MoVfuscator Writeup - Revision history

PhilippeTeuwen at 09:16, 18 August 2015

2015-08-18T09:16:24Z

← Older revision		Revision as of 09:16, 18 August 2015
Line 218:		Line 218:
	ia32:		ia32:
	mkdir -p obj-ia32		mkdir -p obj-ia32
	$(MAKE) TARGET=ia32 obj-ia32/~~Tracer~~.so		$(MAKE) TARGET=ia32 obj-ia32/tracer.so

	intel64:		intel64:
	mkdir -p obj-intel64		mkdir -p obj-intel64
	$(MAKE) TARGET=intel64 obj-intel64/~~Tracer~~.so		$(MAKE) TARGET=intel64 obj-intel64/tracer.so

	clean-all:		clean-all:
Line 231:		Line 231:
	And use it: (I used the <code>-ifeellucky</code> switch because current latest PIN doesn't know about my linux kernel 4.0 yet)		And use it: (I used the <code>-ifeellucky</code> switch because current latest PIN doesn't know about my linux kernel 4.0 yet)
	make		make
	../../../pin -ifeellucky -t ./obj-ia32/~~Tracer~~.so -- ./challenge 6bc1bee22e409f96e93d7e117393172a		../../../pin -ifeellucky -t ./obj-ia32/tracer.so -- ./challenge 6bc1bee22e409f96e93d7e117393172a

	==Attack==		==Attack==
Line 244:		Line 244:
	for i in range(50):		for i in range(50):
	plaintext=random.randint(0, (1<<(8*16))-1)		plaintext=random.randint(0, (1<<(8*16))-1)
	cmd = '../../../pin -ifeellucky -t ./obj-ia32/~~Tracer~~.so -- ./challenge %0*x; exit 0' % (32, plaintext)		cmd = '../../../pin -ifeellucky -t ./obj-ia32/tracer.so -- ./challenge %0*x; exit 0' % (32, plaintext)
	output=subprocess.check_output(cmd, shell=True)		output=subprocess.check_output(cmd, shell=True)
	ciphertext=int(output.split('\n')[3], 16)		ciphertext=int(output.split('\n')[3], 16)
Line 414:		Line 414:

	def crack(c):		def crack(c):
	cmd = ['echo "'+ c + '" \| ./~~Tracer~~ ./crackme2; exit 0']		cmd = ['echo "'+ c + '" \| ../../../pin -ifeellucky -t ./obj-ia32/tracer.so -- ./crackme2; exit 0']
	output=subprocess.check_output(cmd, shell=True)		output=subprocess.check_output(cmd, shell=True)
	os.rename('trace-1byte-writes.bin', 'trace-1byte-writes.bin.'+c)		os.rename('trace-1byte-writes.bin', 'trace-1byte-writes.bin.'+c)

PhilippeTeuwen: /* crackme2 */

2015-08-16T21:37:09Z

crackme2

← Older revision		Revision as of 21:37, 16 August 2015
Line 398:		Line 398:
	Back to [https://github.com/xoreaxeaxeax/movfuscator/tree/master/poc/crackme crackme2]: we can use the same tracer as above to dump all memory writes.		Back to [https://github.com/xoreaxeaxeax/movfuscator/tree/master/poc/crackme crackme2]: we can use the same tracer as above to dump all memory writes.
	<br>Then trying all 1-char keys and diffing the traces give some info. Differences vary quite a lot but if we count for which char we've quite a unique number of diffs when compared with other traces, we get good candidates. When attacking byte N, those diff stats don't change no matter what are the N-1 chars.		<br>Then trying all 1-char keys and diffing the traces give some info. Differences vary quite a lot but if we count for which char we've quite a unique number of diffs when compared with other traces, we get good candidates. When attacking byte N, those diff stats don't change no matter what are the N-1 chars.
	<br>E.g. here I compare with trace of 'a':		<br>E.g. here I compare with trace of '...a':
	HEAD: => ['@', 'A', 'a', 'z', '{']		HEAD: => ['@', 'A', 'a', 'z', '{']
	HEAD: a => ['@', 'A', 'N', 'a', 'n']		HEAD: a => ['@', 'A', 'N', 'a', 'n']

