Unpacking tips and tricks Protector Techniques Conclusion Samuel - - PowerPoint PPT Presentation

▶

Dec 01, 2022 170 likes •445 views

Unpacking tips and tricks Samuel Chevet Presentation Process Unpacking tips and tricks Protector Techniques Conclusion Samuel Chevet w4kfu@lse.epita.fr http://www.lse.epita.fr 12 February 2013 Why this talk ? Unpacking tips and tricks

SLIDE 1

Unpacking tips and tricks Samuel Chevet Presentation Process Protector Techniques Conclusion

Unpacking tips and tricks

Samuel Chevet

w4kfu@lse.epita.fr http://www.lse.epita.fr

12 February 2013

SLIDE 2

Unpacking tips and tricks Samuel Chevet Presentation

Why this talk ? Packer Protector Detection Basics knowledges Import Table Import Address Table

Process Protector Techniques Conclusion

Why this talk ?

Previously in w4kfu’s talk : Anti-Debug Malicious software Video Games Share Reverse Engineering stuff Fun

SLIDE 3

Unpacking tips and tricks Samuel Chevet Presentation

Why this talk ? Packer Protector Detection Basics knowledges Import Table Import Address Table

Process Protector Techniques Conclusion

Packer

Compress executable Prepend decompression stub Decompression stub is standalone Indistinguishable to the casual user Single executable Unpack and transfer control to it Original entry point Exist for DOS, Microsoft Windows and others OS Command line as GUI based

SLIDE 4

Unpacking tips and tricks Samuel Chevet Presentation

Why this talk ? Packer Protector Detection Basics knowledges Import Table Import Address Table

Process Protector Techniques Conclusion

Packer Benefit

Less storage space Marketing a product via internet Less time for data transfer Resistant to casual reverser Target must be unpacked or rebuilt

SLIDE 5

Unpacking tips and tricks Samuel Chevet Presentation

Why this talk ? Packer Protector Detection Basics knowledges Import Table Import Address Table

Process Protector Techniques Conclusion

Packer Disavantages

Everything come at a price Antivirus problem More time to decompress Unpacked at some stage Dumped to disk ?

SLIDE 6

Unpacking tips and tricks Samuel Chevet Presentation

Why this talk ? Packer Protector Detection Basics knowledges Import Table Import Address Table

Process Protector Techniques Conclusion

Protector

Derive of the simple packer Packer aim to reduce size Add code to protect against reverse engineering Size will considerably increase Malicious software

SLIDE 7

Unpacking tips and tricks Samuel Chevet Presentation

Why this talk ? Packer Protector Detection Basics knowledges Import Table Import Address Table

Process Protector Techniques Conclusion

Detection

Signature based Opcode-sequence-based Tag Additional heuristics

OEP outside first section More than one executable section ImportTable position uncommon LoadLibrary and GetProcAddress in ImportTable TLS Unknow instruction

Anti Re-Protect Compiler startup code

SLIDE 8

Unpacking tips and tricks Samuel Chevet Presentation

Why this talk ? Packer Protector Detection Basics knowledges Import Table Import Address Table

Process Protector Techniques Conclusion

Detection

Anti

Replace instruction Polymorphism Metamorphism

Toolz

PEiD Protection ID RDG packer Detector . . .

SLIDE 9

Unpacking tips and tricks Samuel Chevet Presentation

Why this talk ? Packer Protector Detection Basics knowledges Import Table Import Address Table

Process Protector Techniques Conclusion

Import Table

List of functions not part of the application Called imports Operating systems DLL’s, or homemade Different OS Version Application don’t know where

SLIDE 10

Unpacking tips and tricks Samuel Chevet Presentation

Why this talk ? Packer Protector Detection Basics knowledges Import Table Import Address Table

Process Protector Techniques Conclusion

Import Table

OptionalHeader->DataDirectory[] IMAGE_DIRECTORY_ENTRY_IMPORT

IMAGE_IMPORT_DESCRIPTOR

OriginalFirstThunk TimeDateStamp ForwarderChain Name FirstThunk

SLIDE 11

Unpacking tips and tricks Samuel Chevet Presentation

Why this talk ? Packer Protector Detection Basics knowledges Import Table Import Address Table

