Qualitative and Quantitative Evaluation of Software Packers Mar a - PowerPoint PPT Presentation

Qualitative and Quantitative Evaluation of Software Packers Mar´ ıa Baz´ ıguez , Jos´ us, Ricardo J. Rodr´ e Merseguer � All wrongs reversed rjrodriguez@unizar.es ※ @RicardoJRdez ※ www.ricardojrodriguez.es Department of Computer Science and Systems Engineering University of Zaragoza, Spain December 12, 2015 NoConName 2015 Barcelona (Spain)

$ whoami Ph.D. on Comp. Sci. (Univ. of Zaragoza, Spain) (2013) Assistant Professor at University of Zaragoza Performance analysis on critical, complex systems Secure Software Engineering Advance malware analysis RFID/NFC Security Not prosecuted ¨ ⌣ Speaker at NcN, HackLU, RootedCON, STIC CCN-CERT, HIP , MalCON, HITB. . . M. Baz´ us, R.J. Rodr´ ıguez, J. Merseguer Qualitative and Quantitative Evaluation of Software Packers NcN 2015 2 / 39

Agenda Introduction 1 Contributions and Related Work 2 Previous Concepts 3 Software Protection Taxonomy 4 Software Packers Under Study 5 Qualitative and Quantitative Evaluation 6 Qualitative Evaluation Quantitative Evaluation Conclusions and Future Work 7 M. Baz´ us, R.J. Rodr´ ıguez, J. Merseguer Qualitative and Quantitative Evaluation of Software Packers NcN 2015 3 / 39

Introduction (I): Reverse Engineering WTF? To analyse a binary program with machine-code vision Types of analysis: Static analysis ( ⇓ not executed, ⇑ all paths explored) Dynamic analysis ( ⇑ truly executed, ⇓ but just one path explored!) M. Baz´ us, R.J. Rodr´ ıguez, J. Merseguer Qualitative and Quantitative Evaluation of Software Packers NcN 2015 5 / 39

Introduction (I): Reverse Engineering WTF? To analyse a binary program with machine-code vision Types of analysis: Static analysis ( ⇓ not executed, ⇑ all paths explored) Dynamic analysis ( ⇑ truly executed, ⇓ but just one path explored!) RE uses: legitimate and illegitimate � Find software bugs � Get interoperability with legacy systems � Detect malicious software X Detect vulnerabilities to create/spread malware X Obtain (or avoid) software license duplication M. Baz´ us, R.J. Rodr´ ıguez, J. Merseguer Qualitative and Quantitative Evaluation of Software Packers NcN 2015 5 / 39

Introduction (II): RE Tools Dynamic analysis Debuggers Static analysis Trace execution Disassemblers Breakpoints Decompilers View internal data Dumpers M. Baz´ us, R.J. Rodr´ ıguez, J. Merseguer Qualitative and Quantitative Evaluation of Software Packers NcN 2015 6 / 39

Introduction (III): Anti-RE Techniques Definition, pros and cons of software packers Avoidance techniques for static and dynamic analysis into binaries Make RE tasks harder On the contrary, they have a strong impact on binary performance: execution time, memory consumption M. Baz´ us, R.J. Rodr´ ıguez, J. Merseguer Qualitative and Quantitative Evaluation of Software Packers NcN 2015 7 / 39

Introduction (III): Anti-RE Techniques Definition, pros and cons of software packers Avoidance techniques for static and dynamic analysis into binaries Make RE tasks harder On the contrary, they have a strong impact on binary performance: execution time, memory consumption They are used for. . . Binary protection before distribution (to keep the intellectual (?) property) Avoid a malware to be positively detected as malicious by an anti-virus M. Baz´ us, R.J. Rodr´ ıguez, J. Merseguer Qualitative and Quantitative Evaluation of Software Packers NcN 2015 7 / 39

Introduction (IV): Software Packers Software packer: What is it? Tools for binary protection (legitimately) Once upon a time. . . : just compressors They evolve to protectors, including anti-RE techniques Normally used in Windows environments M. Baz´ us, R.J. Rodr´ ıguez, J. Merseguer Qualitative and Quantitative Evaluation of Software Packers NcN 2015 8 / 39

Introduction (V): Software Packers How do they “protect” a binary? Packed executable = Original executable + unpacking routine Ejecutable Original Ejecutable Empacado Rutina desempacado Protector + (Rutina empacado) Ejecutable Original M. Baz´ us, R.J. Rodr´ ıguez, J. Merseguer Qualitative and Quantitative Evaluation of Software Packers NcN 2015 9 / 39

