Qualitative and Quantitative Evaluation of Software Packers Mar´ ıa Baz´ ıguez , Jos´ us, Ricardo J. Rodr´ e Merseguer � All wrongs reversed rjrodriguez@unizar.es ※ @RicardoJRdez ※ www.ricardojrodriguez.es Department of Computer Science and Systems Engineering University of Zaragoza, Spain December 12, 2015 NoConName 2015 Barcelona (Spain)
$ whoami Ph.D. on Comp. Sci. (Univ. of Zaragoza, Spain) (2013) Assistant Professor at University of Zaragoza Performance analysis on critical, complex systems Secure Software Engineering Advance malware analysis RFID/NFC Security Not prosecuted ¨ ⌣ Speaker at NcN, HackLU, RootedCON, STIC CCN-CERT, HIP , MalCON, HITB. . . M. Baz´ us, R.J. Rodr´ ıguez, J. Merseguer Qualitative and Quantitative Evaluation of Software Packers NcN 2015 2 / 39
Agenda Introduction 1 Contributions and Related Work 2 Previous Concepts 3 Software Protection Taxonomy 4 Software Packers Under Study 5 Qualitative and Quantitative Evaluation 6 Qualitative Evaluation Quantitative Evaluation Conclusions and Future Work 7 M. Baz´ us, R.J. Rodr´ ıguez, J. Merseguer Qualitative and Quantitative Evaluation of Software Packers NcN 2015 3 / 39
Agenda Introduction 1 Contributions and Related Work 2 Previous Concepts 3 Software Protection Taxonomy 4 Software Packers Under Study 5 Qualitative and Quantitative Evaluation 6 Qualitative Evaluation Quantitative Evaluation Conclusions and Future Work 7 M. Baz´ us, R.J. Rodr´ ıguez, J. Merseguer Qualitative and Quantitative Evaluation of Software Packers NcN 2015 4 / 39
Introduction (I): Reverse Engineering WTF? To analyse a binary program with machine-code vision Types of analysis: Static analysis ( ⇓ not executed, ⇑ all paths explored) Dynamic analysis ( ⇑ truly executed, ⇓ but just one path explored!) M. Baz´ us, R.J. Rodr´ ıguez, J. Merseguer Qualitative and Quantitative Evaluation of Software Packers NcN 2015 5 / 39
Introduction (I): Reverse Engineering WTF? To analyse a binary program with machine-code vision Types of analysis: Static analysis ( ⇓ not executed, ⇑ all paths explored) Dynamic analysis ( ⇑ truly executed, ⇓ but just one path explored!) RE uses: legitimate and illegitimate � Find software bugs � Get interoperability with legacy systems � Detect malicious software X Detect vulnerabilities to create/spread malware X Obtain (or avoid) software license duplication M. Baz´ us, R.J. Rodr´ ıguez, J. Merseguer Qualitative and Quantitative Evaluation of Software Packers NcN 2015 5 / 39
Introduction (II): RE Tools Dynamic analysis Debuggers Static analysis Trace execution Disassemblers Breakpoints Decompilers View internal data Dumpers M. Baz´ us, R.J. Rodr´ ıguez, J. Merseguer Qualitative and Quantitative Evaluation of Software Packers NcN 2015 6 / 39
Introduction (III): Anti-RE Techniques Definition, pros and cons of software packers Avoidance techniques for static and dynamic analysis into binaries Make RE tasks harder On the contrary, they have a strong impact on binary performance: execution time, memory consumption M. Baz´ us, R.J. Rodr´ ıguez, J. Merseguer Qualitative and Quantitative Evaluation of Software Packers NcN 2015 7 / 39
Introduction (III): Anti-RE Techniques Definition, pros and cons of software packers Avoidance techniques for static and dynamic analysis into binaries Make RE tasks harder On the contrary, they have a strong impact on binary performance: execution time, memory consumption They are used for. . . Binary protection before distribution (to keep the intellectual (?) property) Avoid a malware to be positively detected as malicious by an anti-virus M. Baz´ us, R.J. Rodr´ ıguez, J. Merseguer Qualitative and Quantitative Evaluation of Software Packers NcN 2015 7 / 39
Introduction (IV): Software Packers Software packer: What is it? Tools for binary protection (legitimately) Once upon a time. . . : just compressors They evolve to protectors, including anti-RE techniques Normally used in Windows environments M. Baz´ us, R.J. Rodr´ ıguez, J. Merseguer Qualitative and Quantitative Evaluation of Software Packers NcN 2015 8 / 39
Introduction (V): Software Packers How do they “protect” a binary? Packed executable = Original executable + unpacking routine Ejecutable Original Ejecutable Empacado Rutina desempacado Protector + (Rutina empacado) Ejecutable Original M. Baz´ us, R.J. Rodr´ ıguez, J. Merseguer Qualitative and Quantitative Evaluation of Software Packers NcN 2015 9 / 39