Process Protector Techniques Conclusion

Import Address Table

Loader loads DLL Construct IAT All ptr in FirstThunk contain API’s address call [addr], jmp [addr]

SLIDE 12

Unpacking tips and tricks Samuel Chevet Presentation

Why this talk ? Packer Protector Detection Basics knowledges Import Table Import Address Table

Process Protector Techniques Conclusion

Peering inside the PE

SLIDE 13

Unpacking tips and tricks Samuel Chevet Presentation Process

Original OEP Fix PE Import rebuilding

Protector Techniques Conclusion

Original OEP

Trace the code ESP trick VirtualProtect() Use Exceptions

SLIDE 14

Unpacking tips and tricks Samuel Chevet Presentation Process

Original OEP Fix PE Import rebuilding

Protector Techniques Conclusion

Fix PE

Offset OEP Offset IAT Sections characteristics And more when there is some protection

SLIDE 15

Unpacking tips and tricks Samuel Chevet Presentation Process

Original OEP Fix PE Import rebuilding

Protector Techniques Conclusion

Import rebuilding

Packers/Protector destroy Import Table Correct RVA and Size of Import Table IMAGE_IMPORT_DESCRIPTOR nulled one OriginalFirstThunk, FirstThunk and Name must be well informed

SLIDE 16

Unpacking tips and tricks Samuel Chevet Presentation Process Protector Techniques

Anti-Dumping TLS Callbacks Stolen Bytes API Redirection Nanomites Triggers

Conclusion

Anti-Dumping

Mutex CPUID Delete loader Header modification Page level protection

SLIDE 17

Unpacking tips and tricks Samuel Chevet Presentation Process Protector Techniques

Anti-Dumping TLS Callbacks Stolen Bytes API Redirection Nanomites Triggers

Conclusion

TLS Callbacks

Thread Local Storage Execute code before EP Debugger detection Decryption routines Hook

SLIDE 18

Unpacking tips and tricks Samuel Chevet Presentation Process Protector Techniques

Anti-Dumping TLS Callbacks Stolen Bytes API Redirection Nanomites Triggers

Conclusion

Stolen Bytes

Portions of code Removed from original Usually near entry point Executed from allocated memory Restore them before dump

SLIDE 19

Unpacking tips and tricks Samuel Chevet Presentation Process Protector Techniques

Anti-Dumping TLS Callbacks Stolen Bytes API Redirection Nanomites Triggers

Conclusion

API Redirection

IAT partially or completely destroyed Call to APIs are redirected Routines located into allocated memory or in protector stub

SLIDE 20

Unpacking tips and tricks Samuel Chevet Presentation Process Protector Techniques

Anti-Dumping TLS Callbacks Stolen Bytes API Redirection Nanomites Triggers

Conclusion

API Redirection

Stolen instructions Control transfered back in the middle Routines located into allocated memory or in protector stub Load whole DLL image Redirect API Difficult to set breakpoints

SLIDE 21

Unpacking tips and tricks Samuel Chevet Presentation Process Protector Techniques

Anti-Dumping TLS Callbacks Stolen Bytes API Redirection Nanomites Triggers

Conclusion

API Redirection

Inject !!! Scan for call dword ptr / jmp dword ptr Is outside PE ? Is not an API ? Hook routine Call it Use against himself !

SLIDE 22

Unpacking tips and tricks Samuel Chevet Presentation Process Protector Techniques

Anti-Dumping TLS Callbacks Stolen Bytes API Redirection Nanomites Triggers

Conclusion

Nanomites

JCC instruction Some Opcodes Replace by int3 2 Process ! Father and son Inject the father Father : WaitForDebugEvent() Son : Scan 0xCC (int3) Reverse, or comportemental study Thruth table Maybe opcode will be restored to avoid performance down

SLIDE 23

Unpacking tips and tricks Samuel Chevet Presentation Process Protector Techniques

Anti-Dumping TLS Callbacks Stolen Bytes API Redirection Nanomites Triggers

Conclusion

Triggers

Detect if protection has been deleted Developpers can use SDK Invincible enemy Camera bug Redirect call will return on the next instruction Return value modification

SLIDE 24

Unpacking tips and tricks Samuel Chevet Presentation Process Protector Techniques Conclusion

Conclusion

INJECT !

