4 ms·

I am an average web developer and I have sound computer and programing skills. I'm interested in computer security and always fascinated by these articles. Whe

by shroom 9y ago

I am an average web developer and I have sound computer and programing skills. I'm interested in computer security and always fascinated by these articles. When I read stuff like "Petya (binary edited)" I feel like a complete noob. Anyone care to elaborate how editing binaries would be done? Sounds like a daunting task. Even on a normal program. Much more so on malware that is obfuscated to begin with. Just curious :-)

adrianN 9y ago
Well, you look up the format of executable files under your operating system and find the parts of the program that you want to edit, like the code segments. Then you write the code you'd like to run, let your compiler translate it into the appropriate binary format (or you do this step by hand) and write it at the right spot. You have to be careful if addresses change (because you changed the size of the code for example), then you have to to the linker's job again.
pjmlp 9y ago
The first step is to get hold of a hexdump editor. https://en.wikipedia.org/wiki/Hex_dump https://en.wikipedia.org/wiki/Hex_dump Then you need to have an idea of the executable file format so that you can extract information from the respective file sections. Of course, there are tools that will extract those sections. So manual work only occurs if the tools fail to do their work. In the case of executables, reverse engineering tools like IDA give an helping hand. https://www.hex-rays.com/products/ida/ https://www.hex-rays.com/products/ida/ Then it goes from there, with lots of Assembly love and knowledge of OS internals.
- bitexploder 9y ago
  Okteta for Linux, Hex Fiend for Mac , 010 for Windows. Radare is a free disassembler. Hopper is good a good disassembler for Mac. IDA is great, but very expensive. Manual work happens almost always with weird malware and or packers. They almost always do something that makes trivial reversing harder.
indigochill 9y ago
I'll take a stab at a newb-friendly explanation, bearing in mind I'm only slightly less of a newb, but have at least studied this stuff to some extent and have played with https://microcorruption.com https://microcorruption.com, which is a game about maliciously editing machine instructions. Onwards! CPUs have a fixed instruction set. Add, subtract, increment by 1, and so on. These instructions in turn are represented in machine language as a binary string, which represents signals that get sent to the CPU's processing center, the ALU (Arithmetic Logic Unit). The ALU has a number of input ports, with each one corresponding to a different fundamental operation. There are a number of programs capable of taking an executable and providing a step-by-step breakdown in machine language (which makes sense intuitively because the machine has to do this for itself anyway in order to execute the program). So once you have the machine language instructions, you then study it to see what different sets of instructions are doing. This is made somewhat easier by the fact that computers run through instructions linearly (with the exception of jumps, but you also know that jumps represent some sort of logic operating on input, so those are informative as well). Although this would take forever to do manually, there are programs that aid in breaking machine language into easier-to-understand chunks, like IDA. Anyway, once you understand what different chunks of instructions are doing, then you can decide how you want to alter the program. You can use a hex editor for the actual editing (I assume professionals use something different, but some game modders use hex editors), which simply lets you change the individual bits on your drive (if this sounds impressive, realize that every time you save a file or something, that's what's going on at a large scale). If you want a gentle, newbie-friendly introduction to CPUs which will make a lot of this stuff click better, I highly recommend the NAND to Tetris course, which has a video series on Coursera: https://www.coursera.org/learn/build-a-computer https://www.coursera.org/learn/build-a-computer
