NOPcon 2016

1. THE POSTMODERN BINARY ANALYSIS
Onur ALANBEL

2. $ id -un
➤ Computer Engineer (IZTECH)
➤ Developer @TaintAll (taintall.com)
➤ AppSec Researcher
➤ Blog: onuralanbel.pro
➤ @onuralanbel
➤ https://packetstormsecurity.com/search/?q=onur+alanbel

3. AGENDA
➤ Dynamic Binary Instrumentation
➤ Taint Analysis
➤ Constraint Solving With Z3
➤ Symbolic/Concolic Execution

4. DYNAMIC BINARY INSTRUMENTATION
➤ Inject instrumentation code into a
running binary.

5. DYNAMIC BINARY INSTRUMENTATION
➤ Inject instrumentation code into a
running binary.
➤ Instrumentation code executes as
normal instructions.

6. DYNAMIC BINARY INSTRUMENTATION
➤ Inject instrumentation code into a
running binary.
➤ Instrumentation code executes as
normal instructions.
➤ Instrumentation is transparent to
the application.

7. DBI FRAMEWORKS
➤ Intel PIN Framework
➤ Win, Lin, OS X
➤ No IL

8. DBI FRAMEWORKS
➤ Intel PIN Framework
➤ Win, Lin, OS X
➤ No IL
➤ Valgrind
➤ Lin, OS X
➤ IL

9. DBI FRAMEWORKS
➤ Intel PIN Framework
➤ Win, Lin, OS X
➤ No IL
➤ Valgrind
➤ Lin, OS X
➤ IL
➤ DynamoRIO
➤ Win, Lin, Android
➤ No IL

10. DBI FRAMEWORKS
➤ Intel PIN Framework
➤ Win, Lin, OS X
➤ No IL
➤ Valgrind
➤ Lin, OS X
➤ IL
➤ DynamoRIO
➤ Win, Lin, Android
➤ No IL
➤ May be others like
➤ PEMU
➤ …

11. INSTRUCTION COUNTING

12. SIMPLE SIDE CHANNEL ATTACK

13. CAN WE DO BETTER?
➤ Use snapshots instead of Re-run

14. CAN WE DO BETTER?
➤ Use snapshots instead of Re-run
➤ Use multi-threading

15. CAN WE DO BETTER?
➤ Use snapshots instead of Re-run
➤ Use multi-threading
➤ What about doing something smarter?

16. TAINT ANALYSIS
➤ Which parts of the code can be controlled or affected by
tainted data (usually user input)

17. TAINT ANALYSIS
➤ Which parts of the code can be controlled or affected by
tainted data (usually user input)

18. TAINT ANALYSIS
taint RAX

19. TAINT ANALYSIS
taint RAX
mov RCX, RAX

20. TAINT ANALYSIS
taint RAX
mov RCX, RAX
push RCX

21. TAINT ANALYSIS
taint RAX
mov RCX, RAX
push RCX
…….
mov RCX, ptr [0x1234]

22. TAINT ANALYSIS
taint RAX
mov RCX, RAX
push RCX
…….
mov RCX, ptr [0x1234]
pop RBX

23. TAINT ANALYSIS
taint RAX
mov RCX, RAX
push RCX
…….
mov RCX, ptr [0x1234]
pop RBX
stop tainting

24. TAINT ANALYSIS
taint RAX
mov RCX, RAX
push RCX
…….
mov RCX, ptr [0x1234]
pop RBX
stop tainting
Which are the tainted regs?

25. TAINT ANALYSIS
taint RAX
mov RCX, RAX
push RCX
…….
mov RCX, ptr [0x1234]
pop RBX
stop tainting
Which are the tainted regs?
Which are the tainted mems?

