metamorphism Classical metamorphism transformation

On our bytecodes On the original assembly code?

Polymorphism ? It is impossible with classical VM

⇒ But we can provide such features with our bytecodes

  • A. Desnos

Dynamic, Metamorphic (and opensource) Virtual Machines

slide-26
SLIDE 26

Introduction Obfuscation Virtual Machines Android/Java appplications Conclusion

Current section

1

Introduction

2

Obfuscation

3

Virtual Machines

4

Android/Java appplications

5

Conclusion

  • A. Desnos

Dynamic, Metamorphic (and opensource) Virtual Machines

slide-27
SLIDE 27

Introduction Obfuscation Virtual Machines Android/Java appplications Conclusion

Mobiles ?

why ? The number of Mobile Apps is growing quickly But there is no real protection/obfuscation on java bytecodes ie: the android developper blog recommends to use ProGuard

  • A. Desnos

Dynamic, Metamorphic (and opensource) Virtual Machines

slide-28
SLIDE 28

Introduction Obfuscation Virtual Machines Android/Java appplications Conclusion

Mobile Format

Dex/Class ? JVM : .class format (classic java applications) DalvikVM : .dex format (classic android applications) .dex is obtained by the transformation of .class format

  • A. Desnos

Dynamic, Metamorphic (and opensource) Virtual Machines

slide-29
SLIDE 29

Introduction Obfuscation Virtual Machines Android/Java appplications Conclusion

Mobiles Format

JVM stack-based mainly for Java language JIT with HotSpot DalvikVM register-based "an uncompressed .dex file is typically a few percent smaller in size than a compressed .jar (Java Archive) derived from the same .class files" wikipedia since Android 2.2, JIT !

  • A. Desnos

Dynamic, Metamorphic (and opensource) Virtual Machines

slide-30
SLIDE 30

Introduction Obfuscation Virtual Machines Android/Java appplications Conclusion

Mobile Format

Which format? Both are interesting But it is more interesting to work at the level of the .class format

⇒ And we can work between the end of the compilation and

the transformation (easy with Ant)

⇒ So it is not only for mobile devices

  • A. Desnos

Dynamic, Metamorphic (and opensource) Virtual Machines

slide-31
SLIDE 31

Introduction Obfuscation Virtual Machines Android/Java appplications Conclusion

Mobile Format

Which format? Both are interesting But it is more interesting to work at the level of the .class format

⇒ And we can work between the end of the compilation and

the transformation (easy with Ant)

⇒ So it is not only for mobile devices

  • A. Desnos

Dynamic, Metamorphic (and opensource) Virtual Machines

slide-32
SLIDE 32

Introduction Obfuscation Virtual Machines Android/Java appplications Conclusion

Mobile Format

Which format? Both are interesting But it is more interesting to work at the level of the .class format

⇒ And we can work between the end of the compilation and

the transformation (easy with Ant)

⇒ So it is not only for mobile devices

  • A. Desnos

Dynamic, Metamorphic (and opensource) Virtual Machines

slide-33
SLIDE 33

Introduction Obfuscation Virtual Machines Android/Java appplications Conclusion

Mobile Format

JVM Format Header (magic, minor_version, major_version, constant_pool_count, constant_pool, access_flags, this_class, super_class, interfaces_count, interfaces, fields_count, fields, methods_count, methods, attributes_count)

  • A. Desnos

Dynamic, Metamorphic (and opensource) Virtual Machines

slide-34
SLIDE 34

Introduction Obfuscation Virtual Machines Android/Java appplications Conclusion

Mobile Format

JVM Format - Constant Pool Description of classes, fields, methods, interfaces, strings, integers, floats .... Methodref_info(tag=10, class_index=33, name_and_type_index=51) – Class_info(tag=7, name_index=75) — Utf8_info(tag=1, length=16) Utf8_next(bytes=’java/lang/Object’) – NameAndType_info(tag=12, name_index=40, descriptor_index=41) — Utf8_info(tag=1, length=6) Utf8_next(bytes=’<init>’) — Utf8_info(tag=1, length=3) Utf8_next(bytes=’()V’)