linkregister 9y ago
Assembly is just shell code that hasn't been commented. If you know how to write assembly, you can change it. Also, it is possible the authors of this software have the source for Petya, and modified it there (easier). From what people who have taken the time to reverse engineer this code claim, NotPetya is a wrapper. The modified Petya code is stored in a buffer and is then called when it's time to encrypt the filesystem. To get started reverse engineering, modifying binaries, linking, etc. you need to start with learning x86_64 assembly. There are some pretty good courses and tutorials online. Since there are only a few opcodes that are used frequently, it might help to search for "reverse engineering bomb lab" and go from there. Here is the first search result, maybe it is good, maybe not: http://zpalexander.com/binary-bomb-lab-phase-1/ http://zpalexander.com/binary-bomb-lab-phase-1/
simias 9y ago
I don't find your quote in the original article, where is binary editing mentioned? At any rate in general it just means that the binary version is directly modified instead of, say, modifying the source and recompiling it. When the source is not available you don't really have a choice. It doesn't mean however that you'll just open a big binary dump of the program in emacs and start flipping bits manually. In general you'll first disassemble the code to figure out what it does, isolate the part that you want to modify, implement the modification and then you end up with a binary patch. That's easier said than done though, reverse engineering a complex binary is very time consuming. It reminded me of this anecdote: https://en.wikipedia.org/wiki/Wing_Commander_%28video_game%29#Development https://en.wikipedia.org/wiki/Wing_Commander_%28video_game%2... >As development for Wing Commander came to a close, the EMM386 memory manager the game used would give an exception when the user exited the game. It would print out a message similar to "EMM386 Memory manager error..." with additional information. The team could not isolate and fix the error and they needed to ship it as soon as possible. As a work-around, one of the game's programmers, Ken Demarest III, hex-edited the memory manager so it displayed a different message. Instead of the error message, it printed "Thank you for playing Wing Commander."
- shroom 9y ago
  Thanks for a great reply! Binary edited is written on the white board from the picture in the article.
- mariusmg 9y ago
  >reverse engineering a complex binary is very time consuming. And still ppl who crack games do it very often. They start with a obfuscated binary, decrypt it and patch it to remove the protection.
  - Filligree 9y ago
    That's not full reverse engineering. They're removing the protection, with a clearly defined goal they can look at to see if they're done, and that's all. Very different from trying to figure out everything a program does.
huhtenberg 9y ago
Depends on the amount of editing required. It can something as simple as changing several bytes using a hex/bin editor or something more involved like disassembling the binary, patching the assembly and then assembling it back.
masswerk 9y ago
A binary file on disk is just a file, like any other file, and you may read and hex-dump it, like any other. (Probably, your text editor has this built in.) And, of course, you may alter a file, either by overwriting part of it (using open, seek, write, close) or writing a modified version of it back to disk. If we open a file in a hex-editor, we may locate an embedded string, like this: 0180: 54 68 69 73 20 69 73 20 61 20 73 74 72 69 6E 67 00 This is a string. Now we may obviously change some of the string, and even shorten it, by filling the rest by zero-bytes: 0180: 54 68 69 73 20 69 73 20 61 20 70 65 74 00 00 00 00 This is a pet.... The interesting thing about this is that we may change the content, but have to maintain the original length and order of the code, else the binary won't work any more. I