Using SMT solvers for binary analysis and exploitation A primer on - - PowerPoint PPT Presentation

▶
using smt solvers for binary analysis and exploitation
SMART_READER_LITE
LIVE PREVIEW

Using SMT solvers for binary analysis and exploitation A primer on - - PowerPoint PPT Presentation

Mar 22, 2023 132 likes •643 views

Using SMT solvers for binary analysis and exploitation A primer on SMT, SMT solvers, Z3 & angr Carl Svensson August 29, 2018 Nixucon 2018 About me Carl Svensson, 27 MSc in Computer Science, KTH Head of Security, KRY/LIVI

slide-1
SLIDE 1

Using SMT solvers for binary analysis and exploitation

A primer on SMT, SMT solvers, Z3 & angr

Carl Svensson August 29, 2018

Nixucon 2018

slide-2
SLIDE 2

About me

  • Carl Svensson, 27
  • MSc in Computer Science, KTH
  • Head of Security, KRY/LIVI
  • CTF-player, HackingForSoju
  •  calle.svensson@zeta-two.com
  •  @zetatwo
  •  https://zeta-two.com

1

slide-3
SLIDE 3

Reverse engineering in 15 seconds?

  • Take stufg, e.g. software, apart
  • Understand how it works
  • Many possible goals
  • How can I reach a specifjc state?

2

slide-4
SLIDE 4

What is SMT?

  • Satisfjability modulo theories, SMT
  • A bunch of variables
  • A bunch of theories
  • Theory = A bunch of rules
  • A bunch of formulas
  • Can we fjnd values for all values s.t. all formulas are satisifed?

3

slide-5
SLIDE 5

SMT: Example 1

x + 13 = 37

4

slide-6
SLIDE 6

SMT: Example 2

x + y + 13 = 37 − z x − 2 · y + 10 = 10 · z 4 · x − z + 13 = 37 + y

5

slide-7
SLIDE 7

SMT: Example 3

6

slide-8
SLIDE 8

Microsoft to the rescue

  • Can we automate? Yes!
  • Microsoft Research
  • Z3 Theorem Prover
  • General purpose
  • Own language
  • Bindings for several languages
  • Open source & cross platform

7

slide-9
SLIDE 9

Using Z3 in Python

8

slide-10
SLIDE 10

Using Z3 in RE

Throwback Thursday: Starcraft

9

slide-11
SLIDE 11

Throwback Thursday: Starcraft

  • Commercial software
  • Released in 1998
  • Simple protections
  • Good starting point
  • Requires a serial key
  • Can we create our own?

10

slide-12
SLIDE 12

Getting to the core: Installer

11

slide-13
SLIDE 13

Getting to the core: Serial key input

12

slide-14
SLIDE 14

Getting to the core: Resource strings

13

slide-15
SLIDE 15

Getting to the core: Decompilation

14

slide-16
SLIDE 16

Getting to the core: Call graph

15

slide-17
SLIDE 17

Getting to the core: Call graph

16

slide-18
SLIDE 18

Getting to the core: Decompilation

17

slide-19
SLIDE 19

Z3: Formulating formulas

18

slide-20
SLIDE 20

Z3: Formulating formulas

19

slide-21
SLIDE 21

Symbolic execution

  • Symbols vs. concrete values
  • Pro: Explore ”all” paths
  • Con: Exponential complexity

20

slide-22
SLIDE 22

Once again, with fee... angr

  • ”python framework for analyzing binaries”
  • ”both static and dynamic symbolic (concolic)”
  • Computer Security Lab at UC Santa Barbara
  • Uses Z3 internally

21

slide-23
SLIDE 23

Angr management: Extracting the code

22

slide-24
SLIDE 24

Angr management: Minimizing the code

23

slide-25
SLIDE 25

Angr management: Writing the explorer

24

slide-26
SLIDE 26

Can we use even less efgort?

  • Extracting code is cumbersome
  • Can’t we use the code in place?
  • ”Call” directly into validator
  • Symbolic argument
  • Patch away irrelevant parts

25

slide-27
SLIDE 27

Full fury: Writing the explorer

26

slide-28
SLIDE 28

Full fury: Writing the explorer

27

slide-29
SLIDE 29

Full fury: Writing the explorer

28

slide-30
SLIDE 30

Using Z3 in RE

What about exploitation?

29

slide-31
SLIDE 31

Exploitation

  • IP control
  • Satisfy condition

30

slide-32
SLIDE 32

Exploitation with angr

  • Find execution path
  • Constrain execution
  • Satisfy condition

31

slide-33
SLIDE 33

Example from Security Fest CTF

  • Function pointer lookup
  • Index OOB
  • Hook messy function

32

slide-34
SLIDE 34

angr exploitation example

33

slide-35
SLIDE 35

angr exploitation example

34

slide-36
SLIDE 36

angr exploitation example

35

slide-37
SLIDE 37

angr exploitation example

36

slide-38
SLIDE 38

angr exploitation example

> python exploit_angr . py Choice : 2147483648 RDX: f f f f f f f f f f f f f f f e > ./ bowrain_581bbadaafd23051a25ccb4adc80b670 . . . : 2147483648 [ 1 ] 17059 segmentation f a u l t ( core dumped)

37

slide-39
SLIDE 39

Using Z3 in RE

Even deobfuscation?!

38

slide-40
SLIDE 40

Obfuscation

  • Make code hard to read
  • for humans
  • for computers
  • Control fmow fmattening
  • Packer
  • Dropper
  • VM
  • Dead code

39

slide-41
SLIDE 41

Deobfuscation in general

  • Undo the mess
  • Hard problem

40

slide-42
SLIDE 42

Deobfuscation of dead code with angr

  • Prove that dead code is dead
  • Prove uniqueness of value

41

slide-43
SLIDE 43

Example: indirect jmp deobfuscator

42

slide-44
SLIDE 44

Example from mobile app

  • Find ”jmp reg”
  • Search callgraph backwards
  • Search forward
  • Simplify expression
  • Replace code

43

slide-45
SLIDE 45

Example: indirect jmp deobfuscator

44

slide-46
SLIDE 46

Example: indirect jmp deobfuscator

45

slide-47
SLIDE 47

Example: indirect jmp deobfuscator

46

slide-48
SLIDE 48

Example: indirect jmp deobfuscator

47

slide-49
SLIDE 49

Thanks for listening!

47