  • A. Desnos

Dynamic, Metamorphic (and opensource) Virtual Machines

slide-35
SLIDE 35

Introduction Obfuscation Virtual Machines Android/Java appplications Conclusion

Mobile Format

JVM Format - Constant Pool Description of classes, fields, methods, interfaces, strings, integers, floats .... Methodref_info(tag=10, class_index=33, name_and_type_index=51) – Class_info(tag=7, name_index=75) — Utf8_info(tag=1, length=16) Utf8_next(bytes=’java/lang/Object’) – NameAndType_info(tag=12, name_index=40, descriptor_index=41) — Utf8_info(tag=1, length=6) Utf8_next(bytes=’<init>’) — Utf8_info(tag=1, length=3) Utf8_next(bytes=’()V’)

  • A. Desnos

Dynamic, Metamorphic (and opensource) Virtual Machines

slide-36
SLIDE 36

Introduction Obfuscation Virtual Machines Android/Java appplications Conclusion

Mobile Format

JVM Format - Constant Pool Description of classes, fields, methods, interfaces, strings, integers, floats .... Methodref_info(tag=10, class_index=33, name_and_type_index=51) – Class_info(tag=7, name_index=75) — Utf8_info(tag=1, length=16) Utf8_next(bytes=’java/lang/Object’) – NameAndType_info(tag=12, name_index=40, descriptor_index=41) — Utf8_info(tag=1, length=6) Utf8_next(bytes=’<init>’) — Utf8_info(tag=1, length=3) Utf8_next(bytes=’()V’)

  • A. Desnos

Dynamic, Metamorphic (and opensource) Virtual Machines

slide-37
SLIDE 37

Introduction Obfuscation Virtual Machines Android/Java appplications Conclusion

Mobile Format

JVM Format - Constant Pool Description of classes, fields, methods, interfaces, strings, integers, floats .... Methodref_info(tag=10, class_index=33, name_and_type_index=51) – Class_info(tag=7, name_index=75) — Utf8_info(tag=1, length=16) Utf8_next(bytes=’java/lang/Object’) – NameAndType_info(tag=12, name_index=40, descriptor_index=41) — Utf8_info(tag=1, length=6) Utf8_next(bytes=’<init>’) — Utf8_info(tag=1, length=3) Utf8_next(bytes=’()V’)

  • A. Desnos

Dynamic, Metamorphic (and opensource) Virtual Machines

slide-38
SLIDE 38

Introduction Obfuscation Virtual Machines Android/Java appplications Conclusion

Mobiles Format

JVM Format - Constant Pool Description of classes, fields, methods, interfaces, strings, integers, floats .... String_info(tag=8, string_index=59) – Utf8_info(tag=1, length=4) – Utf8_next(bytes=’IDX ’)

  • A. Desnos

Dynamic, Metamorphic (and opensource) Virtual Machines

slide-39
SLIDE 39

Introduction Obfuscation Virtual Machines Android/Java appplications Conclusion

Mobiles Format

JVM Format - Constant Pool Description of classes, fields, methods, interfaces, strings, integers, floats .... String_info(tag=8, string_index=59) – Utf8_info(tag=1, length=4) – Utf8_next(bytes=’IDX ’)

  • A. Desnos

Dynamic, Metamorphic (and opensource) Virtual Machines

slide-40
SLIDE 40

Introduction Obfuscation Virtual Machines Android/Java appplications Conclusion

Mobiles Format

JVM Format - Constant Pool Description of classes, fields, methods, interfaces, strings, integers, floats .... String_info(tag=8, string_index=59) – Utf8_info(tag=1, length=4) – Utf8_next(bytes=’IDX ’)

