https://drive.google.com/open?id=152zyh8NsPD3razOdgm5AY4QTzHTHTPCJ NCRISC (2nd National Conference on Recent innovation in Software and Computer 2018) Introduction and importance of reverse engineering in security related issues with the help of examples and exploit development references and learning resources for beginners.

1. National Conference on Recent Innovation in Software and Computer (NCTISC-2018)
March 10-11, 2018, Jaipur
1
Software Reverse Engineering In Security Context
Authored by:
Presented by:
Affiliation:
Venue: ARYA COLLEGE OF ENGG. & I.T. , Jaipur

2. National Conference on Recent Innovation in Software and Computer (NCTISC-2018)
March 10-11, 2018, Jaipur
Introduction
• Software Reverse Engineering is a research process aimed to discover the
functioning principles (mostly the hidden ones) of a software over a specific
hardware or on the targeted platform (Windows, *nix, etc.) .
• Software reversing is used in maintenance, Malware analysis, vulnerability and
patch analysis, exploit development, application
compatibility/interoperability research, or creating a new software with same
functioning principles without copying the original one.
• Software Reverse Engineering can provide a differentiating business approach,
which saves almost all types of resources and rest of project time opens much
broader functional opportunities for development teams.
• In the United States, India and many other countries even if an artifact or process is
protected by trade secrets, reverse-engineering the artifact or process is often lawful
as long as it has been legitimately obtained.
2

3. National Conference on Recent Innovation in Software and Computer (NCTISC-2018)
March 10-11, 2018, Jaipur
Objective(s)
• Literature Review
• General Architecture of a Microprocessor
• Registers
• Memory Management
• Prologue and Epilogue in Assembly Language (IA-32)
• Tools
• Static Analysis
• Dynamic Analysis
• Applications of Software Reverse Engineering
• Legal
• Illegal
• Example
• Security Mitigations
3

4. National Conference on Recent Innovation in Software and Computer (NCTISC-2018)
March 10-11, 2018, Jaipur
General Architecture of a Microprocessor
Registers : Microprocessor
use these general purpose and
special registers for temporary
holding the data/values
loaded from memory for
operation execution.
4

5. National Conference on Recent Innovation in Software and Computer (NCTISC-2018)
March 10-11, 2018, Jaipur
General Architecture of a Microprocessor
Memory Management :
Microprocessor uses memory
segments (Stack, Heap,
program image) during
program's execution which
may differ according to the
host systems like windows,
where process environment
block (PEB) is additionally
used to keep data structures
applies to whole process.
5

6. National Conference on Recent Innovation in Software and Computer (NCTISC-2018)
March 10-11, 2018, Jaipur
Prologue and Epilogue in Assembly Language (example)
C/C++
// code example in C language.
int square(int num)
{
return num * num;
}
Assembly Language
square(int):
push rbp ; saving RBP to stack (prologue)
mov rbp, rsp ; setting new RBP (prologue)
mov DWORD PTR [rbp-4], edi ; args (num)
mov eax, DWORD PTR [rbp-4]
imul eax, DWORD PTR [rbp-4]
pop rbp ; loads RBP original value (epilogue )
ret ; returns to previous location (epilogue)
6

7. National Conference on Recent Innovation in Software and Computer (NCTISC-2018)
March 10-11, 2018, Jaipur
Tools (Static Analysis)
Dissembler is a computer program that translates machine language into assembly
language—the inverse operation to that of an assembler.
Examples -
• Interactive Disassembler (IDA)
• OllyDbg is a 32-bit assembler level analyzing debugger
• Radare2
• Objdump
7

8. National Conference on Recent Innovation in Software and Computer (NCTISC-2018)
March 10-11, 2018, Jaipur
Tools (Dynamic Analysis)
Debuggers offers more sophisticated functions compared to disassemblers such as:
• Running a program step by step (single-stepping).
• Stopping (breaking) (pausing the program to examine the current state)by means of a
breakpoint.
• Tracking the values of variables(registers).
• Some debuggers have the ability to modify program state while it is running.
• It may also be possible to continue execution at a different location in the program to bypass
a crash or logical error.
• The same functionality which makes a debugger useful for eliminating bugs allows it to be
used as a software cracking tool to evade copy protection, digital rights management, and
other software protection features.
8

9. National Conference on Recent Innovation in Software and Computer (NCTISC-2018)
March 10-11, 2018, Jaipur
Applications (legal)
• Functioning principle Advancements
• Application Analysis
• Malware Analysis
• Interoperability Analysis
• Vulnerability Analysis
• Exploit Development for research or testing purpose (after public disclosure of
vulnerability)
9

10. National Conference on Recent Innovation in Software and Computer (NCTISC-2018)
March 10-11, 2018, Jaipur
Applications (illegal)
• Patching software to defeat copy protection
• Key-Generator development
• Advanced Malwares, viruses, trojan horses or any other type of malicious
applications.
10

11. National Conference on Recent Innovation in Software and Computer (NCTISC-2018)
March 10-11, 2018, Jaipur
Example (exploit development)
• Verify bug (fuzzing)
• Calculate offset for Instruction pointer register (EIP)
• Search for reliable jmp/call instruction pointing to our input data
• Check for bad characters ( 0x00, …...... , 0xFF )
• Write/Generate shellcode (encode if required)
• Add few NOP instructions (0x90) between EIP offset and shellcode, provides extra
space in memory for shellcode decoding without truncating itself.
• Deploy and test exploit
11

12. National Conference on Recent Innovation in Software and Computer (NCTISC-2018)
March 10-11, 2018, Jaipur
Security Mitigations
Security mitigations can be added during SDLC for securing applications, off course
these can be bypassed but they minimizes the risks of remote code execution (RCE) in
the developed application.
Examples -
• Address space layout randomization (ASLR).
• Data execution prevention (DEP).
• Canaries (canary words) are known values that are placed between a buffer and
control data on the stack to monitor buffer overflows.
12

13. National Conference on Recent Innovation in Software and Computer (NCTISC-2018)
March 10-11, 2018, Jaipur
Conclusion
• Reverse engineering is more like offense for better defense.
• Analysis of applications helps us to understand working of mitigation techniques.
• The accuracy and amount of information that can be deduced varies, but it is
certainly possible to obtain functioning principles concepts.
• Reverse-engineering is used for many purposes, as a learning tool, as a way to
make new, compatible products, cheaper than what's currently on the market.
• software interoperability or to bridge data between different operating systems or
databases.
• Analysis of different malicious applications (malware, ransomwares, etc.).
• Tracing malicious applications back to its source.
13

14. National Conference on Recent Innovation in Software and Computer (NCTISC-2018)
March 10-11, 2018, Jaipur
References
• Books:
• Reverse Engineering for Beginners by Dennis Yurichev
• Reversing: Secrets of Reverse Engineering by Eldad Eilam
• Sites:
• Wikipedia
• Corelan Team
14

15. National Conference on Recent Innovation in Software and Computer (NCTISC-2018)
March 10-11, 2018, Jaipur
15
Queries ? ? ? ?