Unpacking tips and tricks Protector Techniques Conclusion Samuel - PowerPoint PPT Presentation

Unpacking tips and tricks Samuel Chevet Presentation Process Unpacking tips and tricks Protector Techniques Conclusion Samuel Chevet w4kfu@lse.epita.fr http://www.lse.epita.fr 12 February 2013

Why this talk ? Unpacking tips and tricks Samuel Chevet Presentation Why this talk ? Packer Protector Previously in w4kfu’s talk : Anti-Debug Detection Basics knowledges Import Table Malicious software Import Address Table Video Games Process Protector Share Reverse Engineering stu ff Techniques Conclusion Fun

Packer Unpacking tips and tricks Samuel Chevet Presentation Compress executable Why this talk ? Packer Prepend decompression stub Protector Detection Decompression stub is standalone Basics knowledges Import Table Import Address Table Indistinguishable to the casual user Process Single executable Protector Techniques Unpack and transfer control to it Conclusion Original entry point Exist for DOS, Microsoft Windows and others OS Command line as GUI based

Packer Benefit Unpacking tips and tricks Samuel Chevet Presentation Why this talk ? Packer Protector Less storage space Detection Basics knowledges Marketing a product via internet Import Table Import Address Table Less time for data transfer Process Protector Resistant to casual reverser Techniques Target must be unpacked or rebuilt Conclusion

Packer Disavantages Unpacking tips and tricks Samuel Chevet Presentation Why this talk ? Packer Protector Everything come at a price Detection Basics knowledges Antivirus problem Import Table Import Address Table More time to decompress Process Protector Unpacked at some stage Techniques Dumped to disk ? Conclusion

Protector Unpacking tips and tricks Samuel Chevet Presentation Why this talk ? Packer Protector Derive of the simple packer Detection Basics knowledges Import Table Packer aim to reduce size Import Address Table Add code to protect against reverse engineering Process Protector Size will considerably increase Techniques Conclusion Malicious software

Detection Unpacking tips and tricks Samuel Chevet Signature based Presentation Why this talk ? Opcode-sequence-based Packer Protector Tag Detection Basics knowledges Additional heuristics Import Table Import Address Table OEP outside first section Process More than one executable section Protector ImportTable position uncommon Techniques LoadLibrary and GetProcAddress in ImportTable Conclusion TLS Unknow instruction Anti Re-Protect Compiler startup code

Detection Unpacking tips and tricks Samuel Chevet Anti Presentation Why this talk ? Replace instruction Packer Protector Detection Polymorphism Basics knowledges Import Table Metamorphism Import Address Table Process Protector Toolz Techniques PEiD Conclusion Protection ID RDG packer Detector . . .

Import Table Unpacking tips and tricks Samuel Chevet Presentation Why this talk ? Packer Protector List of functions not part of the application Detection Basics knowledges Called imports Import Table Import Address Table Operating systems DLL’s, or homemade Process Protector Di ff erent OS Version Techniques Application don’t know where Conclusion

Import Table Unpacking tips and tricks Samuel Chevet Presentation OptionalHeader- > DataDirectory[] Why this talk ? Packer IMAGE_DIRECTORY_ENTRY_IMPORT Protector Detection Basics knowledges Import Table IMAGE_IMPORT_DESCRIPTOR Import Address Table Process OriginalFirstThunk Protector TimeDateStamp Techniques Conclusion ForwarderChain Name FirstThunk

Import Address Table Unpacking tips and tricks Samuel Chevet Presentation Why this talk ? Packer Protector Detection Loader loads DLL Basics knowledges Import Table Construct IAT Import Address Table Process All ptr in FirstThunk contain API’s address Protector Techniques call [addr], jmp [addr] Conclusion

Peering inside the PE Unpacking tips and tricks Samuel Chevet Presentation Why this talk ? Packer Protector Detection Basics knowledges Import Table Import Address Table Process Protector Techniques Conclusion