26. TAINT ANALYSIS
taint RAX
mov RCX, RAX
push RCX
…….
mov RCX, ptr [0x1234]
pop RBX
stop tainting
Which are the tainted regs?
Which are the tainted mems?
RAX, RBX and 8 addresses
from the stack

27. TAINT ANALYSIS
taint RAX
mov AL, 0x1

28. TAINT ANALYSIS
taint RAX
mov AL, 0x1
mov ECX, EAX

29. TAINT ANALYSIS
taint RAX
mov AL, 0x1
mov ECX, EAX
cmp ECX, EBX

30. TAINT ANALYSIS
taint RAX
mov AL, 0x1
mov ECX, EAX
cmp ECX, EBX
jz 0x4321

31. TAINT ANALYSIS
taint RAX
mov AL, 0x1
mov ECX, EAX
cmp ECX, EBX
jz 0x4321
Can we control this branch?

32. TAINT ANALYSIS
taint RAX
mov AL, 0x1
mov ECX, EAX
cmp CL, BL
jz 0x4321
What about this one?

33. TAINT ANALYSIS
taint RAX
mov AL, 0x1
mov ECX, EAX
cmp CL, BL
jz 0x4321
What about this one?
taint RCX
xor RCX, RDX

34. TAINT ANALYSIS
taint RAX
mov AL, 0x1
mov ECX, EAX
cmp CL, BL
jz 0x4321
What about this one?
taint RCX
xor RCX, RDX
add RAX, RCX

35. TAINT ANALYSIS
taint RAX
mov AL, 0x1
mov ECX, EAX
cmp CL, BL
jz 0x4321
What about this one?
taint RCX
xor RCX, RDX
add RAX, RCX
Should RAX be tainted?

36. TAINT ANALYSIS
taint RAX
mov AL, 0x1
mov ECX, EAX
cmp CL, BL
jz 0x4321
What about this one?
taint RCX
xor RCX, RCX
mov RAX, RCX
Now, should be ?

37. TAINT ANALYSIS
➤ With the help of PIN’s Inspection API (TaintAll)

38. TAINT ANALYSIS
➤ With the help of PIN’s Inspection API (TaintAll)
➤ With the help of Symbolic Execution (Triton Framework)

39. TAINT ANALYSIS
➤ With the help of PIN’s Inspection API (TaintAll)
➤ With the help of Symbolic Execution (Triton Framework)
➤ Using an Intermediate Language (TaintGrind)

40. TAINT ANALYSIS WITH TRITON
Triton/src/examples/pin/
runtime_memory_tainting.py
with a little modification

41. TAINT ANALYSIS WITH TRITON
Triton/src/examples/pin/
runtime_memory_tainting.py
with a little modification

42. A LITTLE BIT OF Z3
➤ “Z3 is a state-of-the art theorem prover from Microsoft
Research”

43. A LITTLE BIT OF Z3
➤ “Z3 is a state-of-the art theorem prover from Microsoft
Research”
➤ Input format is an extension of SMT-LIB 2.0 standard

44. A LITTLE BIT OF Z3
➤ “Z3 is a state-of-the art theorem prover from Microsoft
Research”
➤ Input format is an extension of SMT-LIB 2.0 standard

45. A LITTLE BIT OF Z3
➤ “Z3 is a state-of-the art theorem prover from Microsoft
Research”
➤ Input format is an extension of SMT-LIB 2.0 standard
➤ Or use Z3Py

47. For a real world example
Search: “Reversing the petya
ransomware with constraint solvers”

48. SYMBOLIC EXECUTION
➤ x = input()
y = x * 5
if x < 20:
print “ok”
else:
print “nope”

49. SYMBOLIC EXECUTION
➤ x = input()
y = x * 5
if x < 20:
print “ok”
else:
print “nope”
y=sym_x*5
sym_x
x < 20
ok nope

50. CONCRETE EXECUTION
➤ x = input()
y = x * 5
if x < 20:
print “ok”
else:
print “nope”
y=sym_x*5
sym_x
x < 20
ok nope

51. CONCOLIC EXECUTION
➤ x = input()
y = x * 5
if x < 20:
print “ok”
else:
print “nope”
y=sym_x*5
sym_x
x < 20
ok nope

53. OPEN SOURCE DBA FRAMEWORKS/TOOLS
➤ Triton
➤ Angr
➤ BitBlaze TEMU
➤ Valgrind Tools
➤ PIN Tools

54. REFERENCES
➤ http://uninformed.org/index.cgi?v=7&a=1&p=3
➤ https://software.intel.com/sites/landingpage/pintool/docs/
76991/Pin/html/
➤ http://smtlib.cs.uiowa.edu/solvers.shtml