Reverse-Engineering

From YobiWiki
Jump to navigation Jump to search

Books

Resources

Static Analysis Tools

IDA Pro

IDA Pro combines an interactive, programmable, multi-processor disassembler coupled to a local and remote debugger and augmented by a complete plugin programming environment.

Hex-Rays

The most expensivepowerful IDA Pro plugin is the Hex-Rays decompiler

  • x86 and ARM
  • decompiler

Limitations specific to ARM:

  • floating point instructions are not supported
  • VFP/SIMD/Neon/... instructions are not supported
  • functions having an argument that is passed partially on registers and partially on the stack are not supported (e.g. int64 passed in R3 and on the stack)

REC Studio

  • x86, x64
  • Windows, Linux, Mac OS X
  • HLA disassembler

Useful commands: 

help
strings
calltree
showprocs
decompile /tmp/myprog.c

click on a function in the "Project" function list to HLA disass it

Radare

The reverse engineering framework

Misc

Distorm

diStorm3 is really a decomposer, which means it takes an instruction and returns a binary structure which describes it rather than static text, this is great for advanced binary code analysis

PyPEELF

PyPEELF is a multi-platform binary editor written in Python, wxPython and BOA Constructor. It allows you to manage binary data in PE32, PE32+ (x64) and ELF binary files.

PyPEELF uses pefile to manage PE32 and PE32+ files and pyelf to manage ELF files. Besides, it uses winappdbg and pydasm in some others features like Task Running Viewer and Disassembling files.

PyPEELF was designed for Reverse Engineers who want to edit or visualize binary file data in multi-platforms. That is why PyPEELF runs under Windows and Unix/BSD operating systems

Poor man's tools

File, -z to uncompress, -s to inspect non-files, e.g. /dev/sda1 

file -k [-z] [-s] mybin

Strings 

strings [-n min_length] -a -e [s|S|b|l|B|L] mybin

Android

Mobile Sandbox

Provides online static analysis of malware images.

APKInspector

The goal of this project is to aide analysts and reverse engineers to visualize compiled Android packages and their corresponding DEX code. APKInspector provides both analysis functions and graphic features for the users to gain deep insight into the malicious apps

Dex2jar

A tool for converting Android’s .dex format to Java’s .class format
See also DeObfuscate jar with dex tool

Jd-gui

JD-GUI is a standalone graphical utility that displays Java source codes of “.class” files

Androguard

Reverse engineering, Malware analysis of Android applications … and more !

Dexdump

Java .dex file format decompiler

Smali

smali/baksmali is an assembler/disassembler for the dex format used by dalvik, Android’s Java VM implementation

Apk Multi-Tool

Swiss knive (was Apk Manager)
Contains apktool, smali/baksmali etc
on Github for Linux release

  • 9 decompile apk / 1 select apk / 9 decompile apk

GetStrings

Small script to copy in-place resource strings into smali, to ease reversing.
To be used e.g. after Apk Multi-Tool decompilation 

#!/bin/bash

DECOMPILED_DIR=working/*apk/

cat $DECOMPILED_DIR/res/values/public.xml|grep "type=.string"|\
    sed 's/.*name="\?//;s/" id="\?/ /;s/"\? \/>//'|\
    awk --non-decimal-data '{print $2, int($2), $1}'\
    > getstring-pub
cat $DECOMPILED_DIR/res/values/strings.xml|grep '<string'|\
    sed 's/.*name="\?//; s/"\?>/ /;s/<\/string>//'\
    > getstring-str
join -1 3 -2 1 getstring-pub getstring-str|awk '{t=$3;$3=$1;$1=t;print}' > getstring-map
cat getstring-map |awk '{id=$2;$1="";$2="";$3="";sub(/^ */,"");printf("s#"id"#\"%s\"#\n", $0)}' > getstring-sed

find $DECOMPILED_DIR -name "*.smali" -exec sed -i -f getstring-sed {} \;

Java

JAD

Java Decompiler

binary-refactor

Helper to manual de-obfuscate obfuscated jars

  • rename class/packages in a jar
  • match a jarjar-ed & obfuscated jar with a known jar,to find the 'same' classes
  • bytecode dump(asm)
  • class dependency graph

ELF

man elf

readelf

readelf -a -g -t --dyn-syms -W mybin

elfedit

objdump

objdump -C -g -F -x -T --special-syms mybin
objdump -d -l -r -R -S mybin
objdump -D -l -r -R -S mybin

nm

nm -a -C -S -s --special-syms mybin

ldd

Shared library dependencies: 

ldd -v mybin

PE

Pefile

A Python module to read and work with PE (Portable Executable) files, see usage examples 

#!/usr/bin/env python
import sys, pefile
pe = pefile.PE(sys.argv[1])
pe.dump_info()
open('out.txt', 'w').write(pe.dump_info())

Can run under Linux

PEiD

Can run with Wine

PETools

Can run with Wine

Resource Hacker

Can run with Wine

Dependency Walker

Can run with Wine

PEview

Can run with Wine

DLL Export Viewer

Can run with Wine
Under Wine, require absolute path to DLL so: click on gears, "load functions from the following DLL file", Browse

PEBrowse Pro

Can run with Wine

Explorer Suite

  • CFF Explorer: Allows also to modify a PE
  • Signature Explorer
  • PE Detective
  • Task Explorer (32 & 64)

PE Insider

Static protections

Packers

upx -d myfile
  • Crinkler: some insane PE packing tool coming from the demoscene world.