PhilippeTeuwen: /* crackme2 */

2015-08-16T21:30:01Z

crackme2

← Older revision		Revision as of 21:30, 16 August 2015
Line 405:		Line 405:
	HEAD: aaaa => ['@', 'A', 'N', 'a', 'n']		HEAD: aaaa => ['@', 'A', 'N', 'a', 'n']
	HEAD: aaaaa => ['@', 'A', 'S', 'a', 's']		HEAD: aaaaa => ['@', 'A', 'S', 'a', 's']
			etc
	And the ugly script I used:		And the ugly script I used:
	<source lang=python>		<source lang=python>

PhilippeTeuwen at 21:26, 16 August 2015

2015-08-16T21:26:59Z

@@ Line 124: / Line 124: @@
 ==Traces==
-Let's use a very simple [{{#filelink: tracer.cpp}} tracing code tracer.cpp] with [https://software.intel.com/en-us/articles/pin-a-dynamic-binary-instrumentation-tool Intel PIN] to record all 1-byte memory writes:
+Let's use a very simple [{{#filelink: tracer.cpp}} tracing code tracer.cpp] with Intel PIN to record all 1-byte memory writes:
 {{#fileanchor: tracer.cpp}}
 <source lang=cpp>
@@ Line 394: / Line 394: @@
 Comments?
 <br>You can [https://twitter.com/doegox/status/630751161419755520 reply to my tweet] or [[User:PhilippeTeuwen|contact me]].

PhilippeTeuwen: /* Traces */

2015-08-16T21:21:10Z

Traces

← Older revision		Revision as of 21:21, 16 August 2015
Line 124:		Line 124:

	==Traces==		==Traces==
	Let's use a very simple [{{#filelink: tracer.cpp}} tracing code tracer.cpp] with Intel PIN to record all 1-byte memory writes:		Let's use a very simple [{{#filelink: tracer.cpp}} tracing code tracer.cpp] with [https://software.intel.com/en-us/articles/pin-a-dynamic-binary-instrumentation-tool Intel PIN] to record all 1-byte memory writes:
	{{#fileanchor: tracer.cpp}}		{{#fileanchor: tracer.cpp}}
	<source lang=cpp>		<source lang=cpp>

PhilippeTeuwen: /* Attack */

2015-08-11T22:37:40Z

Attack

← Older revision		Revision as of 22:37, 11 August 2015
Line 285:		Line 285:

	filenames = sorted(glob.glob('trace_1byte_write*small'))		filenames = sorted(glob.glob('trace_1byte_write*small'))

	#ntraces = len(filenames)		#ntraces = len(filenames)
	# Limit our number of traces for a faster result:		# Limit our number of traces for a faster result:
	ntraces=30		ntraces=30

	nsamples = os.path.getsize(filenames[0])*8		nsamples = os.path.getsize(filenames[0])*8
	#sample_start = 0		#sample_start = 0
Line 294:		Line 296:
	sample_start = 3000		sample_start = 3000
	sample_end = 3500		sample_end = 3500

			#targetbits=range(8)
			# Focus on the first bit only for a faster result:
			targetbits=[0]

	traces = np.zeros([ntraces, nsamples],np.uint8)		traces = np.zeros([ntraces, nsamples],np.uint8)
Line 335:		Line 341:
	diffs = [0]*256		diffs = [0]*256
	for key in range(0, 256):		for key in range(0, 256):
	mean1 = np.zeros([sample_end-sample_start,8])		mean1 = np.zeros([sample_end-sample_start,len(targetbits)])
	mean0 = np.zeros([sample_end-sample_start,8])		mean0 = np.zeros([sample_end-sample_start,len(targetbits)])
	num1 = [0]*8		num1 = [0]*len(targetbits)
	num0 = [0]*8		num0 = [0]*len(targetbits)
	for tnum in range(ntraces):		for tnum in range(ntraces):
	Hyp = SBOX[plaintexts[tnum, bnum] ^ key]		Hyp = SBOX[plaintexts[tnum, bnum] ^ key]
	for targetbit in ~~range(8)~~:		for targetbit in targetbits:
	if (Hyp & (1 << targetbit)) != 0:		if (Hyp & (1 << targetbit)) != 0:
	mean1[:,targetbit] = np.add(mean1[:,targetbit], traces[tnum,sample_start:sample_end])		mean1[:,targetbit] = np.add(mean1[:,targetbit], traces[tnum,sample_start:sample_end])
Line 355:		Line 361:
	</source>		</source>
	Running it:		Running it:
	time ./~~dpa2~~.py		time ./dpa.py
	2b 7e 15 16 28 ae d2 a6 ab f7 15 88 09 cf 4f 3c		2b 7e 15 16 28 ae d2 a6 ab f7 15 88 09 cf 4f 3c
	real ~~0m7~~.~~927s~~		real 0m1.196s
	user ~~0m7~~.~~908s~~		user 0m1.184s
	sys 0m0.~~012s~~		sys 0m0.008s