Introduction (V): Software Packers How do they “protect” a binary? Packed executable = Original executable + unpacking routine Ejecutable Original Ejecutable Empacado Rutina desempacado Protector + (Rutina empacado) Ejecutable Original How are they reversed? Find unpacking routine end ⇒ dump binary from memory to disk! M. Baz´ us, R.J. Rodr´ ıguez, J. Merseguer Qualitative and Quantitative Evaluation of Software Packers NcN 2015 9 / 39

Introduction (VI): Main Goals Analysing a bunch of software packers for. . . Create a taxonomy of protection techniques Create a benchmark for testing Evaluate the selected packers: Qualitatively: protection strength Quantitatively: reliability and performance M. Baz´ us, R.J. Rodr´ ıguez, J. Merseguer Qualitative and Quantitative Evaluation of Software Packers NcN 2015 10 / 39

Related Work ∄ comparative analysis of current software packers Automation of malware unpacking ([RHD + 06], [KPY07], [MCJ07],[GFC08], [JCL + 10]) Using DBI to analyse malware ([RAG16]) Closest work: performance of software packers in Linux embedded systems ([KLC + 10]) Contributions Taxonomy of software packers Current software packers evaluation Qualitatively: protection strengths Quantitatively: reliability and performance (exec. time, memory consumption, binary size) M. Baz´ us, R.J. Rodr´ ıguez, J. Merseguer Qualitative and Quantitative Evaluation of Software Packers NcN 2015 12 / 39

Previous Concepts (I): PE Header What is it? Windows standard format for binaries (.exe, .dll, .sys, . . . ) Header (characteristics) + Sections (data & code) Cabecera DOS MZ Cabecera PE DOS Header: Tabla de secciones e lfnew offset to PE Header Secciones PE Header: Sección 1 ImageBase … AddressOfEntryPoint DataDirectory[1] Sección n M. Baz´ us, R.J. Rodr´ ıguez, J. Merseguer Qualitative and Quantitative Evaluation of Software Packers NcN 2015 14 / 39

Previous Concepts (II): Loading Process En9Memoria Cabecera9DOS9MZ Cabecera9PE Tabla9de9secciones Secciones En9Disco Sección91 RUTINA9DESEMPACADO Cabecera9DOS9MZ … Cabecera9PE Tabla9de9secciones Sección9 n Secciones Cabecera9DOS9MZ Cabecera9PE Sección91 Tabla9de9secciones RUTINA9DESEMPACADO … Secciones Sección9 n AOABA8B9A4A3E857016B00CF19A50B Sección91 ……. … 57016B00CF19A50BAOABA8B9A4A3A0 Sección9 n M. Baz´ us, R.J. Rodr´ ıguez, J. Merseguer Qualitative and Quantitative Evaluation of Software Packers NcN 2015 15 / 39

Previous Concepts (III): Import Address Table IMAGE_OPTIONAL_HEADER IMAGE_OPTIONAL_HEADER En Memoria … (Sobreescrito por el DataDirectory [1 ] Windows Loader) IMAGE_THUNK_DATA IMAGE_THUNK_DATA IMAGE_THUNK_DATA IMAGE_THUNK_DATA IMAGE_IMPORT_DESCRIPTOR_0 … En Disco (ntdll.dll) 000..000 000…000 IMAGE_IMPORT_DESCRIPTOR _1 OriginalFirstThunk ReadFile TimeDateStamp WriteFile ForwardedChain Name Kernel32.dll FirstThunk … 77E55A68 IMAGE_IMPORT_DESCRIPTOR_n 77E52B38 0 … 0 M. Baz´ us, R.J. Rodr´ ıguez, J. Merseguer Qualitative and Quantitative Evaluation of Software Packers NcN 2015 16 / 39

Software Protection (I): Static Analysis Copy protection Main aim: Avoid to illegitimately copy a software Techniques: License management, register keys, hardware dongles M. Baz´ us, R.J. Rodr´ ıguez, J. Merseguer Qualitative and Quantitative Evaluation of Software Packers NcN 2015 18 / 39

Qualitative and Quantitative Evaluation of Software Packers Mar a - PowerPoint PPT Presentation

Qualitative and Quantitative Evaluation of Software Packers Mar a Baz guez , Jos us, Ricardo J. Rodr e Merseguer All wrongs reversed rjrodriguez@unizar.es @RicardoJRdez www.ricardojrodriguez.es Department of Computer

Impact Evaluation of Takaful and Karama I. Quantitative Component II. Qualitative Component

T-76.613 Software testing Analyzing Quantitative Data Mika Mntyl <mika.mantyla@hut.fi>

From Qualitative to Quantitative Theories of Software Tom Henzinger IST Austria Qualitative