SLIDE 25

Unpacking tips and tricks Samuel Chevet Presentation Process Protector Techniques Conclusion

Real Conclusion

Really fun ! Code your own toolz Don’t use unpacker ! Write your own Internet connection permanent Kill market of multimedia library and occasion

SLIDE 26

Unpacking tips and tricks Samuel Chevet Presentation Process Protector Techniques Conclusion

Unpacking tips and tricks

Samuel Chevet

w4kfu@lse.epita.fr http://www.lse.epita.fr

12 February 2013

Why this talk ?

Previously in w4kfu’s talk : Anti-Debug Malicious software Video Games Share Reverse Engineering stuff Fun

Packer

Compress executable Prepend decompression stub Decompression stub is standalone Indistinguishable to the casual user Single executable Unpack and transfer control to it Original entry point Exist for DOS, Microsoft Windows and others OS Command line as GUI based

Packer Benefit

Less storage space Marketing a product via internet Less time for data transfer Resistant to casual reverser Target must be unpacked or rebuilt

Packer Disavantages

Everything come at a price Antivirus problem More time to decompress Unpacked at some stage Dumped to disk ?

Protector

Derive of the simple packer Packer aim to reduce size Add code to protect against reverse engineering Size will considerably increase Malicious software

Detection

Signature based Opcode-sequence-based Tag Additional heuristics

OEP outside first section More than one executable section ImportTable position uncommon LoadLibrary and GetProcAddress in ImportTable TLS Unknow instruction

Anti Re-Protect Compiler startup code

Detection

Anti

Replace instruction Polymorphism Metamorphism

Toolz

PEiD Protection ID RDG packer Detector . . .

Import Table

List of functions not part of the application Called imports Operating systems DLL’s, or homemade Different OS Version Application don’t know where

Import Table

OptionalHeader->DataDirectory[] IMAGE_DIRECTORY_ENTRY_IMPORT

IMAGE_IMPORT_DESCRIPTOR

OriginalFirstThunk TimeDateStamp ForwarderChain Name FirstThunk

Import Address Table

Loader loads DLL Construct IAT All ptr in FirstThunk contain API’s address call [addr], jmp [addr]

Peering inside the PE

Original OEP

Trace the code ESP trick VirtualProtect() Use Exceptions

Fix PE

Offset OEP Offset IAT Sections characteristics And more when there is some protection

Import rebuilding

Packers/Protector destroy Import Table Correct RVA and Size of Import Table IMAGE_IMPORT_DESCRIPTOR nulled one OriginalFirstThunk, FirstThunk and Name must be well informed

Anti-Dumping

Mutex CPUID Delete loader Header modification Page level protection

TLS Callbacks

Thread Local Storage Execute code before EP Debugger detection Decryption routines Hook

Stolen Bytes

Portions of code Removed from original Usually near entry point Executed from allocated memory Restore them before dump

API Redirection

IAT partially or completely destroyed Call to APIs are redirected Routines located into allocated memory or in protector stub

API Redirection

Stolen instructions Control transfered back in the middle Routines located into allocated memory or in protector stub Load whole DLL image Redirect API Difficult to set breakpoints

API Redirection

Inject !!! Scan for call dword ptr / jmp dword ptr Is outside PE ? Is not an API ? Hook routine Call it Use against himself !

Nanomites

JCC instruction Some Opcodes Replace by int3 2 Process ! Father and son Inject the father Father : WaitForDebugEvent() Son : Scan 0xCC (int3) Reverse, or comportemental study Thruth table Maybe opcode will be restored to avoid performance down

Triggers

Detect if protection has been deleted Developpers can use SDK Invincible enemy Camera bug Redirect call will return on the next instruction Return value modification

Conclusion

INJECT !

Real Conclusion

Really fun ! Code your own toolz Don’t use unpacker ! Write your own Internet connection permanent Kill market of multimedia library and occasion

Questions ?

Thank you for your attention @w4kfu blog.w4kfu.com w4kfu@lse.epita.fr