Dynamic Analysis Tools

IDA Pro

IDA Pro has some debugging capabilities too.
Local debugging: win32, windbg Remote debugging: 

gdbserver --multi <client_ip>:<port> # default IDA port: 23946

Then on IDA: select Remote GDB debugger, paths should be paths on the gdbserver host.
Tuning:

  • Debugger / options / Stop on process entry point
  • Compatible with lib preloading, cf below
  • from 6.4, can make use of Intel PIN tools for diff debugging, see tutorial (pdf)

Intel PIN tools

  • Official page
  • Windows, Linux, Mac OS X, Android
  • x86-32, x86-64 (only Intel platforms obviously)
  • binary instrumentation

The best way to think about Pin is as a "just in time" (JIT) compiler. The input to this compiler is not bytecode, however, but a regular executable. Pin intercepts the execution of the first instruction of the executable and generates ("compiles") new code for the straight line code sequence starting at this instruction. It then transfers control to the generated sequence. The generated code sequence is almost identical to the original one, but Pin ensures that it regains control when a branch exits the sequence. After regaining control, Pin generates more code for the branch target and continues execution. Pin makes this efficient by keeping all of the generated code in memory so it can be reused and directly branching from one sequence to another. In JIT mode, the only code ever executed is the generated code. The original code is only used for reference. When generating code, Pin gives the user an opportunity to inject their own code (instrumentation).

Vdb/Vtrace / Vivisect

  • debugger, static analysis
  • Windows, Linux, Android
  • Intel, ARM

vtrace is a cross-platform process debugging API implemented in python, and vdb is a debugger which uses it
vivisect is a Python based static analysis and emulation framework

Android

Binary Instrumentation Framework for Android

Slides here

DroidScope

DECAF(short for Dynamic Executable Code Analysis Framework) is a binary analysis platform based on QEMU. This is also the home of the DroidScope dynamic Android malware analysis platform. DroidScope is now an extension to DECAF
Slides here and article here

DroidBox

Android Application Sandbox

TaintDroid

Realtime Privacy Monitoring on Smartphones

Soot

Java, Dalvik (see here and here)

Java

Javasnoop

A tool that lets you intercept methods, alter data and otherwise hack Java applications running on your computer.

ELF

ltrace/strace

Tracing library calls and system calls.
Getting a summary: 

ltrace -f -S mybin 2>&1|grep '(.*)'|sed 's/(.*//'|sort|uniq -c

Getting more: 

ltrace -f -i -S -n 4 -s 1024 mybin

Lib preloading

#define _GNU_SOURCE

#include <dlfcn.h>
#include <sys/types.h>
#include <unistd.h>
#include <errno.h>
#include <stdio.h>
#include <time.h>


// Kill nanosleep()
int nanosleep(const struct timespec *req, struct timespec *rem){
    printf("\n==== In our own nanosleep(), I dunnah want sleep\n");
    return 0;
}

// Kill usleep()
int usleep(useconds_t usec){
    printf("\n==== In our own usleep(), I dunnah want sleep\n");
    return 0;
}

// Fix time()
time_t time(time_t *t){
    printf("\n==== In our own time(), will return 1380120175\n");
    return 1380120175;
}

// Fix srand()
void srand(unsigned int seed){
    printf("\n==== In our own srand(), will do srand(0)\n");
    void (*original_srand)(unsigned int seed);
    original_srand = dlsym(RTLD_NEXT, "srand");
    unsigned int myseed = 0;
    return (*original_srand)(myseed);
}

#if 0
// Kill rand()
int rand(void){
    printf("\n==== In our own rand(), will return 0\n");
    return 0;
}
#else
// Intercept rand()
int rand(void){
    int (*original_rand)(void);
    original_rand = dlsym(RTLD_NEXT, "rand");
    int r = (*original_rand)();
    printf("\n==== In our own rand(), will return %04X\n", r);
    return r;
}
#endif

gcc -fPIC -shared -Wl,-soname,patch -o patch.so patch.c -ldl
export LD_PRELOAD=patch.so
export LD_LIBRARY_PATH=.:$LD_LIBRARY_PATH

injectso

  • x86-32, x86-64, ARM (since v0.52)

PE

Process Monitor

Process Explorer

RegShot

Computes diff between two registry snapshots

HeapMemView

OllyDBG

PE32 only dynamic disassembler and debugger: http://ollydbg.de/.

Support sofwtare and hardware breakpoint, binary patching and repacking, symbol analysis, advanced instruction pattern search, trace with conditional breaking, etc.

There is also a patched version with advanced python scripting ability called Immunity Debugger: http://www.immunityinc.com/products-immdbg.shtml

WinAppDbg

The WinAppDbg python module allows developers to quickly code instrumentation scripts in Python under a Windows environment.

Tracer.py

Based on WinAppDbg, finds interesting bits in trace by dichotomy signal/noise

  • run first time and try everything but not the interesting stuff -> use noise option
  • then run again and try interesting stuff -> use signal option

WTFDLL.py

Find libraries loaded at runtime and the functions called

Cuckoo Sandboxing

Currently only supporting Windows binaries.
Cuckoo Sandbox is a malware analysis system. You can throw any suspicious file at it and in a matter of seconds Cuckoo will provide you back some detailed results outlining what such file did when executed inside an isolated environment. Cuckoo generates a handful of different raw data which include:

  • Native functions and Windows API calls traces
  • Copies of files created and deleted from the filesystem
  • Dump of the memory of the selected process
  • Full memory dump of the analysis machine
  • Screenshots of the desktop during the execution of the malware analysis
  • Network dump generated by the machine used for the analysis

Dynamic protections

Retrieved from "https://wiki.yobi.be/index.php?title=Reverse-Engineering&oldid=8341"