Original OEP Unpacking tips and tricks Samuel Chevet Presentation Process Original OEP Fix PE Trace the code Import rebuilding Protector ESP trick Techniques Conclusion VirtualProtect() Use Exceptions

Fix PE Unpacking tips and tricks Samuel Chevet Presentation Process Original OEP Fix PE O ff set OEP Import rebuilding Protector O ff set IAT Techniques Conclusion Sections characteristics And more when there is some protection

Import rebuilding Unpacking tips and tricks Samuel Chevet Presentation Process Original OEP Fix PE Packers / Protector destroy Import Table Import rebuilding Protector Correct RVA and Size of Import Table Techniques IMAGE_IMPORT_DESCRIPTOR nulled one Conclusion OriginalFirstThunk, FirstThunk and Name must be well informed

Anti-Dumping Unpacking tips and tricks Samuel Chevet Presentation Process Protector Mutex Techniques Anti-Dumping CPUID TLS Callbacks Stolen Bytes Delete loader API Redirection Nanomites Triggers Header modification Conclusion Page level protection

TLS Callbacks Unpacking tips and tricks Samuel Chevet Presentation Process Protector Thread Local Storage Techniques Anti-Dumping Execute code before EP TLS Callbacks Stolen Bytes Debugger detection API Redirection Nanomites Triggers Decryption routines Conclusion Hook

Stolen Bytes Unpacking tips and tricks Samuel Chevet Presentation Process Protector Portions of code Techniques Anti-Dumping Removed from original TLS Callbacks Stolen Bytes Usually near entry point API Redirection Nanomites Triggers Executed from allocated memory Conclusion Restore them before dump

API Redirection Unpacking tips IAT partially or completely destroyed and tricks Call to APIs are redirected Samuel Chevet Routines located into allocated memory or in Presentation protector stub Process Protector Techniques Anti-Dumping TLS Callbacks Stolen Bytes API Redirection Nanomites Triggers Conclusion

API Redirection Unpacking tips and tricks Samuel Chevet Presentation Process Stolen instructions Protector Techniques Control transfered back in the middle Anti-Dumping TLS Callbacks Routines located into allocated memory or in Stolen Bytes protector stub API Redirection Nanomites Triggers Load whole DLL image Conclusion Redirect API Di ffi cult to set breakpoints

API Redirection Unpacking tips and tricks Samuel Chevet Presentation Process Inject !!! Protector Scan for call dword ptr / jmp dword ptr Techniques Anti-Dumping Is outside PE ? TLS Callbacks Stolen Bytes API Redirection Is not an API ? Nanomites Triggers Hook routine Conclusion Call it Use against himself !

Nanomites Unpacking tips and tricks Samuel Chevet JCC instruction Presentation Some Opcodes Process Replace by int3 Protector Techniques 2 Process ! Father and son Anti-Dumping TLS Callbacks Stolen Bytes Inject the father API Redirection Nanomites Father : WaitForDebugEvent() Triggers Conclusion Son : Scan 0xCC (int3) Reverse, or comportemental study Thruth table Maybe opcode will be restored to avoid performance down

Triggers Unpacking tips and tricks Samuel Chevet Presentation Process Detect if protection has been deleted Protector Techniques Developpers can use SDK Anti-Dumping TLS Callbacks Invincible enemy Stolen Bytes API Redirection Nanomites Camera bug Triggers Conclusion Redirect call will return on the next instruction Return value modification

Conclusion Unpacking tips and tricks Samuel Chevet Presentation Process Protector Techniques Conclusion INJECT !

Real Conclusion Unpacking tips and tricks Samuel Chevet Presentation Process Protector Really fun ! Techniques Code your own toolz Conclusion Don’t use unpacker ! Write your own Internet connection permanent Kill market of multimedia library and occasion

Questions ? Unpacking tips and tricks Samuel Chevet Presentation Process Thank you for your attention Protector Techniques Conclusion @w4kfu blog.w4kfu.com w4kfu@lse.epita.fr