oriented RE for fun and profit Alexander Matrosov Eugene Rodionov - - PowerPoint PPT Presentation

▶
oriented re for fun and profit
SMART_READER_LITE
LIVE PREVIEW

oriented RE for fun and profit Alexander Matrosov Eugene Rodionov - - PowerPoint PPT Presentation

Mar 22, 2024 112 likes •593 views

HexRaysCodeXplorer: object oriented RE for fun and profit Alexander Matrosov Eugene Rodionov @matrosov @vxradius Agenda C++ Code Reconstruction Problems Show problems on real examples (Flamer) HexRaysCodeXplorer v1.5 [H2HC Edition]

slide-1
SLIDE 1

HexRaysCodeXplorer: object

  • riented RE for fun and profit

Alexander Matrosov @matrosov Eugene Rodionov @vxradius

slide-2
SLIDE 2

 C++ Code Reconstruction Problems  Show problems on real examples (Flamer)  HexRaysCodeXplorer v1.5 [H2HC Edition]

Agenda

slide-3
SLIDE 3

C++ Code Reconstruction Problems

  • Object identification

Type reconstruction

  • Class layout reconstruction

 Identify constructors/destructors  Identify class members  Local/global type reconstruction  Associate object with exact method calls

  • RTTI reconstruction

 Vftable reconstruction  Associate vftable object with exact object  Class hierarchy reconstruction

slide-4
SLIDE 4

C++ Code Reconstruction Problems

Class A vfPtr a1() a2() A::vfTable meta A::a1() A::a2() RTTI Object Locator signature pTypeDescriptor pClassDescriptor

slide-5
SLIDE 5

C++ Code Reconstruction Problems

slide-6
SLIDE 6

REconstructing Flamer Framework

slide-7
SLIDE 7

An overview of the Flamer Framework

Vector<Command Executor> DB_Query ClanCmd Vector<Task> IDLER CmdExec Vector<DelayedTasks> Euphoria Share Supplier Vector<Consumer> Mobile Consumer Cmd Consumer Munch Sniffer FileFinder FileCollect Driller GetConfig LSS Sender Frog Beetlejuice Lua Consumer Media Consumer http://www.welivesecurity.com/2012/08/02/flamer-analysis-framework-reconstruction/

slide-8
SLIDE 8

An overview of the Flamer Framework

Vector<Command Executor> DB_Query ClanCmd Vector<Task> IDLER CmdExec Vector<DelayedTasks> Euphoria Share Supplier Vector<Consumer> Mobile Consumer Cmd Consumer Munch Sniffer FileFinder FileCollect Driller GetConfig LSS Sender Frog Beetlejuice Lua Consumer Media Consumer http://www.welivesecurity.com/2012/08/02/flamer-analysis-framework-reconstruction/

slide-9
SLIDE 9

An overview of the Flamer Framework

Vector<Command Executor> DB_Query ClanCmd Vector<Task> IDLER CmdExec Vector<DelayedTasks> Euphoria Share Supplier Vector<Consumer> Mobile Consumer Cmd Consumer Munch Sniffer FileFinder FileCollect Driller GetConfig LSS Sender Frog Beetlejuice Lua Consumer Media Consumer http://www.welivesecurity.com/2012/08/02/flamer-analysis-framework-reconstruction/

slide-10
SLIDE 10

Identify Smart Pointer Structure

  • Smart pointers
  • Strings
  • Vectors to maintain the objects
  • Custom data types:

 wrappers  tasks,  triggers  and etc.

slide-11
SLIDE 11

Data Types Being Used: Smart pointers

typedef struct SMART_PTR { void *pObject; // pointer to the object int *RefNo; // reference counter };

slide-12
SLIDE 12

Identify Smart Pointer Structure

slide-13
SLIDE 13

Data Types Being Used: Vectors

struct VECTOR { void *vTable; // pointer to the table int NumberOfItems; // self-explanatory int MaxSize; // self-explanatory void *vector; // pointer to buffer with elements };

  • Used to handle the objects:

 tasks  triggers  etc.

slide-14
SLIDE 14

Identify Exact Virtual Function Call in Vtable

slide-15
SLIDE 15

Identify Exact Virtual Function Call in Vtable

slide-16
SLIDE 16

Identify Custom Type Operations

slide-17
SLIDE 17

Data Types Being Used: Strings

struct USTRING_STRUCT { void *vTable; // pointer to the table int RefNo; // reference counter int Initialized; wchar_t *UnicodeBuffer; // pointer to unicode string char *AsciiBuffer; // pointer to ASCII string int AsciiLength; // length of the ASCII string int Reserved; int Length; // Length of unicode string int LengthMax; // Size of UnicodeBuffer };

slide-18
SLIDE 18

Identify Objects Constructors

slide-19
SLIDE 19

Identify Objects Constructors

slide-20
SLIDE 20

REconstructing Object’s Attributes

slide-21
SLIDE 21

REconstructing Object’s Attributes

slide-22
SLIDE 22

REconstructing Object’s Methods

slide-23
SLIDE 23

REconstructing Object’s Methods

slide-24
SLIDE 24

HexRaysCodeXplorer

slide-25
SLIDE 25

HexRaysCodeXplorer v1.0: released in 2013 at REcon

slide-26
SLIDE 26

HexRaysCodeXplorer Features

  • Hex-Rays decompiler plugin
  • The plugin was designed to facilitate static analysis of:

