analyse and binary transformation
play

Analyse and binary transformation Guillaume Bouffard Analyse and - PowerPoint PPT Presentation

Nov 03, 2022 •376 likes •779 views

Analyse and binary transformation Guillaume Bouffard Analyse and binary transformation Guillaume Bouffard Outline 1 Introduction Profiling step 2 Translation step 3 Binary Modification 4 Proof Of Concept 5 Conclusion 6 2 / 19

  1. Analyse and binary transformation Guillaume Bouffard

  2. Analyse and binary transformation Guillaume Bouffard

  3. Outline 1 Introduction Profiling step 2 Translation step 3 Binary Modification 4 Proof Of Concept 5 Conclusion 6 2 / 19 Limoges, September 8, 2010

  4. Outline Introduction 1 Technicolor My Internship Profiling step 2 3 Translation step 4 Binary Modification 5 Proof Of Concept Conclusion 6

  5. Technicolor Security and Content Protection Labs Technicolor Creating, managing and delivering video For the Communication, Media and Entertainment industries. Their works Cryptography Signal processing for security Content protection (DRM) Network security Tamper resistance 3 / 19 Limoges, September 8, 2010

  6. Context The Internship Context Illegal software duplication and intellectual property theft Software protection VS hardware protection Hardware protection? 4 / 19 Limoges, September 8, 2010

  7. Subject Binary executable without source code Search sensitive part of the binary application in a generic way Extract the sensitive piece of code Insert instructions to Translate the sensitive piece of code communicate to a dongle Protect the piece Modify binary ex- of code in a dongle ecutable without sensitive part 5 / 19 Limoges, September 8, 2010

  8. Motivation What was my motivation? A blend of compilation and smart card problems Discover the computer science underground Think on a research subject 6 / 19 Limoges, September 8, 2010

  9. Outline 1 Introduction Profiling step 2 Translation step 3 Binary Modification 4 Proof Of Concept 5 Conclusion 6

  10. Application Profiling What do you want to find? Each executed binary piece of code Found the sensitive parts What can tools do that? OProfile Valgrind 7 / 19 Limoges, September 8, 2010

  11. Outline 1 Introduction Profiling step 2 Translation step 3 Binary Modification 4 Proof Of Concept 5 Conclusion 6

  12. Translation step The Goal Protect the sensitive pieces of code in a dongle These pieces of code are executed by the dongle = > A solution: UQBT 8 / 19 Limoges, September 8, 2010

  13. Outline Introduction 1 Profiling step 2 3 Translation step 4 Binary Modification ELF Format Diablo Samples Proof Of Concept 5 Conclusion 6

  14. Executable and Linkable Format ELF header Executable and Program header table Linkable Format { Used by Unices & .text GNU/Linux Each section are .rodata linked { ... .data How can I modify this file format? Section header table 9 / 19 Limoges, September 8, 2010

  15. Executable and Linkable Format ELF header Executable and Program header table Linkable Format { Used by Unices & .text GNU/Linux Each section are .rodata linked { ... .data How can I modify this file format? Section header table 9 / 19 Limoges, September 8, 2010

  16. Diablo Linked program Map file (.map) Object files (.o) Parser Disassemble Assemble Modified binary Flowgraph Disflowgraph Some modifications 10 / 19 Limoges, September 8, 2010

  17. Brief overview of assembler #include <stdio.h> ... int main ( void ) { some value (%esp) ⇒ printf("hello world\n"); ⇒ return EXIT_SUCCESS ; (%eax) some value ⇒ } ... <main >: ⇒ mov DWORD PTR [esp],0 x8096188 ⇒ call $ ./hello_world 80486 c0 <_IO_printf > ⇒ mov eax ,0x0 hello world ⇒ leave ⇒ ret 11 / 19 Limoges, September 8, 2010

  18. Brief overview of assembler #include <stdio.h> ... int main ( void ) { some value (%esp) ⇒ printf("hello world\n"); ⇒ return EXIT_SUCCESS ; (%eax) some value ⇒ } ... <main >: ⇒ mov DWORD PTR [esp],0 x8096188 ⇒ call $ ./hello_world 80486 c0 <_IO_printf > ⇒ mov eax ,0x0 hello world ⇒ leave ⇒ ret 11 / 19 Limoges, September 8, 2010

