Fun with symbolic execution Carl Svensson, 27 MSc in Computer - - PowerPoint PPT Presentation

▶
fun with symbolic execution
SMART_READER_LITE
LIVE PREVIEW

Fun with symbolic execution Carl Svensson, 27 MSc in Computer - - PowerPoint PPT Presentation

Oct 31, 2022 454 likes •699 views

Carl Svensson Exploit development and deobfuscation September 13, 2018 SEC-T 2018 Fun with symbolic execution Carl Svensson, 27 MSc in Computer Science, KTH Head of Security, Kry CTF-player, HackingForSoju 1 About me

slide-1
SLIDE 1

Fun with symbolic execution

Exploit development and deobfuscation

Carl Svensson September 13, 2018

SEC-T 2018

slide-2
SLIDE 2

About me

  • Carl Svensson, 27
  • MSc in Computer Science, KTH
  • Head of Security, Kry
  • CTF-player, HackingForSoju
  •  calle.svensson@zeta-two.com
  •  @zetatwo
  •  https://zeta-two.com

1

slide-3
SLIDE 3

Symbolic execution

  • Symbols vs. concrete values
  • Pro: Explore ”all” paths
  • Con: Exponential complexity

2

slide-4
SLIDE 4

Once again, with fee... angr

  • ”python framework for analyzing binaries”
  • ”both static and dynamic symbolic (concolic)”
  • Computer Security Lab at UC Santa Barbara
  • Uses Z3 internally

3

slide-5
SLIDE 5

Exploitation

  • IP control
  • Satisfy condition

4

slide-6
SLIDE 6

Exploitation with angr

  • Find execution path
  • Constrain execution
  • Satisfy condition

5

slide-7
SLIDE 7

Example from Security Fest CTF

  • Function pointer lookup
  • Index OOB
  • Hook messy function

6

slide-8
SLIDE 8

angr exploitation example

7

slide-9
SLIDE 9

angr exploitation example

8

slide-10
SLIDE 10

angr exploitation example

9

slide-11
SLIDE 11

angr exploitation example

10

slide-12
SLIDE 12

angr exploitation example

> python exploit_angr.py Choice: 2147483648 RDX: fffffffffffffffe > ./bowrain_581bbadaafd23051a25ccb4adc80b670 ... : 2147483648 [1] 17059 segmentation fault (core dumped)

11

slide-13
SLIDE 13

Deobfuscation

Deobfuscation

12

slide-14
SLIDE 14

Obfuscation

  • Make code hard to read
  • for humans
  • for computers
  • Control flow flattening
  • Packer
  • Dropper
  • VM
  • Dead code

13

slide-15
SLIDE 15

Deobfuscation in general

  • Undo the mess
  • Hard problem

14

slide-16
SLIDE 16

Deobfuscation of dead code with angr

  • Prove that dead code is dead
  • Prove uniqueness of value

15

slide-17
SLIDE 17

Example: indirect jmp deobfuscator

16

slide-18
SLIDE 18

Example from mobile app

  • Find ”jmp reg”
  • Search callgraph backwards
  • Search forward
  • Simplify expression
  • Replace code

17

slide-19
SLIDE 19

Example: indirect jmp deobfuscator

18

slide-20
SLIDE 20

Example: indirect jmp deobfuscator

19

slide-21
SLIDE 21

Example: indirect jmp deobfuscator

20

slide-22
SLIDE 22

Example: indirect jmp deobfuscator

21

slide-23
SLIDE 23

Thanks for listening!

21