  • A. Desnos

Dynamic, Metamorphic (and opensource) Virtual Machines

slide-41
SLIDE 41

Introduction Obfuscation Virtual Machines Android/Java appplications Conclusion

Mobile Format

JVM Format - Field/Method Pool Described precisely a field/method MethodInfo(access_flags=0, name_index=40, descriptor_index=41, attributes_count=1) <init> ()V AttributeInfo(attribute_name_index=42, attribute_length=29) Code LOW(max_stack=1, max_locals=1, code_length=5) 0 0 aload_0 1 1 invokespecial [’java/lang/Object’, ’<init>’, ’()V’] 2 4 return

  • A. Desnos

Dynamic, Metamorphic (and opensource) Virtual Machines

slide-42
SLIDE 42

Introduction Obfuscation Virtual Machines Android/Java appplications Conclusion

Mobile Format

JVM Format - Field/Method Pool Described precisely a field/method MethodInfo(access_flags=0, name_index=40, descriptor_index=41, attributes_count=1) <init> ()V AttributeInfo(attribute_name_index=42, attribute_length=29) Code LOW(max_stack=1, max_locals=1, code_length=5) 0 0 aload_0 1 1 invokespecial [’java/lang/Object’, ’<init>’, ’()V’] 2 4 return

  • A. Desnos

Dynamic, Metamorphic (and opensource) Virtual Machines

slide-43
SLIDE 43

Introduction Obfuscation Virtual Machines Android/Java appplications Conclusion

Mobile Format

JVM Format - Field/Method Pool Described precisely a field/method MethodInfo(access_flags=0, name_index=40, descriptor_index=41, attributes_count=1) <init> ()V AttributeInfo(attribute_name_index=42, attribute_length=29) Code LOW(max_stack=1, max_locals=1, code_length=5) 0 0 aload_0 1 1 invokespecial [’java/lang/Object’, ’<init>’, ’()V’] 2 4 return

  • A. Desnos

Dynamic, Metamorphic (and opensource) Virtual Machines

slide-44
SLIDE 44

Introduction Obfuscation Virtual Machines Android/Java appplications Conclusion

Mobile Format

JVM Format - Field/Method Pool Described precisely a field/method MethodInfo(access_flags=0, name_index=40, descriptor_index=41, attributes_count=1) <init> ()V AttributeInfo(attribute_name_index=42, attribute_length=29) Code LOW(max_stack=1, max_locals=1, code_length=5) 0 0 aload_0 1 1 invokespecial [’java/lang/Object’, ’<init>’, ’()V’] 2 4 return

  • A. Desnos

Dynamic, Metamorphic (and opensource) Virtual Machines

slide-45
SLIDE 45

Introduction Obfuscation Virtual Machines Android/Java appplications Conclusion

Modify .class format

Add and remove string Insert a new CONSTANT_Utf8 into the Constant Pool

(’>BH’, namedtuple( "CONSTANT_Utf8_info", "tag length" ) + bytes

Modify the name of a field or a method FieldInfo or MethodInfo

Change bytes into CONSTANT_Utf8 at name_index

  • A. Desnos

Dynamic, Metamorphic (and opensource) Virtual Machines

slide-46
SLIDE 46

Introduction Obfuscation Virtual Machines Android/Java appplications Conclusion

Modify .class format

Add and remove string Insert a new CONSTANT_Utf8 into the Constant Pool

(’>BH’, namedtuple( "CONSTANT_Utf8_info", "tag length" ) + bytes

Modify the name of a field or a method FieldInfo or MethodInfo

Change bytes into CONSTANT_Utf8 at name_index

  • A. Desnos

Dynamic, Metamorphic (and opensource) Virtual Machines

slide-47
SLIDE 47

Introduction Obfuscation Virtual Machines Android/Java appplications Conclusion

Modify .class format

Add/Remove instructions into MethodInfo Insert new instructions into a human readable format Apply relocations on specific instructions (goto*, if*, jsr*) Modify code_length in CodeAttribute and attribute_length in AttributeInfo Example j = jvm.JVMFormat( open(TEST).read() ) code = j.get_method("test")[0].get_code()