	One may use autocorrelation on a single trace to find the underlying AES structure and find the first round:		One may use autocorrelation on a single trace to find the underlying AES structure and find the first round:

PhilippeTeuwen: /* Attack */

2015-08-11T22:11:49Z

Attack

← Older revision		Revision as of 22:11, 11 August 2015
Line 354:		Line 354:
	print "%02x" % diffs.index(max(diffs)),		print "%02x" % diffs.index(max(diffs)),
	</source>		</source>
			Running it:
			time ./dpa2.py
			2b 7e 15 16 28 ae d2 a6 ab f7 15 88 09 cf 4f 3c
			real 0m7.927s
			user 0m7.908s
			sys 0m0.012s

	One may use autocorrelation on a single trace to find the underlying AES structure and find the first round:		One may use autocorrelation on a single trace to find the underlying AES structure and find the first round:

PhilippeTeuwen at 22:10, 11 August 2015

2015-08-11T22:10:35Z

@@ Line 269: / Line 269: @@
 Now each trace contains only 6625 1-byte writes, much better!
-'''A classical [https://en.wikipedia.org/wiki/Power_analysis#Differential_power_analysis DPA attack] on those traces will reveal the key with as few as 20 traces.'''
+'''A classical [https://en.wikipedia.org/wiki/Power_analysis#Differential_power_analysis DPA attack] on those traces will reveal the key with about 20 to 30 traces.'''
 <br>Small reminder about the settings to mount a DPA attack with as few traces as possible, from [https://eprint.iacr.org/2015/753 our paper]:
 * Serialize the traces to consider each bit individually
@@ Line 275: / Line 275: @@
 * DPA works slightly better than CPA
 If nevertheless you're trying CPA on Hamming weight of first round SBox, it will require about 160 traces, still quite doable.
 One may use autocorrelation on a single trace to find the underlying AES structure and find the first round:

PhilippeTeuwen: /* Open samples */

2015-08-11T14:50:03Z

Open samples

← Older revision		Revision as of 14:50, 11 August 2015
Line 285:		Line 285:

	==Open samples==		==Open samples==
	In typical white-boxes, the key scheduling is ~~unrolled~~ when the executable is generated and the round keys are merged somehow into the processing, typically in some look-up tables.		In typical white-boxes, the key scheduling is precomputed when the executable is generated and the round keys are merged somehow into the processing, typically in some look-up tables.
	<br>But here it was not the case so, if someone knows exactly where to look, he may directly extract the key.		<br>But here it was not the case so, if someone knows exactly where to look, he may directly extract the key.
	<br>This knowledge requires so called ''open samples'': we need to compile a few same challenges with other known keys.		<br>This knowledge requires so called ''open samples'': we need to compile a few same challenges with other known keys.

PhilippeTeuwen: /* Attack */

2015-08-11T14:48:54Z

Attack

← Older revision		Revision as of 14:48, 11 August 2015
Line 273:		Line 273:
	* Serialize the traces to consider each bit individually		* Serialize the traces to consider each bit individually
	* Attack first round SBox output, considering each target bit individually, not their Hamming weight.		* Attack first round SBox output, considering each target bit individually, not their Hamming weight.
	* DPA works slightly better than ~~DCA~~		* DPA works slightly better than CPA
	If nevertheless you're trying ~~DCA~~ on Hamming weight of first round SBox, it will require about 160 traces, still quite doable.		If nevertheless you're trying CPA on Hamming weight of first round SBox, it will require about 160 traces, still quite doable.

	One may use autocorrelation on a single trace to find the underlying AES structure and find the first round:		One may use autocorrelation on a single trace to find the underlying AES structure and find the first round: