Recent content in Nicolò Altamura's Website on
I’m a security engineer at Emproof , working in the software protection field. I have a background in reverse engineering, static analysis and R&D of automatic reverse engineering programs, such as disassemblers, decompilers and intermediate languages development. I hold a master’s degree in Computer Science and Engineering from Università degli Studi di Verona . My work has appeared…
ptxNinja is an architectural plugin that extends the functionality of Binary Ninja to support *.ptx files containing functions or kernels written in PTX. The PTX language is a low-level format used by NVIDIA for its CUDA-based GPUs. This plugin provides a lifter that translates raw instructions into the low-level instructions that Binary Ninja requires to begin analysis. This work was presented at…
Obfuscation Analysis is a Binary Ninja plugin designed to improve the readability of protected binaries once the relevant code regions have been identified. It offers focused utilities to address common reverse-engineering obstacles, including MBA simplification directly within the decompiler view, detection and elimination of corrupted functions that disrupt disassembly, and recursive function…
Building your own set of analysis tools is a great exercise for those who already have some basics and allows you to later move on to implement more targeted analyses in reverse engineering. Even just seeing how the different algorithms can be implemented provides a mental framework that may help when reverse engineering more difficult-to-analyse executable files, i.e. obfuscated ones. Excluding…
Interactive PDF Analysis (also called IPA) allows any researcher to explore the inner details of any PDF file. PDF files may be used to carry malicious payloads that exploit vulnerabilities, and issues of PDF viewer, or may be used in phishing campaigns as social engineering artefacts. The goal of this software is to let any analyst go deep on its own the PDF file. Via IPA, you may extract…
The control-flow graph is an important building block in static program analysis for applying a variety of analyses that consider the flow of a program. The “flow”, described informally, represents the evolution of the program during execution time, that is, at which the CPU jumps in order to continue program execution. The graph (also called CFG for brevity) allows the first…
FairPlay comprises a set of algorithms created by Apple for digital rights management (also called DRM, digital rights management ). FairPlay is currently used to manage the decryption of iOS applications during their installation on Apple devices. In fact, we know that Apple distributes all applications in the Apple Store through the IPA file format. The IPA file format contains encrypted…
With this article I want to summarize some details I found while analyzing McAfee Virus Scan software, historically speaking, it is one of the first commercial antivirus. Studying its details and operation might reveal some design choices that show how early antivirus worked. We are especially interested in understanding how malware detection occurred, as well as the particular features that the…
POCKET is a program for applying transformations to obfuscate any expression through Mixed Boolean Arithmetic via a set of pre-computed transformations. It accepts input expressions and obfuscates them through some rules that are applied by substitution or term-rewriting. The goal of the project is to showcase a very simple program that can parse a given expression and outputs a transformed AST.…
Code obfuscation is the technique of applying transformations to a code to make any static analysis (automatic or otherwise) more difficult and more complex. Static analysis groups a series of operations that an analyst can perform on an executable to try to obtain information such as high-level structures and original variables. Among the techniques of static analysis of software, we can find…
A new version of MicroSCOPE has been released. The following is a list of some of the changes made: Improved heuristics on section flags. Fixed problem with resource offsets, if present in different sections. Added printing on section flags. Fixed issue on trust chain verification for Security section. Added Microsoft root certificates (2010 and 2017). You can download the software for Windows,…
MicroSCOPE is a command-line software that is used to statically analyze any ELF (*nix) or PE (Windows) binary program. MicroSCOPE applies heuristics to look for any features that might identify the program as ransomware. The project was developed following modern software engineering techniques, preferring an incremental approach. The programming language used was Go , which is powerful,…
A new version of MicroSCOPE has been released. Below is the list of some of the changes made: Fixed fixes on the header of ELF files. Added heuristics on section name Added heuristics for resources Improved string heuristics for ransomware Increased threshold to the value 150 Fixed an issue on export values Added Timestamp field to resource Added heuristics for .NET files Fixed issue with…
OSLab contains the source files for Hugo to build the HTML documentation in Italian for the course Operating Systems, academic year 2021-2022, lab part. It contains a wealth of useful information that were not written in the slides, including some code examples explained step by step. Link to repository Link to documentation I want to learn more
Hugo 1 is a static site generation tool written in Go. It is incredibly fast and has excellent high-level and flexible primitives for content management using Markdown and JSON . You will learn how to create a new Hugo blog and deploy it using Cloudflare Pages . You will use the hugo CLI to create a new Hugo site and then Cloudflare to deploy your website. You must have a Cloudflare account and a…
Assume we have the following code: t := time. Now () fmt. Println (t. Format ( 'yyyyMMddHHmmss' )) how may we format the date in the go-lang format: yyyyMMddHHmmss ? The question is simple and the answer is almost trivial. However, the reason for this answer conceals one of the great nightmares of programmers writing with GoLang. 2 January 2006 To format the date simply enter…
While studying operating systems, I found an important resource called The Little Book of Semaphores that illustrates several examples of concurrent programming exercises, particularly on semaphores. For those of you who are a bit unfamiliar or have never seen concurrent programming in your career, let’s take a step back. Every process that we run that runs for the operating system competes…
For the Operating Systems lab, it has been requested to start to autonomously compile MentOS 1 , Mentoring Operating System, a “hobbyist” operating system developed by some students of the University of Verona. Unlike many other operating systems used in other courses, MentOS is among the few to dogmatically follow the guidelines made available by Linux, implementing the same data…
Don’t have a clue what Git is? Do you think it’s the name of Elon Musk’s new car? Do you need it for your new project of OS class? There’s nothing to worry about: just follow this step-by-step introductory guide and you’ll soon be familiar enough with Git to brag to friends and family that you’re a developer™. Before we delve deeper, let’s clear up a…
Among the many concepts (and pre-concepts) of computer science, one paradigm in particular has always fascinated me: illusion. In computer science unlike many other sciences you are free to cheat, hide and use all the tricks you want to make the user believe anything. Some patterns on graphical interfaces and user experiences are so devious that they have been strongly criticized by many people 1…
Hello World. Any blog must start with the typical program phrase that they usually propose during the first lesson of any programming course. Those who have surely attempted program development will have come across Hello world. Although it doesn’t represent any interesting feature within a program, showing a simple message on the screen is already a progress: having understood how to…