⇒ code.insert_at( 13, [ "aload_0" ] ) ⇒ code.insert_at( 14, [ "invokevirtual", "toto", "(I)I" ] )

  • A. Desnos

Dynamic, Metamorphic (and opensource) Virtual Machines

slide-48
SLIDE 48

Introduction Obfuscation Virtual Machines Android/Java appplications Conclusion

Modify .class format

Add/Remove instructions into MethodInfo Insert new instructions into a human readable format Apply relocations on specific instructions (goto*, if*, jsr*) Modify code_length in CodeAttribute and attribute_length in AttributeInfo Example j = jvm.JVMFormat( open(TEST).read() ) code = j.get_method("test")[0].get_code()

⇒ code.insert_at( 13, [ "aload_0" ] ) ⇒ code.insert_at( 14, [ "invokevirtual", "toto", "(I)I" ] )

  • A. Desnos

Dynamic, Metamorphic (and opensource) Virtual Machines

slide-49
SLIDE 49

Introduction Obfuscation Virtual Machines Android/Java appplications Conclusion

Modify .class format

Insert new "craft" method Create new objects :

MethodInfo (information + code) MethodRef (class + name_type) + NameAndType (name + type)

Add MethodInfo into the Method Pool Example j = jvm.JVMFormat( open(TEST).read() ) j.insert_craft_method( "toto", [ "ACC_PUBLIC", "[B", "[B" ], [ [ "aconst_null" ], [ "areturn" ] ] )

  • A. Desnos

Dynamic, Metamorphic (and opensource) Virtual Machines

slide-50
SLIDE 50

Introduction Obfuscation Virtual Machines Android/Java appplications Conclusion

Modify .class format

Insert new "craft" method Create new objects :

MethodInfo (information + code) MethodRef (class + name_type) + NameAndType (name + type)

Add MethodInfo into the Method Pool Example j = jvm.JVMFormat( open(TEST).read() ) j.insert_craft_method( "toto", [ "ACC_PUBLIC", "[B", "[B" ], [ [ "aconst_null" ], [ "areturn" ] ] )

  • A. Desnos

Dynamic, Metamorphic (and opensource) Virtual Machines

slide-51
SLIDE 51

Introduction Obfuscation Virtual Machines Android/Java appplications Conclusion

Modify .class format

Insert new "craft" method Create new objects :

MethodInfo (information + code) MethodRef (class + name_type) + NameAndType (name + type)

Add MethodInfo into the Method Pool But ...

⇒ Interesting but it’s very difficult to insert advanced

instructions

  • A. Desnos

Dynamic, Metamorphic (and opensource) Virtual Machines

slide-52
SLIDE 52

Introduction Obfuscation Virtual Machines Android/Java appplications Conclusion

Modify .class format

Insert the new method from another .class file Same as craft method Fix attributes Patch invokes*, ldc*, anewarray, getstatic, new, ... Example j = jvm.JVMFormat( open(TEST).read() ) j2 = jvm.JVMFormat( open(TEST_REF).read() )

⇒ j.insert_direct_method( "toto2",

j2.get_method("test3")[0] )

  • A. Desnos

Dynamic, Metamorphic (and opensource) Virtual Machines

slide-53
SLIDE 53

Introduction Obfuscation Virtual Machines Android/Java appplications Conclusion

Modify .class format

Insert the new method from another .class file Same as craft method Fix attributes Patch invokes*, ldc*, anewarray, getstatic, new, ... Example j = jvm.JVMFormat( open(TEST).read() ) j2 = jvm.JVMFormat( open(TEST_REF).read() )

⇒ j.insert_direct_method( "toto2",

j2.get_method("test3")[0] )

