©2012 Check Point Software Technologies Ltd. Introduction to Reverse Engineering Inbar Raz Malware...

Introduction to Reverse Engineering

Inbar RazMalware Research Lab Manager

Information Security – Theory vs. RealityTel Aviv University, 368-4474-01, Winter 2012-2013Lecture 7

What is Reverse Engineering?

Reverse engineering is the process of discovering the technological principles of a device, object, or system through analysis of its structure, function, and operation.

aka: Reversing, RE, SRE

Why do it?

Discover Trade Secrets

FindVulnerabilities

AcademicResearch

(Yeah, right…)

Circumvent[Copy]

Protection

AnalyseProtocolsPure

CuriosityPatch Binary

andAlter Behavior

Sounds awesome,

right?

So where’s the catch?

Low-level is, well, low level…00401000 push ebp00401001 mov ebp, esp00401003 push ecx00401004 push ecx00401005 and dword ptr [ebp-4], 000401009 push esi0040100A mov esi, [ebp+8]0040100D push edi0040100E push esi0040100F call ds:[00402008h]00401015 mov edi, eax00401017 xor edx, edx00401019 test edi, edi0040101B jle 00401047h0040101D movsx ecx, byte ptr [edx+esi]00401021 add [ebp-4], ecx00401024 mov [ebp-8], ecx00401027 rol dword ptr [ebp-4], 10040102A mov eax, ecx0040102C imul eax, [ebp-4]00401030 mov [ebp-4], eax00401033 mov eax, [ebp-8]00401036 add [ebp-4], eax00401039 xor [ebp-4], ecx0040103C inc edx0040103D cmp edx, edi0040103F jl 0040101Dh00401041 cmp dword ptr [ebp-4], 000401045 jnz 00401063h00401047 push 000401049 push 40230Ch0040104E push 4022CCh00401053 push ds:[004023ACh]00401059 call ds:[00402010h]0040105F xor eax, eax00401061 jmp 0040107Fh00401063 xor dword ptr [ebp+0Ch], 01337C0DEh0040106A sub dword ptr [ebp+0Ch], 0BADC0DE5h00401071 mov eax, [ebp-4]00401074 not dword ptr [ebp+0Ch]00401077 xor eax, [ebp+0Ch]0040107A neg eax0040107C sbb eax, eax0040107E inc eax0040107F pop edi00401080 pop esi00401081 leave00401082 retn

for (Serial = 0, i = 0; i < strlen(UserName); i++) { CurChar = (int) UserName[i]; Serial += CurChar; Serial = (((Serial << 1) && 0xFFFFFFFE) || ((Serial >> 31) && 1)); Serial = (((Serial * CurChar) + CurChar) ^ CurChar);}UserSerial = ~((UserSerial ^ 0x1337C0DE) - 0xBADC0DE5);

Low-level is, well, low level…

Needle in a haystack– Average opcode size:

3 bytes– Average executable size:

500KB (on WinXP)– There are executables,

libraries, drivers….

Needle in a haystack

Sometimes, the code resists– Packers and compressors– Obfuscators

Needle in a haystack

Sometimes, the code resists

Sometimes, the code fights back– Detect reversing tools– Detect VMs and emulators

A Battle of Wits

Author writes code

Reverser reverses it

Author creates an anti-reversing technique

Reverser bypasses it

And so on…

So what do you need

in order to be a good reverser?

We’ll come backto this…

Tools of the Trade

Disassembler (Static code analysis)

Debugger (Dynamic code analysis)

Hex Editor

PE Analyzer

Resource Editor

Disassemblers

The old world: Sourcer

Old ages: Sourcer

Welcome to Windows: W32DASM

The Holy Grail: IDA-Pro

Started as an Interactive Dis-Assembler, enabling user interaction with the disassembler’s decisions.

Slowly evolved into an automatic RE tool:– Built-in full-control script language– Library recognition (including user-generated)– Function prototype information

– Display– Propagate throughout the code

– Support for plug-ins– Support for Python scripting– Multi-architecture, cross-platform support– Full incorporation with built-in and external debuggers

Debuggers

באג בדיזיין –

זין בדיבאג

First, there was DEBUG…

GUI and much more: Turbo Debugger

Next major step: Soft-ICE

And finally: OllyDbg

Other Tools

Hex-Editor

PE Analyzer

Resource Editor

Methodology

How we do it?