guess, padding, like this, is what gives the editing away -- at least at the level of arguments and embedded data. (However, if there were some hash signatures checked by the runtime, we will run into some trouble with our edit.) Just the same, we may edit any instruction code. Let's say, your hex-editor has a built-in disassembler module, displaying mnemonics next to the byte code, just like the ASCII text in the string example. Even while some of the code may be encrypted, there must be some top-level code which isn't, and we should be able to discern this from any obfuscated code. Now, say, we want to skip a call to a subroutine or module, by overwriting the call instruction by a few bytes representing a jump instruction to skip ahead. Notably, again, we'll have to maintain the overall length and byte order, leaving behind some unused bytes as a signature of this being edited code. Historical note: Classic MacOS (up to System 9) used a separate resource fork for any content embedded in files and executables. There was also a free tool by Apple, ResEdit, for displaying and editing the various resources and so-called res-hacks were not uncommon. (E.g., you may have accessed the resource providing the label for a menu item and replace it by your own, etc. This worked generally great with most of the programs, while some rather expensive software obviously applied some checks, prohibiting edited versions from working.) There was also a disassembler module for ResEdit, allowing code edits like described above.
- icebraining 9y ago
  Re: ResEdit - EXE files also have resource records, there's even a tool by the same name for Windows :)
nthcolumn 9y ago
The reason they are having this discussion is for the purposes of attribution or blame. The point was whether notPetya had been recompiled from source i.e. it was Janus or his source was stolen/bought or they had a sample of the ransomware binary (too easy to get unfortunately) and had tweaked it using an editor. Malware also employs 'shellcode' - low level code which can be inserted into a return point in a running process to branch and open a shell (usually) and do something like creating a reverse shell to an attackers' machine or wiping your hard drive. In theory you could use a tested one like petya and change the payload to do something else. You are correct it is daunting - it is rockhard - you can't just hack away at the image and shellcode is often much more complex than plain old assembly as it needs to be obfuscated and tries to avoid using null bytes.
tyingq 9y ago
>When I read stuff like "Petya (binary edited)" I feel like a complete noob There's probably a way to try it with tools you already know. Know vim for example? cp /bin/grep ./mygrep vim -b ./mygrep [find a string to change, like something from the output of ./mygrep -V] [don't change the length] [change a few letters] <esc>: %s/Free Software/Tree Software/g [save it] :wq! [run it] ./mygrep -V Changing things that aren't strings just requires a little research into the file format. A linux executable, for example, would usually be in the ELF format. Knowing that, you could, for example, coerce a linux binary to load a shared library from a different directory or name. Or research x86 opcodes and change some operation to a NOP...though a hex editor might be easier than vim -b.
- shroom 9y ago
  Interesting! Thanks a lot :)
tehno 9y ago
One really cool reading about reverse engineering obfuscated binaries and protocols, getting around anti-debugger code, etc is this talk from Blackhat about reverse-engineering Skype: https://www.blackhat.com/presentations/bh-europe-06/bh-eu-06-biondi/bh-eu-06-biondi-up.pdf https://www.blackhat.com/presentations/bh-europe-06/bh-eu-06... Gives pretty good insight into what steps go into this kind of work.
conradev 9y ago
I gave a high-level intro to a lot of popular reverse engineering tools that you might find helpful (in the context of reverse engineering iOS apps): https://news.realm.io/news/conrad-kramer-reverse-engineering-ios-apps-lyft/ https://news.realm.io/news/conrad-kramer-reverse-engineering...