  19. Brief overview of assembler #include <stdio.h> ... int main ( void ) { 0x8096188 (%esp) ⇒ printf("hello world\n"); ⇒ return EXIT_SUCCESS ; (%eax) some value ⇒ } ... <main >: ⇒ mov DWORD PTR [esp],0 x8096188 ⇒ call $ ./hello_world 80486 c0 <_IO_printf > ⇒ mov eax ,0x0 hello world ⇒ leave ⇒ ret 11 / 19 Limoges, September 8, 2010

  20. Brief overview of assembler #include <stdio.h> ... int main ( void ) { 0x8096188 (%esp) ⇒ printf("hello world\n"); ⇒ return EXIT_SUCCESS ; (%eax) some value ⇒ } ... <main >: ⇒ mov DWORD PTR [esp],0 x8096188 ⇒ call $ ./hello_world 80486 c0 <_IO_printf > ⇒ mov eax ,0x0 hello world ⇒ leave ⇒ ret 11 / 19 Limoges, September 8, 2010

  21. Brief overview of assembler #include <stdio.h> ... int main ( void ) { printf return value (%esp) ⇒ printf("hello world\n"); ⇒ return EXIT_SUCCESS ; (%eax) some value ⇒ } ... <main >: ⇒ mov DWORD PTR [esp],0 x8096188 ⇒ call $ ./hello_world 80486 c0 <_IO_printf > ⇒ mov eax ,0x0 hello world ⇒ leave ⇒ ret 11 / 19 Limoges, September 8, 2010

  22. Brief overview of assembler #include <stdio.h> ... int main ( void ) { printf return value (%esp) ⇒ printf("hello world\n"); ⇒ return EXIT_SUCCESS ; (%eax) some value ⇒ } ... <main >: ⇒ mov DWORD PTR [esp],0 x8096188 ⇒ call $ ./hello_world 80486 c0 <_IO_printf > ⇒ mov eax ,0x0 hello world ⇒ leave ⇒ ret 11 / 19 Limoges, September 8, 2010

  23. Brief overview of assembler #include <stdio.h> ... int main ( void ) { printf return value (%esp) ⇒ printf("hello world\n"); ⇒ return EXIT_SUCCESS ; (%eax) 0x00 ⇒ } ... <main >: ⇒ mov DWORD PTR [esp],0 x8096188 ⇒ call $ ./hello_world 80486 c0 <_IO_printf > ⇒ mov eax ,0x0 hello world ⇒ leave ⇒ ret 11 / 19 Limoges, September 8, 2010

  24. Brief overview of assembler #include <stdio.h> ... int main ( void ) { printf return value (%esp) ⇒ printf("hello world\n"); ⇒ return EXIT_SUCCESS ; (%eax) 0x00 ⇒ } ... <main >: ⇒ mov DWORD PTR [esp],0 x8096188 ⇒ call $ ./hello_world 80486 c0 <_IO_printf > ⇒ mov eax ,0x0 hello world ⇒ leave ⇒ ret 11 / 19 Limoges, September 8, 2010

  25. Brief overview of assembler #include <stdio.h> ... int main ( void ) { printf return value (%esp) ⇒ printf("hello world\n"); ⇒ return EXIT_SUCCESS ; (%eax) 0x00 ⇒ } ... <main >: ⇒ mov DWORD PTR [esp],0 x8096188 ⇒ call $ ./hello_world 80486 c0 <_IO_printf > ⇒ mov eax ,0x0 hello world ⇒ leave ⇒ ret 11 / 19 Limoges, September 8, 2010

  26. Hello World HELL int MyFunction (char *msg) bbl at 0x80481f0 (in main at 0x80481f0) { ... FILE * file = fopen 0x8048200 : movl DWORD PTR [%esp],0x8096188 ( "output" , "w" ); 0x8048207 : call 80486c0 fprintf(file,msg); fclose(file); return EXIT_SUCCESS; } _IO_printf (0x80486c0) bbl at 0x804820c (in main at 0x80481f0) 0x804820c : movl %eax,0x0 MyFunction.o 0x8048211 : leave 0x8048212 : ret EXIT HELL 12 / 19 Limoges, September 8, 2010