Finding the interesting part– System calls (User mode and Kernel mode API)– Strings and constants– Dynamic loading of libraries– Provocation– Zoom-in and Zoom-out

Better and quicker (and how not to get stuck)– Iterative passes over the code– Leave no stone unturned– Macros/Scripts/Plugins– BinDiffing (manual and with tools)

Let’s play with them tools…

60 seconds on x86 registers

General purpose registers:32bit/16bit/8bit

Index registers:32bit/16bit

Segment registers:16bit

Flags:32bit/16bit

Exercise 1:Static Reversing

Exercise 1: Static Reversing

Target: a 2004 “Crack-Me”

Tools: IDA-Pro

Exercise 2:Dynamic Reversing

Exercise 2: Dynamic Reversing

Tools: OllyDbg, IDA-Pro

Exercise 3:Simple Anti-Debugging

Exercise 3: Simple Anti Debugging

Tools: OllyDbg

Reversing Malware

Malware is comprised of the following building blocks:– Infection Vector– Concealment– Operation– Communications

Check Point’s Anti-Malware Software Blade sits at the gateway

Therefore, communications interest us the most

Introducing: Spy Eye

A CrimeWare ToolKit, originating in Russia.

Used mostly for stealing financial information, but will settle for any other identity information and key logging…

Like any serious trojan, Spy Eye compresses its traffic and encrypts it

– Compression is performed using a public library (LZO)– Encryption algorithm is proprietary

Act 1:Encryption

Act 2:Configuration Download

Act 3:Another Encryption

So what do you need

in order to be a good reverser?

What makes a good reverser?

Qualities

• Patient

• Curious

• Persistent

• Outside-the-Box Thinking

• Optional: Good lookin’

Knowledge

• Assembly Language

• Some High-Level programming• Best: origin of binary

• Operating System Internals• API• Data Structures• File Structures

• Good scripting skills

• Anti-Debugging Tricks

Outside-the-Box Thinking

And remember, kids:

Binary Reverse Engineer

Which means…

Questions?

Check yourOpportunities

We are looking for: Excellent Computer Science/Software Engineering students

for a variety of developing positions Talented software developers Security & Malware researchers

To learn more about our openings please check our website: www.checkpoint.com

Thank you!

inbarr@checkpoint.com

©2012 Check Point Software Technologies Ltd. Introduction to Reverse Engineering Inbar Raz Malware...

Documents

Inbar Avron ppt

inbar&restaurant 6 2010

INBAR&restaurant 2 2011

inbar&restaurant 5 2009

©2012 Check Point Software Technologies Ltd. KillBot: Conspiracy Theories Inbar Raz hack.lu lightning talk 25 October 2012 [Protected] For public distribution

Inbar Spector SS09

INBAR Annual Report 2015

A Growing Sub-programme in INBAR - Haiti...A Growing Sub-programme in INBAR Shyam K. Paudel, Program Officer, INBAR spaudel@inbar.int Dr. Maxim Lobovikov, Programme Manager, INBAR

©2013 Check Point Software Technologies Ltd. Physical (In)security: Its not all about Cyber… Inbar Raz Malware & Security Research Manager Check Point

INBAR&restaurant 1 2011

INBAR&restaurant 4 2011

· MAT raz raz raz raz raz raz raz raz raz raz raz raz Ukupan poredak MAT 2-lige 20180/2019. UKUPNO: 830 734 550 838 836 826 456 424 376 950 926 648 UKUPNO: 1016 650 584 632 494

Philippine Innovation In Partnership With Inbar

Inbar Br No03

CODE BLUE 2014 : Physical [In]Security: It’s not ALL about Cyber by Inbar Raz

Efraim Inbar - besacenter.orgbesa.center@mail.biu.ac.il Israel Is Not Isolated Efraim Inbar 99

SBU Urban Fortress Inbar Outlets

Hoveret inbar a4mizrachi 2014

Dorit Inbar Communication and information technology exhibition & conference

Inbar Technical Report No14