The worst part of reverse engineering C++ programs -- or really, any program that uses custom structure types with no definitions provided -- is that information about structures is often incomplete, sporadic, and isolated. Consider the following function: From this code, we can infer that rcx points to a struct that has a QWORD -sized field at offset +0x70 . However, from this code alone, we…
This blog entry announces the release of an exhaustive analysis of ComLook, a newly-discovered malware family about which little information has been published. It was recently discovered by ClearSky Cyber Security, and announced in a thread on Twitter . You can find the IDB for the DLL here , in which every function has been analyzed, and every data structure has been recovered. Like the previous…
There are three major elements to reverse engineering C++ code that uses STL container classes: Determining in the first place that an STL container is being used, and which category, i.e., std::list<T> vs. std::vector<T> vs. std::set<T> Determining the element type, i.e., T in the categories above Creating data types in your reverse engineering tool of choice, and applying those types to the…
This entry is about how to make the best use of IDA and Hex-Rays with regards to a common scenario in malware analysis, namely, dynamic lookup of APIs via GetProcAddress (and/or import resolution via hash). I have been tempted to write this blog entry several times; in fact, I uploaded the original code for this entry exactly one year ago today. The problem that the script solves is simple: given…
Hex-Rays uses while(1) to represent infinite loops in the output. However, sometimes you might see while(2) loops in the output instead, as in the following: Logically, while(2) behaves the same as while(1) -- both loops are infinite -- but I wondered where they came from, what they meant, and why Hex-Rays produces them. Given that somebody asked me about it on Twitter, it's clear that I'm not the…
This blog entry announces the release of an exhaustive analysis of FlawedGrace. You can find the IDB for the main executable, and for the 64-bit password stealer module, here. The sha1sum for the main executable is 9bb72ae1dc6c49806064992e0850dc8cb02571ed, and the md5sum is bc91e2c139369a1ae219a11cbd9a243b. Like the previous entry in this series on ComRAT v4 , I did this analysis as part of my…
This blog entry announces the release of an exhaustive analysis of ComRAT v4. You can find the IDBs here . More specifically, an IDB for the sample with hash 0139818441431C72A1935E7F740A1CC458A63452, which was mentioned in the ESET report (see especially its attached PDF ), and which is available online on Hybrid Analysis . All of the analysis has been performed in Hex-Rays 64-bit, so the results…
Today I discovered a neat optimization that I'd only heard about in graduate school, but had never seen in a real binary. Although the code below involves virtual functions in C++, the same technique would work for ordinary function pointers in C. A few other optimizations are referenced in the explanation below; all of them can be found in my presentation, "Compiler Optimizations for Reverse…
Here are the slides for my recent presentation at RECON, entitled "Automation Techniques in C++ Reverse Engineering". As usual, my slides use in-frame animations, so in brief, navigate them using contiguous mode (one slide at a time, advance/retreat with left/right) instead of continuous mode (where parts of multiple slides are visible at the same time, scrolling with up and down). A video of the…
This blog entry announces the release of an abstract interpretation-based Ghidra plugin for deobfuscation. The code can be found here (see the ‘Releases’ tab for a binary release). In view of the picture below, the static analysis described herein is designed to take graphs like the one on the left, detect and remove the "opaque predicates" (fake "conditional" branches that only go in one…
As part of my reverse engineering work, I wrote a small plugin to deal with an optimization that had been irritating me. The plugin isn't very sophisticated or interesting, but it is useful, and it's fully automatic, requiring no user interaction. You can find the code here , and my recent article on the Hex-Rays microcode API provides all of the necessary background. In brief, testing individual…
Reverse engineering tools tend to be developed against fundamental assumptions, for example, that binaries will more or less conform to the standard patterns generated by compilers; that instructions will not jump into other instructions; perhaps that symbols are available, etc. As any reverse engineer knows, your day can get worse if the assumptions are violated. Your tools may work worse than…
One thing I teach my students in my static reverse engineering training classes is to exploit information that programmers have left in the binaries for debugging purposes. The most obvious example of this is when the program contains a debug logging function, where one of the parameters is the function's name. In this case, the reverse engineer can write a script to extract the function names and…
I wrote a guest blog entry published on Hex-Rays’ website about a project I did involving the Hex-Rays decompiler microcode API.
Here's a half-day project that I did this weekend for my own edification. Perhaps someone will benefit from the source code in the future. While reading hasherezade's research on the Hidden Bee malware family's custom file format (samples here ), I was struck with the thought that this use-case seemed particularly well-suited for an IDA custom loader module. The IDA loader module approach has a…
This post covers my solution to the Atredis BlackHat 2018 challenge , for which I won second place and a ticket to BlackHat. I'd like to express my gratitude to the author, the increasingly-reclusive Dionysus Blazakis, as well as Atredis for running the contest. Initial Recon As you can see from the screenshot in the tweet linked above, and reproduced below, once you connect to the network service…
I've decided to release my presentation (two slide decks) on the theoretical foundations of abstract interpretation, illustrated through the game of chess. It has been collecting dust on my hard drive for five years, so I figured I may as well give it a proper burial. This was the first thing I wrote as part of what eventually became my SMT-Based Program Analysis training , back when I planned for…
[Note: if you've been linked here without context, the introduction to Part #3 describing its four phases can be found here .] 1. Introduction In Part #3, Phase #1 , we deobfuscated the FinSpy VM bytecode program by removing the Group #2 instructions. In Part #3, Phase #2 , we made a first attempt to devirtualize the FinSpy VM bytecode program back into x86 code. This was mostly successful, except…
[Note: if you've been linked here without context, the introduction to Part #3 describing its four phases can be found here .] 1. Introduction At the end of Part #3, Phase #2 , we noted that our first attempt at devirtualization is still subject to two remaining major issues. We had deferred generating proper displacements when devirtualizing the FinSpy VM X86CALLOUT instructions into x86 CALL…
[Note: if you've been linked here without context, the introduction to Part #3 describing its four phases can be found here .] 1. Introduction In the previous Part #3, Phase #1 , we inspected our FinSpy VM bytecode disassembly listing and discovered that the Group #2 instructions were used for obfuscation. After discovering obfuscation patterns and replacing them with simpler sequences, we…