Palestra realizada por Raphael Prudencio aka raph0x88 durante a 2a. edição da Nullbyte Security Conference em 21 de novembro de 2015. Resumo: Cada binário é uma história diferente e toda história pode ser reescrita, ao subverter o fluxo de um binário é possível alterar a sua história para satisfazer as necessidades mais obscuras. Veremos como adulterar um binário é uma tarefa relativamente simples, com bypass de técnicas de proteção e ao estilo “Cracking for fun and profit”!

1. RAPHAEL SANCHEZ PRUDENCIO
(RAPH0X88)
RSPRUDENCIO@GMAIL.COM

2. DISCLAIMER
ALL THE INFORMATION PROVIDED ON THIS TALK ARE FOR EDUCATIONAL PURPOSES ONLY.
THE AUTHOR IS NOT RESPONSIBLE FOR ANY MISUSE OF THE INFORMATION!

3. MOTIVATION
• REVERSE ENGINEERING ROCKS
• YOUR COMPUTER, YOUR RULES
• AND ABOVE ALL, CURIOSITY!
• JUST TO CLARIFY, NOT A TYPO!
• AT LEAST NOT MY TYPO
• INSPIRED IN ZERO WING FAMOUS MISTRANSLATION MEME

4. OLLYDBG
• OLLYDBG IS A 32-BIT ASSEMBLER LEVEL ANALYZING DEBUGGER FOR WINDOWS.
• PRETTY USEFUL TOOL FOR DEBUGGING ON WINDOWS
• SUPPORTS PLUGINS, WHICH CAN EXTEND IT’S FEATURES

5. DEMO TIME!

6. ANTI-DEBUG
• TOO MANY TECHNIQUES TO DESCRIBE ALL
• DEBUGGER DETECTION
• NTSETINFORMATIONTHREAD - THREADHIDEFROMDEBUGGER
• ISDEBUGGERPRESENT
• TIMING HOOKS
• GETTICKCOUNT
• NTQUERYPERFORMANCECOUNTER
• BREAKPOINT DETECTION
• GETTHREADCONTEXT
• INT3 (0XCC) AND INT 3 (0XCD03)
• …

7. ANTI-DISASSEMBLE
• JUNK CODE
• OVERLAPPING INSTRUCTIONS
• CALL/RET ABUSE
• SELF-MODIFYING CODE
• …

9. ANTI-ANTI-DEBUG/DISASM
• PLENTY OF OPTIONS!
• USER SPACE
• SCYLLAHIDE
• KERNEL SPACE
• TITANHIDE

10. DEMO TIME!

11. ENCODER /* Parte 1 */
tmp = (data2 << 4) ^ (data2 >> 5);
tmp += data2;
j = local2 & 3;
tmp2 = c[j] + local2;
data1 += (tmp ^ tmp2);
/* Atualiza local2 */
local2 += local3;
/* Parte 2 */
tmp = (data1 << 4) ^ (data1 >> 5);
tmp += data1;
j = (local2 >> 0xb) & 3;
tmp2 = c[j] + local2;
data2 += (tmp ^ tmp2);

12. DEMO TIME!

13. ROGUE AUTH
$state = $_GET["state"];
$name = $_GET["name"];
$pass = $_GET["pass"];
if ($state == "syn") {
$session = md5(time());
if (strpos($name,'nullbyte') !== false) {
print "ack|" . $session;
} else {
print "bad|Invalid username or password!";
}
} elseif ($state == "synack") {
$what1 = md5(time());
$what2 = md5(time() + 1);
print "good|" . $what1 . "|" . $what2 .
"|ALL YOUR B1N4R13S ARE BELONG TO US!!!";
}

14. QUESTIONS?

15. THANK YOU!

16. BUT
REMEMBER…

17. DON’T
TO THIS AT
HOME!!!