  • A. Desnos

Dynamic, Metamorphic (and opensource) Virtual Machines

slide-54
SLIDE 54

Introduction Obfuscation Virtual Machines Android/Java appplications Conclusion

Modify .class format

Insert the new method from another .class file Same as craft method Fix attributes Patch invokes*, ldc*, anewarray, getstatic, new, ... Example j = jvm.JVMFormat( open(TEST).read() ) j2 = jvm.JVMFormat( open(TEST_REF).read() )

⇒ j.insert_direct_method( "toto2",

j2.get_method("test3")[0] )

  • A. Desnos

Dynamic, Metamorphic (and opensource) Virtual Machines

slide-55
SLIDE 55

Introduction Obfuscation Virtual Machines Android/Java appplications Conclusion

Transform simple integers into VM

Transformation Get manipulation of basic constant integers, like :

bipush 0x10

⇒ Create the VM

  • A. Desnos

Dynamic, Metamorphic (and opensource) Virtual Machines

slide-56
SLIDE 56

Introduction Obfuscation Virtual Machines Android/Java appplications Conclusion

Transform simple integers into VM

Transformation Get manipulation of basic constant integers, like :

bipush 0x10

⇒ Create the VM

  • A. Desnos

Dynamic, Metamorphic (and opensource) Virtual Machines

slide-57
SLIDE 57

Introduction Obfuscation Virtual Machines Android/Java appplications Conclusion

Transform simple integers into VM

Mathematical formulas Transform a simple integer into a reversible mathematical formula X0 = 16 ; X1 = X0 - l1 ; X2 = X1 + l2 ; X3 = l3 - X2 X3 = l4 ; X2 = l3 + X3 ; X1 = X2 - l2 ; X0 = X1 + l1 PRNG : Linear congruential generator X0 = 16; ’A’: 1, ’GERME’: 0, ’C’: 5, ’M’: 29, ’ITER’: 9 GERME = (A * GERME + C) % M 5 10 15 20 25 1 6 11 16 : X0 ... Use of SAT formulas ?

  • A. Desnos

Dynamic, Metamorphic (and opensource) Virtual Machines

slide-58
SLIDE 58

Introduction Obfuscation Virtual Machines Android/Java appplications Conclusion

Transform simple integers into VM

Mathematical formulas Transform a simple integer into a reversible mathematical formula X0 = 16 ; X1 = X0 - l1 ; X2 = X1 + l2 ; X3 = l3 - X2 X3 = l4 ; X2 = l3 + X3 ; X1 = X2 - l2 ; X0 = X1 + l1 PRNG : Linear congruential generator X0 = 16; ’A’: 1, ’GERME’: 0, ’C’: 5, ’M’: 29, ’ITER’: 9 GERME = (A * GERME + C) % M 5 10 15 20 25 1 6 11 16 : X0 ... Use of SAT formulas ?

  • A. Desnos

Dynamic, Metamorphic (and opensource) Virtual Machines

slide-59
SLIDE 59

Introduction Obfuscation Virtual Machines Android/Java appplications Conclusion

Transform simple integers into VM

Mathematical formulas Transform a simple integer into a reversible mathematical formula X0 = 16 ; X1 = X0 - l1 ; X2 = X1 + l2 ; X3 = l3 - X2 X3 = l4 ; X2 = l3 + X3 ; X1 = X2 - l2 ; X0 = X1 + l1 PRNG : Linear congruential generator X0 = 16; ’A’: 1, ’GERME’: 0, ’C’: 5, ’M’: 29, ’ITER’: 9 GERME = (A * GERME + C) % M 5 10 15 20 25 1 6 11 16 : X0 ... Use of SAT formulas ?