 object oriented code  position independent code

  • The plugin allows to:

 navigate through decompiled virtual methods  partially reconstruct object type

slide-27
SLIDE 27

Hex-Rays Decompiler Plugin SDK

  • At the heart of the decompiler lies ctree structure:

 syntax tree structure  consists of citem_t objects  there are 9 maturity levels of the ctree structure

slide-28
SLIDE 28

Hex-Rays Decompiler Plugin SDK

  • At the heart of the decompiler lies ctree structure:

 syntax tree structure  consists of citem_t objects  there are 9 maturity levels of the ctree structure

slide-29
SLIDE 29

Hex-Rays Decompiler Plugin SDK

  • Type citem_t is a base class for:

 cexpr_t – expression type  cinsn_t – statement type

  • Expressions have attached type information
  • Statements include:

 block, if, for, while, do, switch, return, goto, asm

  • Hex-Rays provides iterators for traversing the citem_t objects within ctree

structure:

 ctree_visitor_t  ctree_parentee_t

citem_t cexpr_t cinsn_t

slide-30
SLIDE 30

Hex-Rays Decompiler Plugin SDK

  • Type citem_t is a base class for:

 cexpr_t – expression type  cinsn_t – statement type

  • Expressions have attached type information
  • Statements include:

 block, if, for, while, do, switch, return, goto, asm

  • Hex-Rays provides iterators for traversing the citem_t objects within ctree

structure:

 ctree_visitor_t  ctree_parentee_t

citem_t cexpr_t cinsn_t

slide-31
SLIDE 31

DEMO time :)

slide-32
SLIDE 32

HexRaysCodeXplorer: Gapz Position Independent Code

slide-33
SLIDE 33

HexRaysCodeXplorer: Virtual Methods

  • The IDA’s ‘Local Types’ is used to represent object type
slide-34
SLIDE 34
  • Hex-Rays decompiler plugin is used to navigate through the virtual

methods

HexRaysCodeXplorer: Virtual Methods

slide-35
SLIDE 35
  • Hex-Rays decompiler plugin is used to navigate through the virtual

methods

HexRaysCodeXplorer: Virtual Methods

slide-36
SLIDE 36

HexRaysCodeXplorer: Object Type REconstruction

  • Hex-Rays’s ctree structure may be used to partially

reconstruct object type based on its initialization routine (constructor)

  • Input:

 pointer to the object instance  object initialization routine entry point

  • Output:

 C structure-like object representation

slide-37
SLIDE 37

HexRaysCodeXplorer: Object Type REconstruction

  • citem_t objects to monitor:

 memptr  idx  memref  call (LOBYTE, etc.)

slide-38
SLIDE 38

HexRaysCodeXplorer: Object Type REconstruction

// reference of DWORD at offset 12 in buffer a1 *(DWORD *)(a1 + 12) = 0xEFCDAB89;

slide-39
SLIDE 39

HexRaysCodeXplorer v1.5 [H2HC Edition]

  • New citem_t objects to monitor:

 memptr  idx  memref  call (LOBYTE, etc.)  ptr, asg, …

slide-40
SLIDE 40

HexRaysCodeXplorer v1.5 [H2HC Edition]

  • New citem_t objects to monitor:

 memptr  idx  memref  call (LOBYTE, etc.)  ptr, asg, …

  • Type propagation for nested function calls
slide-41
SLIDE 41

HexRaysCodeXplorer v1.5 [H2HC Edition]

  • Features of v1.5 [H2HC Edition] :

 Better Type Reconstruction

  • Improvements for parsing citem_t objects with PTR and ASG statements
  • Recursive traversal of Ctree to reconstruct Types hierarchy

 Navigate from Pseudo code window to Disassembly line  Hints for Ctree elements which point to Disassembly line  Support for x64 version of Hex-Rays Decompiler  Some bug fixes by user requests

slide-42
SLIDE 42

DEMO time :)

slide-43
SLIDE 43

HexRaysCodeXplorer:

  • > What are the next goals?
  • Develop the next version on IdaPython
  • Focus on the following features:

 Type reconstruction (C++, Objective-C)  Type Navigation (C++, Objective-C)  Vtables parsing based on Hex-Rays API  Ctree graph navigation improvements  Patterns for possible vuln detection

slide-44
SLIDE 44

Why python?

slide-45
SLIDE 45

Python Arsenal Contest

http://2014.zeronights.org/contests/python-arsenal-contest.html

 Best exploit dev tool/plugin/lib

 Best forensics tool/plugin/lib  Best reversing tool/plugin/lib  Best fuzzing tool/plugin/lib  Best malware analysis tool/plugin/lib

slide-46
SLIDE 46

Thank you for your attention!

HexRaysCodeXplorer

http://REhints.com @REhints https://github.com/REhints/HexRaysCodeXplorer