by shroom 9y ago

adrianN 9y ago

Well, you look up the format of executable files under your operating system and find the parts of the program that you want to edit, like the code segments. Then you write the code you'd like to run, let your compiler translate it into the appropriate binary format (or you do this step by hand) and write it at the right spot. You have to be careful if addresses change (because you changed the size of the code for example), then you have to to the linker's job again.

pjmlp 9y ago

The first step is to get hold of a hexdump editor. https://en.wikipedia.org/wiki/Hex_dump https://en.wikipedia.org/wiki/Hex_dump Then you need to have an idea of the executable file format so that you can extract information from the respective file sections. Of course, there are tools that will extract those sections. So manual work only occurs if the tools fail to do their work. In the case of executables, reverse engineering tools like IDA give an helping hand. https://www.hex-rays.com/products/ida/ https://www.hex-rays.com/products/ida/ Then it goes from there, with lots of Assembly love and knowledge of OS internals.

bitexploder 9y ago
Okteta for Linux, Hex Fiend for Mac , 010 for Windows. Radare is a free disassembler. Hopper is good a good disassembler for Mac. IDA is great, but very expensive. Manual work happens almost always with weird malware and or packers. They almost always do something that makes trivial reversing harder.

indigochill 9y ago

I'll take a stab at a newb-friendly explanation, bearing in mind I'm only slightly less of a newb, but have at least studied this stuff to some extent and have played with https://microcorruption.com https://microcorruption.com, which is a game about maliciously editing machine instructions. Onwards! CPUs have a fixed instruction set. Add, subtract, increment by 1, and so on. These instructions in turn are represented in machine language as a binary string, which represents signals that get sent to the CPU's processing center, the ALU (Arithmetic Logic Unit). The ALU has a number of input ports, with each one corresponding to a different fundamental operation. There are a number of programs capable of taking an executable and providing a step-by-step breakdown in machine language (which makes sense intuitively because the machine has to do this for itself anyway in order to execute the program). So once you have the machine language instructions, you then study it to see what different sets of instructions are doing. This is made somewhat easier by the fact that computers run through instructions linearly (with the exception of jumps, but you also know that jumps represent some sort of logic operating on input, so those are informative as well). Although this would take forever to do manually, there are programs that aid in breaking machine language into easier-to-understand chunks, like IDA. Anyway, once you understand what different chunks of instructions are doing, then you can decide how you want to alter the program. You can use a hex editor for the actual editing (I assume professionals use something different, but some game modders use hex editors), which simply lets you change the individual bits on your drive (if this sounds impressive, realize that every time you save a file or something, that's what's going on at a large scale). If you want a gentle, newbie-friendly introduction to CPUs which will make a lot of this stuff click better, I highly recommend the NAND to Tetris course, which has a video series on Coursera: https://www.coursera.org/learn/build-a-computer https://www.coursera.org/learn/build-a-computer

linkregister 9y ago

Assembly is just shell code that hasn't been commented. If you know how to write assembly, you can change it. Also, it is possible the authors of this software have the source for Petya, and modified it there (easier). From what people who have taken the time to reverse engineer this code claim, NotPetya is a wrapper. The modified Petya code is stored in a buffer and is then called when it's time to encrypt the filesystem. To get started reverse engineering, modifying binaries, linking, etc. you need to start with learning x86_64 assembly. There are some pretty good courses and tutorials online. Since there are only a few opcodes that are used frequently, it might help to search for "reverse engineering bomb lab" and go from there. Here is the first search result, maybe it is good, maybe not: http://zpalexander.com/binary-bomb-lab-phase-1/ http://zpalexander.com/binary-bomb-lab-phase-1/

simias 9y ago

I don't find your quote in the original article, where is binary editing mentioned? At any rate in general it just means that the binary version is directly modified instead of, say, modifying the source and recompiling it. When the source is not available you don't really have a choice. It doesn't mean however that you'll just open a big binary dump of the program in emacs and start flipping bits manually. In general you'll first disassemble the code to figure out what it does, isolate the part that you want to modify, implement the modification and then you end up with a binary patch. That's easier said than done though, reverse engineering a complex binary is very time consuming. It reminded me of this anecdote: https://en.wikipedia.org/wiki/Wing_Commander_%28video_game%29#Development https://en.wikipedia.org/wiki/Wing_Commander_%28video_game%2... >As development for Wing Commander came to a close, the EMM386 memory manager the game used would give an exception when the user exited the game. It would print out a message similar to "EMM386 Memory manager error..." with additional information. The team could not isolate and fix the error and they needed to ship it as soon as possible. As a work-around, one of the game's programmers, Ken Demarest III, hex-edited the memory manager so it displayed a different message. Instead of the error message, it printed "Thank you for playing Wing Commander."

shroom 9y ago
Thanks for a great reply! Binary edited is written on the white board from the picture in the article.
mariusmg 9y ago
>reverse engineering a complex binary is very time consuming. And still ppl who crack games do it very often. They start with a obfuscated binary, decrypt it and patch it to remove the protection.
- Filligree 9y ago
  That's not full reverse engineering. They're removing the protection, with a clearly defined goal they can look at to see if they're done, and that's all. Very different from trying to figure out everything a program does.

huhtenberg 9y ago

Depends on the amount of editing required. It can something as simple as changing several bytes using a hex/bin editor or something more involved like disassembling the binary, patching the assembly and then assembling it back.