  • A. Desnos

Dynamic, Metamorphic (and opensource) Virtual Machines

slide-60
SLIDE 60

Introduction Obfuscation Virtual Machines Android/Java appplications Conclusion

Transform simple integers into VM

Mathematical formulas Transform a simple integer into a reversible mathematical formula X0 = 16 ; X1 = X0 - l1 ; X2 = X1 + l2 ; X3 = l3 - X2 X3 = l4 ; X2 = l3 + X3 ; X1 = X2 - l2 ; X0 = X1 + l1 PRNG : Linear congruential generator X0 = 16; ’A’: 1, ’GERME’: 0, ’C’: 5, ’M’: 29, ’ITER’: 9 GERME = (A * GERME + C) % M 5 10 15 20 25 1 6 11 16 : X0 ... Use of SAT formulas ?

  • A. Desnos

Dynamic, Metamorphic (and opensource) Virtual Machines

slide-61
SLIDE 61

Introduction Obfuscation Virtual Machines Android/Java appplications Conclusion

Transform simple integers into VM

Mathematical formulas Transform a simple integer into a reversible mathematical formula X0 = 16 ; X1 = X0 - l1 ; X2 = X1 + l2 ; X3 = l3 - X2 X3 = l4 ; X2 = l3 + X3 ; X1 = X2 - l2 ; X0 = X1 + l1 PRNG : Linear congruential generator X0 = 16; ’A’: 1, ’GERME’: 0, ’C’: 5, ’M’: 29, ’ITER’: 9 GERME = (A * GERME + C) % M 5 10 15 20 25 1 6 11 16 : X0 ... Use of SAT formulas ?

  • A. Desnos

Dynamic, Metamorphic (and opensource) Virtual Machines

slide-62
SLIDE 62

Introduction Obfuscation Virtual Machines Android/Java appplications Conclusion

Transform simple integers into VM

Transformation Transform the previous operation into REIL STR( l4, , x3) ADD( l3, X3, X2 ) SUB( X2, l2, X1 ) ADD( X1, l1, X0 ) Apply metamorphism/polymorphism transformations Apply CFG obfuscation Return a specific register (X0) to have the result + specific parameters values

  • A. Desnos

Dynamic, Metamorphic (and opensource) Virtual Machines

slide-63
SLIDE 63

Introduction Obfuscation Virtual Machines Android/Java appplications Conclusion

Transform simple integers into VM

Transformation Transform the previous operation into REIL STR( l4, , x3) ADD( l3, X3, X2 ) SUB( X2, l2, X1 ) ADD( X1, l1, X0 ) Apply metamorphism/polymorphism transformations Apply CFG obfuscation Return a specific register (X0) to have the result + specific parameters values

  • A. Desnos

Dynamic, Metamorphic (and opensource) Virtual Machines

slide-64
SLIDE 64

Introduction Obfuscation Virtual Machines Android/Java appplications Conclusion

Transform simple integers into VM

Transformation Transform the previous operation into REIL STR( l4, , x3) ADD( l3, X3, X2 ) SUB( X2, l2, X1 ) ADD( X1, l1, X0 ) Apply metamorphism/polymorphism transformations Apply CFG obfuscation Return a specific register (X0) to have the result + specific parameters values

  • A. Desnos

Dynamic, Metamorphic (and opensource) Virtual Machines

slide-65
SLIDE 65

Introduction Obfuscation Virtual Machines Android/Java appplications Conclusion

Transform simple integers into VM

Transformation Transform the previous operation into REIL STR( l4, , x3) ADD( l3, X3, X2 ) SUB( X2, l2, X1 ) ADD( X1, l1, X0 ) Apply metamorphism/polymorphism transformations Apply CFG obfuscation Return a specific register (X0) to have the result + specific parameters values

  • A. Desnos

Dynamic, Metamorphic (and opensource) Virtual Machines

slide-66
SLIDE 66

Introduction Obfuscation Virtual Machines Android/Java appplications Conclusion

Transform simple integers into VM

Transformation Transform the previous operation into REIL STR( l4, , x3) ADD( l3, X3, X2 ) SUB( X2, l2, X1 ) ADD( X1, l1, X0 ) Apply metamorphism/polymorphism transformations Apply CFG obfuscation Return a specific register (X0) to have the result + specific parameters values