  27. Hello World HELL <MyFunction>: bbl at 0x80481f0 (in main at 0x80481f0) mov DWORD PTR [esp+4],0x0 ... mov DWORD PTR [esp],0x0 0x8048200 : movl DWORD PTR [%esp],0x8096188 call 16 <MyFunction+0x16> 0x8048207 : call 80486c0 mov DWORD PTR [ebp-4],eax mov eax,DWORD PTR [ebp+8] mov DWORD PTR [esp+4],eax mov eax,DWORD PTR [ebp-4] _IO_printf (0x80486c0) mov DWORD PTR [esp],eax call 2b <MyFunction+0x2b> mov eax,DWORD PTR [ebp-4] mov DWORD PTR [esp],eax bbl at 0x804820c (in main at 0x80481f0) call 36 <MyFunction+0x36> 0x804820c : movl %eax,0x0 mov eax,0x0 0x8048211 : leave leave 0x8048212 : ret ret EXIT HELL 12 / 19 Limoges, September 8, 2010

  28. Hello World HELL <MyFunction>: bbl at 0x80481f0 (in main at 0x80481f0) mov DWORD PTR [esp+4],0x0 ... mov DWORD PTR [esp],0x0 0x8048200 : movl DWORD PTR [%esp],0x8096188 call 16 <MyFunction+0x16> 0x8048207 : call 80486c0 mov DWORD PTR [ebp-4],eax mov eax,DWORD PTR [ebp+8] mov DWORD PTR [esp+4],eax mov eax,DWORD PTR [ebp-4] _IO_printf (0x80486c0) mov DWORD PTR [esp],eax call 2b <MyFunction+0x2b> mov eax,DWORD PTR [ebp-4] mov DWORD PTR [esp],eax bbl at 0x804820c (in main at 0x80481f0) call 36 <MyFunction+0x36> 0x804820c : movl %eax,0x0 mov eax,0x0 0x8048211 : leave leave 0x8048212 : ret ret EXIT HELL 12 / 19 Limoges, September 8, 2010

  29. CouCou World HELL ELF header bbl at 0x80481f0 (in main at 0x80481f0) ... 0x8048200 : movl DWORD PTR [%esp],0x8096188 Program header table 0x8048207 : call 80486c0 .text MyFunction .rodata ... bbl at 0x804820c (in main at 0x80481f0) 0x804820c : movl %eax,0x0 .data 0x8048211 : leave 0x8048212 : ret Section header table EXIT HELL 13 / 19 Limoges, September 8, 2010

  30. CouCou World HELL ELF header bbl at 0x80481f0 (in main at 0x80481f0) ... 0x8048200 : movl DWORD PTR [%esp],0x8096188 Program header table 0x8048207 : call 80486c0 .text MyFunction .rodata ... bbl at 0x804820c (in main at 0x80481f0) 0x804820c : movl %eax,0x0 .data 0x8048211 : leave 0x8048212 : ret Section header table EXIT HELL 13 / 19 Limoges, September 8, 2010

Recommend

Binary Numbers Binary numbers look like this Binary Numbers or Binary Code Binary numbers or

Binary Numbers Binary numbers look like this Binary Numbers or Binary Code Binary numbers or

Binary Numbers Binary numbers look like this Binary Numbers or Binary Code Binary numbers or binary code are used by computers and digital devices to talk to each other. It is used to give commands to the computer or a way to enter data

165 views • 12 slides
Annotations des gnomes Analyse du transcriptome Analyse des voies mtaboliques Jacques van

Annotations des gnomes Analyse du transcriptome Analyse des voies mtaboliques Jacques van

JGB71E - Bioinformatique applique Annotations des gnomes Analyse du transcriptome Analyse des voies mtaboliques Jacques van Helden Jacques.van-Helden@univ-amu.fr Aix-Marseille Universit, France Technological Advances for Genomics and

886 views • 75 slides
The Power of Binary 0, 1, 10, 11, 100, 101, 110, 111... What is Binary? a binary number

The Power of Binary 0, 1, 10, 11, 100, 101, 110, 111... What is Binary? a binary number

The Power of Binary 0, 1, 10, 11, 100, 101, 110, 111... What is Binary? a binary number is a number expressed in the binary numeral system, or base-2 numeral system, which represents numeric values using two different symbols: typically

485 views • 19 slides
LECTURE 2 Review 1 Binary Math and Assembly BINARY MATH In this section, we review Binary

LECTURE 2 Review 1 Binary Math and Assembly BINARY MATH In this section, we review Binary