masswerk 9y ago

A binary file on disk is just a file, like any other file, and you may read and hex-dump it, like any other. (Probably, your text editor has this built in.) And, of course, you may alter a file, either by overwriting part of it (using open, seek, write, close) or writing a modified version of it back to disk. If we open a file in a hex-editor, we may locate an embedded string, like this: 0180: 54 68 69 73 20 69 73 20 61 20 73 74 72 69 6E 67 00 This is a string. Now we may obviously change some of the string, and even shorten it, by filling the rest by zero-bytes: 0180: 54 68 69 73 20 69 73 20 61 20 70 65 74 00 00 00 00 This is a pet.... The interesting thing about this is that we may change the content, but have to maintain the original length and order of the code, else the binary won't work any more. I guess, padding, like this, is what gives the editing away -- at least at the level of arguments and embedded data. (However, if there were some hash signatures checked by the runtime, we will run into some trouble with our edit.) Just the same, we may edit any instruction code. Let's say, your hex-editor has a built-in disassembler module, displaying mnemonics next to the byte code, just like the ASCII text in the string example. Even while some of the code may be encrypted, there must be some top-level code which isn't, and we should be able to discern this from any obfuscated code. Now, say, we want to skip a call to a subroutine or module, by overwriting the call instruction by a few bytes representing a jump instruction to skip ahead. Notably, again, we'll have to maintain the overall length and byte order, leaving behind some unused bytes as a signature of this being edited code. Historical note: Classic MacOS (up to System 9) used a separate resource fork for any content embedded in files and executables. There was also a free tool by Apple, ResEdit, for displaying and editing the various resources and so-called res-hacks were not uncommon. (E.g., you may have accessed the resource providing the label for a menu item and replace it by your own, etc. This worked generally great with most of the programs, while some rather expensive software obviously applied some checks, prohibiting edited versions from working.) There was also a disassembler module for ResEdit, allowing code edits like described above.

icebraining 9y ago
Re: ResEdit - EXE files also have resource records, there's even a tool by the same name for Windows :)

nthcolumn 9y ago

The reason they are having this discussion is for the purposes of attribution or blame. The point was whether notPetya had been recompiled from source i.e. it was Janus or his source was stolen/bought or they had a sample of the ransomware binary (too easy to get unfortunately) and had tweaked it using an editor. Malware also employs 'shellcode' - low level code which can be inserted into a return point in a running process to branch and open a shell (usually) and do something like creating a reverse shell to an attackers' machine or wiping your hard drive. In theory you could use a tested one like petya and change the payload to do something else. You are correct it is daunting - it is rockhard - you can't just hack away at the image and shellcode is often much more complex than plain old assembly as it needs to be obfuscated and tries to avoid using null bytes.

tyingq 9y ago

>When I read stuff like "Petya (binary edited)" I feel like a complete noob There's probably a way to try it with tools you already know. Know vim for example? cp /bin/grep ./mygrep vim -b ./mygrep [find a string to change, like something from the output of ./mygrep -V] [don't change the length] [change a few letters] <esc>: %s/Free Software/Tree Software/g [save it] :wq! [run it] ./mygrep -V Changing things that aren't strings just requires a little research into the file format. A linux executable, for example, would usually be in the ELF format. Knowing that, you could, for example, coerce a linux binary to load a shared library from a different directory or name. Or research x86 opcodes and change some operation to a NOP...though a hex editor might be easier than vim -b.

shroom 9y ago
Interesting! Thanks a lot :)

tehno 9y ago

One really cool reading about reverse engineering obfuscated binaries and protocols, getting around anti-debugger code, etc is this talk from Blackhat about reverse-engineering Skype: https://www.blackhat.com/presentations/bh-europe-06/bh-eu-06-biondi/bh-eu-06-biondi-up.pdf https://www.blackhat.com/presentations/bh-europe-06/bh-eu-06... Gives pretty good insight into what steps go into this kind of work.

conradev 9y ago

I gave a high-level intro to a lot of popular reverse engineering tools that you might find helpful (in the context of reverse engineering iOS apps): https://news.realm.io/news/conrad-kramer-reverse-engineering-ios-apps-lyft/ https://news.realm.io/news/conrad-kramer-reverse-engineering...