Heuristic Evaluation (Pinelle) Heuristic evaluation is a method of qualitative evaluation of

From Qualitative to Quantitative Program Analysis: Permissive Enforcement of Secure Information

Understanding Impact The role of qualitative methods of evaluation Aims of the workshop To

Keywords: Fig, qualitative and quantitative characteristic, diversity, productivity . Time of

Localism Qualitative and Quantitative Research February 2019 1 Localism Qualitative and

What do we mean by scalability? Qualitative: Will this software work well for substantially

Benefits and Challenges of Analyzing Qualitative Data Sheelagh Carpendale empirical research

From Qualitative to Quantitative Dominance Pruning for Optimal Planning Alvaro Torralba

Quantitative Analysis J. Scott Hawker/R. Kuehl p. 1 R I T Software Engineering Tactics and

Application of geospatial methods and remote sensing and for evaluation Blending quantitative

Qt Ql New People to New Groups S. Gladen licenced under CC BY 2.0 2 Dr. Pat Bazeley,

Introduction Best suited for initial explorations of a group or phenomenon. A powerful tool for

Qualitative Evaluation Food for Thought Nest thermostat

Hacking Attacks The power of IPv6 driven malware m-r Mane Piperevski IT Security Researcher

Network Resilience Sanjeev Goyal Christs College University of Cambridge Latsis Symposium

Killzones AI: dynamic procedural combat tactics Remco Straatman Guerrilla Games, Amsterdam,

Outline Malicious Code Introduction CS 239 Viruses Trojan horses Security for

Information Systems Asset Protection: Monitoring SYSTEM ATTACKS Kevin Henry CISA CISM CRISC

Reversible Digital Watermarking Chang-Tsun Li Department of Computer Science University of

Image Forensics and Steganalysis (Hans) Georg Schaathun Department of Computing University of

Mobile VoIP Steganography From Framework to Implementation Marcus Nutzinger Rainer Poisel

Qualitative and Quantitative Evaluation of Software Packers Mar a - PowerPoint PPT Presentation

Qualitative and Quantitative Evaluation of Software Packers Mar a Baz guez , Jos us, Ricardo J. Rodr e Merseguer All wrongs reversed rjrodriguez@unizar.es @RicardoJRdez www.ricardojrodriguez.es Department of Computer

Impact Evaluation of Takaful and Karama I. Quantitative Component II. Qualitative Component

T-76.613 Software testing Analyzing Quantitative Data Mika Mntyl &lt;mika.mantyla@hut.fi&gt;

From Qualitative to Quantitative Theories of Software Tom Henzinger IST Austria Qualitative

Heuristic Evaluation (Pinelle) Heuristic evaluation is a method of qualitative evaluation of

From Qualitative to Quantitative Program Analysis: Permissive Enforcement of Secure Information

Understanding Impact The role of qualitative methods of evaluation Aims of the workshop To

Keywords: Fig, qualitative and quantitative characteristic, diversity, productivity . Time of

Localism Qualitative and Quantitative Research February 2019 1 Localism Qualitative and

What do we mean by scalability? Qualitative: Will this software work well for substantially

Benefits and Challenges of Analyzing Qualitative Data Sheelagh Carpendale empirical research

From Qualitative to Quantitative Dominance Pruning for Optimal Planning Alvaro Torralba

Quantitative Analysis J. Scott Hawker/R. Kuehl p. 1 R I T Software Engineering Tactics and

Application of geospatial methods and remote sensing and for evaluation Blending quantitative

Qt Ql New People to New Groups S. Gladen licenced under CC BY 2.0 2 Dr. Pat Bazeley,

Introduction Best suited for initial explorations of a group or phenomenon. A powerful tool for

Qualitative Evaluation Food for Thought Nest thermostat

Hacking Attacks The power of IPv6 driven malware m-r Mane Piperevski IT Security Researcher

Network Resilience Sanjeev Goyal Christs College University of Cambridge Latsis Symposium

Killzones AI: dynamic procedural combat tactics Remco Straatman Guerrilla Games, Amsterdam,

Outline Malicious Code Introduction CS 239 Viruses Trojan horses Security for

Information Systems Asset Protection: Monitoring SYSTEM ATTACKS Kevin Henry CISA CISM CRISC

Reversible Digital Watermarking Chang-Tsun Li Department of Computer Science University of

Image Forensics and Steganalysis (Hans) Georg Schaathun Department of Computing University of

Mobile VoIP Steganography From Framework to Implementation Marcus Nutzinger Rainer Poisel

T-76.613 Software testing Analyzing Quantitative Data Mika Mntyl <mika.mantyla@hut.fi>