LECTURE 2 Review 1 Binary Math and Assembly BINARY MATH In this section, we review Binary to decimal conversions and vice versa IEEE 754 Floating point representations Binary Arithmetic Decimal representation of binary numbers

1.66k views • 118 slides
Binary There are 10 types of people in the world those that understand binary and those

Binary There are 10 types of people in the world those that understand binary and those

Binary There are 10 types of people in the world those that understand binary and those that dont. What is binary? You and I write numbers like this: twelve is 12, sixty eight is 68, and one hundred is 100 Binary is a number

525 views • 26 slides
CHAPTER 11: MODEL TRANSFORMATION Transformation Definition Transformation Tool 2 Agenda

CHAPTER 11: MODEL TRANSFORMATION Transformation Definition Transformation Tool 2 Agenda

Architecture and Modelling of Information Systems (D0I71A) Prof. dr. Monique Snoeck CHAPTER 11: MODEL TRANSFORMATION Transformation Definition Transformation Tool 2 Agenda Model Transformations General approach Transformation

985 views • 59 slides
5/10/20 L.O To analyse the main reasons for the Greek victory -I can identify certain techniques

5/10/20 L.O To analyse the main reasons for the Greek victory -I can identify certain techniques

5/10/20 L.O To analyse the main reasons for the Greek victory -I can identify certain techniques the Greek's used during battle L.O To analyse the main reasons for the Greek victory 5/10/20 Starter Who was Alexander the great? L.O To analyse

613 views • 40 slides
A Quick Review Decimal to binary Binary to decimal Binary to hexadecimal

A Quick Review Decimal to binary Binary to decimal Binary to hexadecimal

A Quick Review Decimal to binary Binary to decimal Binary to hexadecimal Hexadecimal to binary Hexadecimal to Decimal Binary addition Binary subtraction Binary shift Decimal to Binary 146d = ????????b 146/2

91 views • 7 slides
Binary Numbers Calculate your age Binary &amp; decimal differences In binary 1 represents

Binary Numbers Calculate your age Binary &amp; decimal differences In binary 1 represents

Binary Numbers Calculate your age Binary &amp; decimal differences In binary 1 represents on Fun Facts Why 10 digits? Because and the 0 represents off people typically have 10 fingers and 10 toes, making it easy for counting! 2

119 views • 10 slides
Analyse statique de programmes num eriques avec calculs flottants eme Rencontres Arithm 4 `

Analyse statique de programmes num eriques avec calculs flottants eme Rencontres Arithm 4 `

Analyse statique de programmes num eriques avec calculs flottants eme Rencontres Arithm 4 ` etique de lInformatique Math ematique Antoine Min e Ecole normale sup erieure 9 f evrier 2011 Perpignan 9/02/2011 Analyse

896 views • 70 slides
Composing Transformation Composing Transformation Composing Transformation the process of

Composing Transformation Composing Transformation Composing Transformation the process of

Composing Transformation Composing Transformation Composing Transformation the process of applying Matrix multiplication is associative several transformation in succession to form one M3 x M2 x M1 = (M3 x M2) x M1 = M3 x (M2 x

485 views • 9 slides
Binary Tree Iterators and Properties Displayable Binary Trees Displayable Binary Trees (next

Binary Tree Iterators and Properties Displayable Binary Trees Displayable Binary Trees (next

Binary Tree Iterators and Properties Displayable Binary Trees Displayable Binary Trees (next assignment) DE DEPARTMENT OF OF COM OMPUTER S SCIENCE &amp; &amp; SO SOFTW TWARE RE E ENGINEERI RING PI PICN CNIC SA SATU TURD RDAY

709 views • 41 slides
On-line Multi-label Classification A Problem Transformation Approach Jesse Read Supervisors:

On-line Multi-label Classification A Problem Transformation Approach Jesse Read Supervisors:

On-line Multi-label Classification A Problem Transformation Approach Jesse Read Supervisors: Bernhard Pfahringer, Geoff Holmes Hamilton, New Zealand Outline Multi-label Classification Problem Transformation Binary Method

885 views • 51 slides
FCE,CAE and CPE levels Aims of the workshop Analyse the process involved in marking students

FCE,CAE and CPE levels Aims of the workshop Analyse the process involved in marking students

Assessing Writing at FCE,CAE and CPE levels Aims of the workshop Analyse the process involved in marking students pieces of writing. Analyse assessment criteria and glossary. Practise assessing with samples of students work.