Introduction (V): Software Packers How do they “protect” a binary? Packed executable = Original executable + unpacking routine Ejecutable Original Ejecutable Empacado Rutina desempacado Protector + (Rutina empacado) Ejecutable Original How are they reversed? Find unpacking routine end ⇒ dump binary from memory to disk! M. Baz´ us, R.J. Rodr´ ıguez, J. Merseguer Qualitative and Quantitative Evaluation of Software Packers NcN 2015 9 / 39
Introduction (VI): Main Goals Analysing a bunch of software packers for. . . Create a taxonomy of protection techniques Create a benchmark for testing Evaluate the selected packers: Qualitatively: protection strength Quantitatively: reliability and performance M. Baz´ us, R.J. Rodr´ ıguez, J. Merseguer Qualitative and Quantitative Evaluation of Software Packers NcN 2015 10 / 39
Agenda Introduction 1 Contributions and Related Work 2 Previous Concepts 3 Software Protection Taxonomy 4 Software Packers Under Study 5 Qualitative and Quantitative Evaluation 6 Qualitative Evaluation Quantitative Evaluation Conclusions and Future Work 7 M. Baz´ us, R.J. Rodr´ ıguez, J. Merseguer Qualitative and Quantitative Evaluation of Software Packers NcN 2015 11 / 39
Related Work ∄ comparative analysis of current software packers Automation of malware unpacking ([RHD + 06], [KPY07], [MCJ07],[GFC08], [JCL + 10]) Using DBI to analyse malware ([RAG16]) Closest work: performance of software packers in Linux embedded systems ([KLC + 10]) Contributions Taxonomy of software packers Current software packers evaluation Qualitatively: protection strengths Quantitatively: reliability and performance (exec. time, memory consumption, binary size) M. Baz´ us, R.J. Rodr´ ıguez, J. Merseguer Qualitative and Quantitative Evaluation of Software Packers NcN 2015 12 / 39
Agenda Introduction 1 Contributions and Related Work 2 Previous Concepts 3 Software Protection Taxonomy 4 Software Packers Under Study 5 Qualitative and Quantitative Evaluation 6 Qualitative Evaluation Quantitative Evaluation Conclusions and Future Work 7 M. Baz´ us, R.J. Rodr´ ıguez, J. Merseguer Qualitative and Quantitative Evaluation of Software Packers NcN 2015 13 / 39
Previous Concepts (I): PE Header What is it? Windows standard format for binaries (.exe, .dll, .sys, . . . ) Header (characteristics) + Sections (data & code) Cabecera DOS MZ Cabecera PE DOS Header: Tabla de secciones e lfnew offset to PE Header Secciones PE Header: Sección 1 ImageBase … AddressOfEntryPoint DataDirectory[1] Sección n M. Baz´ us, R.J. Rodr´ ıguez, J. Merseguer Qualitative and Quantitative Evaluation of Software Packers NcN 2015 14 / 39
Previous Concepts (II): Loading Process En9Memoria Cabecera9DOS9MZ Cabecera9PE Tabla9de9secciones Secciones En9Disco Sección91 RUTINA9DESEMPACADO Cabecera9DOS9MZ … Cabecera9PE Tabla9de9secciones Sección9 n Secciones Cabecera9DOS9MZ Cabecera9PE Sección91 Tabla9de9secciones RUTINA9DESEMPACADO … Secciones Sección9 n AOABA8B9A4A3E857016B00CF19A50B Sección91 ……. … 57016B00CF19A50BAOABA8B9A4A3A0 Sección9 n M. Baz´ us, R.J. Rodr´ ıguez, J. Merseguer Qualitative and Quantitative Evaluation of Software Packers NcN 2015 15 / 39
Previous Concepts (III): Import Address Table IMAGE_OPTIONAL_HEADER IMAGE_OPTIONAL_HEADER En Memoria … (Sobreescrito por el DataDirectory [1 ] Windows Loader) IMAGE_THUNK_DATA IMAGE_THUNK_DATA IMAGE_THUNK_DATA IMAGE_THUNK_DATA IMAGE_IMPORT_DESCRIPTOR_0 … En Disco (ntdll.dll) 000..000 000…000 IMAGE_IMPORT_DESCRIPTOR _1 OriginalFirstThunk ReadFile TimeDateStamp WriteFile ForwardedChain Name Kernel32.dll FirstThunk … 77E55A68 IMAGE_IMPORT_DESCRIPTOR_n 77E52B38 0 … 0 M. Baz´ us, R.J. Rodr´ ıguez, J. Merseguer Qualitative and Quantitative Evaluation of Software Packers NcN 2015 16 / 39
Agenda Introduction 1 Contributions and Related Work 2 Previous Concepts 3 Software Protection Taxonomy 4 Software Packers Under Study 5 Qualitative and Quantitative Evaluation 6 Qualitative Evaluation Quantitative Evaluation Conclusions and Future Work 7 M. Baz´ us, R.J. Rodr´ ıguez, J. Merseguer Qualitative and Quantitative Evaluation of Software Packers NcN 2015 17 / 39
Software Protection (I): Static Analysis Copy protection Main aim: Avoid to illegitimately copy a software Techniques: License management, register keys, hardware dongles M. Baz´ us, R.J. Rodr´ ıguez, J. Merseguer Qualitative and Quantitative Evaluation of Software Packers NcN 2015 18 / 39
Recommend
More recommend