  • A. Desnos

Dynamic, Metamorphic (and opensource) Virtual Machines

slide-67
SLIDE 67

Introduction Obfuscation Virtual Machines Android/Java appplications Conclusion

Transform simple integers into VM

Transformation Transform the REIL bytecodes into JAVA :

Format Registers Instructions

Transform each REIL instructions into JAVA Simple loop which interprets each bytecode

  • A. Desnos

Dynamic, Metamorphic (and opensource) Virtual Machines

slide-68
SLIDE 68

Introduction Obfuscation Virtual Machines Android/Java appplications Conclusion

Transform simple integers into VM

Transformation Transform the REIL bytecodes into JAVA :

Format Registers Instructions

Transform each REIL instructions into JAVA Simple loop which interprets each bytecode

  • A. Desnos

Dynamic, Metamorphic (and opensource) Virtual Machines

slide-69
SLIDE 69

Introduction Obfuscation Virtual Machines Android/Java appplications Conclusion

Transform simple integers into VM

Transformation Transform the REIL bytecodes into JAVA :

Format Registers Instructions

Transform each REIL instructions into JAVA Simple loop which interprets each bytecode

  • A. Desnos

Dynamic, Metamorphic (and opensource) Virtual Machines

slide-70
SLIDE 70

Introduction Obfuscation Virtual Machines Android/Java appplications Conclusion

Insertion of the VM

Insertion Replace the original instructions with a simple call : ⇒ [ "aload_0" ] + [ "invokevirtual", "Test1", "vm", descriptor ] Insert the new method Save the new file

  • A. Desnos

Dynamic, Metamorphic (and opensource) Virtual Machines

slide-71
SLIDE 71

Introduction Obfuscation Virtual Machines Android/Java appplications Conclusion

Current section

1

Introduction

2

Obfuscation

3

Virtual Machines

4

Android/Java appplications

5

Conclusion

  • A. Desnos

Dynamic, Metamorphic (and opensource) Virtual Machines

slide-72
SLIDE 72

Introduction Obfuscation Virtual Machines Android/Java appplications Conclusion

Conclusion

The end ... Framework + tools + demos available at http://code.google.com/p/androguard/ Full python code It’s mainly focus on software protection, but you can do

  • ther things ...

JVM/DalvikVM format access Modification ... ... Save !

! Thanks to Hack.lu 2010 Questions?

  • A. Desnos

Dynamic, Metamorphic (and opensource) Virtual Machines

slide-73
SLIDE 73

Introduction Obfuscation Virtual Machines Android/Java appplications Conclusion

Conclusion

The end ... Framework + tools + demos available at http://code.google.com/p/androguard/ Full python code It’s mainly focus on software protection, but you can do

  • ther things ...

JVM/DalvikVM format access Modification ... ... Save !

! Thanks to Hack.lu 2010 Questions?

  • A. Desnos

Dynamic, Metamorphic (and opensource) Virtual Machines

slide-74
SLIDE 74

Introduction Obfuscation Virtual Machines Android/Java appplications Conclusion

Conclusion

The end ... Framework + tools + demos available at http://code.google.com/p/androguard/ Full python code It’s mainly focus on software protection, but you can do

  • ther things ...

JVM/DalvikVM format access Modification ... ... Save !

! Thanks to Hack.lu 2010 Questions?

  • A. Desnos

Dynamic, Metamorphic (and opensource) Virtual Machines

slide-75
SLIDE 75

Introduction Obfuscation Virtual Machines Android/Java appplications Conclusion

Conclusion

The end ... Framework + tools + demos available at http://code.google.com/p/androguard/ Full python code It’s mainly focus on software protection, but you can do

  • ther things ...

JVM/DalvikVM format access Modification ... ... Save !

! Thanks to Hack.lu 2010 Questions?

  • A. Desnos

Dynamic, Metamorphic (and opensource) Virtual Machines