315 views • 27 slides
Binary Search Trees A binary search tree is a binary tree T such that - each internal node

Binary Search Trees A binary search tree is a binary tree T such that - each internal node

AVL T REES Binary Search Trees AVL Trees AVL Trees 1 Binary Search Trees A binary search tree is a binary tree T such that - each internal node stores an item (k, e) of a dictionary. - keys stored at nodes in the left subtree of

547 views • 26 slides
Binary trees Binary trees David Morgan Binary trees Binary trees elements have up to 2

Binary trees Binary trees David Morgan Binary trees Binary trees elements have up to 2

Binary trees Binary trees David Morgan Binary trees Binary trees elements have up to 2 child elements left child sorts less, right more, than parent tree has a depth tree has a balance, comparing depths of its left and right

305 views • 5 slides
Ecological transformation When ecological knowledge and transformation in the social

Ecological transformation When ecological knowledge and transformation in the social

Ecological transformation When ecological knowledge and transformation in the social practices as the goal of environmental studies ------- Ecological transformation is best understood as an ongoing process of wide-ranging

637 views • 48 slides
Negative Numbers and Binary operations Eric McCreath Binary Addition Adding binary numbers is

Negative Numbers and Binary operations Eric McCreath Binary Addition Adding binary numbers is

Negative Numbers and Binary operations Eric McCreath Binary Addition Adding binary numbers is very similar to how you would add large decimal numbers in primary school It involves positioning the numbers such that the columns line up in their

562 views • 10 slides
Binary Trees Parts of a binary tree A binary tree is composed of zero or more nodes Each

Binary Trees Parts of a binary tree A binary tree is composed of zero or more nodes Each

Binary Trees Parts of a binary tree A binary tree is composed of zero or more nodes Each node contains: A value (some sort of data item) A reference or pointer to a left child (may be null ), and A reference or pointer to a

653 views • 14 slides
Binary Numbers 723 Binary Numbers 723 = 7x100 + 2x10 + 3x1 Binary Numbers 723 = 7x100 + 2x10 +

Binary Numbers 723 Binary Numbers 723 = 7x100 + 2x10 + 3x1 Binary Numbers 723 = 7x100 + 2x10 +

Binary Numbers 723 Binary Numbers 723 = 7x100 + 2x10 + 3x1 Binary Numbers 723 = 7x100 + 2x10 + 3x1 = 7x10 2 + 2x10 1 + 3x10 0 Binary Numbers 5349 = 5x10 3 + 3x10 2 + 4x10 1 + 9x10 0 Binary Numbers Why base 10? Binary Numbers 257 (base 8)

1.23k views • 75 slides
Extending Binary Linear Classification One-Versus-All Classification (OVA) } In the presence of

Extending Binary Linear Classification One-Versus-All Classification (OVA) } In the presence of

Binary and Other Classification } We will generally discuss binary classifiers, which divide data into one of two classes } Linear classifiers as presented in last lecture are inherently binary, defining the classes based on two regions,

336 views • 7 slides
Design of an experimental set-up to analyse compliant mechanisms used for the deployment of a

Design of an experimental set-up to analyse compliant mechanisms used for the deployment of a

I NTRODUCTION S ET - UP FE MODEL I DENTIFICATION V ALIDATION C ONCLUSIONS Design of an experimental set-up to analyse compliant mechanisms used for the deployment of a panel Florence Dewalque, Olivier Brls Department of Aerospace and

383 views • 22 slides
Abstract: This paper will analyse the different ways by which law has been mapped, modelled and

Abstract: This paper will analyse the different ways by which law has been mapped, modelled and

Abstract: This paper will analyse the different ways by which law has been mapped, modelled and graphically represented in rela9on to and within the context of the internetworked society. Star9ng with Lawrence Lessig's illustra9on of the

275 views • 13 slides
(Binary code is a series of digits, that are either ones or zeros. Each digit is called a

(Binary code is a series of digits, that are either ones or zeros. Each digit is called a

Welcome back! In the last session, we started to look at computers and coding, and explored the computer language binary. Can anyone remember what binary code looks like? (Binary code is a series of digits, that are either ones or zeros.

402 views • 25 slides

More recommend