5 ms·

Decompiler output; product of the HBGary/Anonymous dump. The most interesting thing here is probably the emails from HBGary folks about StuxNet in the accompan

by rst 16y ago

Decompiler output; product of the HBGary/Anonymous dump. The most interesting thing here is probably the emails from HBGary folks about StuxNet in the accompanying blog post[1]. (For public purposes, the CEO wants everyone to know, they know nothing about it, but Aaron Barr was talking about it with various people anyway.) Unfortunately, the decompiler output doesn't convey much as it stands, unless you like sorting through pages and pages of local199 = local191; local203 = local191 + 0x6f02418d; local3 = proc2(0x10021238, param1, param2, param9, param5); /* Warning: also results in local190 */ local208 = local3; local209 = local190; local211 = local203; That being one of the more interesting sections; there are stretches with dozens of lines in a row of the form "localfoo = localbar". It does seem to suggest, at least, that this dump didn't have the actual source. [1] http://crowdleaks.org/hbgary-wanted-to-suppress-stuxnet-research/ http://crowdleaks.org/hbgary-wanted-to-suppress-stuxnet-rese...

viraptor 16y ago
A silly decompiler that doesn't even recognise for loop with a break (https://github.com/Laurelai/decompile-dump/blob/master/output/30DF51C9F0D9B010350DC09ABE1E4E97/30DF51C9F0D9B010350DC09ABE1E4E97.c https://github.com/Laurelai/decompile-dump/blob/master/outpu...) That said... I wonder how useful would github be as a collaborative decompilation space - grab a file, annotate / simplify as much as possible, send pull request, repeat...
- soulclap 16y ago
  'collaborative decompilation space' (github-based or not) sounds like a sick idea, actually.
  - nitrogen 16y ago
    I wonder if Google's translation tools could be adapted to the task: "Suggest a better decompilation," perhaps? Does anybody have a good reference for how decompilers work? When converting assembly to C by hand I always went through multiple passes (not necessarily in this order): first a literal pass that looked a lot like this dump with gotos and variables named after registers, then I'd identify if/else and switch blocks, then I'd convert any reverse gotos into a while loop, convert while loops into for loops, identify data structures, duplicate lines that had been optimized to a single reference with jmps, etc.
    - NateLawson 16y ago
      Pretty much that, yes. Also, you have specific idioms for popular compilers (vc, gcc, icc, borland) and value propagation. You could even include an SMT solver to identify constraints and propagate the range to child basic blocks.
  - NateLawson 16y ago
    Bincrowd http://www.zynamics.com/bincrowd.html http://www.zynamics.com/bincrowd.html The plugin is open source and the community server is free.
    - mukyu 16y ago
      I wanted to post about this, but I could not remember the name and googling things like '(collaborative OR crowdsource) static binary analysis' was futile. Thanks, it was driving me insane.
- rst 16y ago
  Although in this case, the object code may have been deliberately obscured. On reflection, I can't help wondering how much of the seemingly pointless diddling of local variables is the result of turning a naive decompiler on a bytestream where the actual instructions are somehow encrypted or masked.
  - viraptor 16y ago
    I really don't think so. The decompilation result is genuinely silly. For example look at: if (*(int*)(local2 + global0) == 0x4550) { local5 = *(unsigned short*)(local2 + global0 + 20); Either local2 or global0 are pointers to a structure. Neither is detected. Most sensible decompilers would change the names and just make it `local5 = global0[local2].blah` instead. Advanced decompilers also can avoid gotos in almost any case. It also uses function calls without parameters or output, assuming some stack layout probably. It's a really really bad output, not a result of obscured compilation.
    - DCoder 16y ago
      I've seen HexRays do the same thing - most of the time you need to actually tell it that a variable is a pointer before it tries to do that. Stating the function type explicitly also helps it display the right arguments given to it. This output could be significantly improved if the assembly version were available as well.
    - updog 16y ago
      This came from one of the better known commercial decompilers. Which ones do you consider 'advanced'?
      - viraptor 16y ago
        Pointed out before: http://news.ycombinator.com/item?id=2214052 http://news.ycombinator.com/item?id=2214052 - this is from boomerang - not a known commercial decompiler really.
    - NateLawson 16y ago
- deleted 16y ago
  [deleted]
levigross 16y ago
this is just in time for the RSA show that is starting on Monday.
yuhong 16y ago
"(For public purposes, the CEO wants everyone to know, they know nothing about it, but Aaron Barr was talking about it with various people anyway.)" Which is of course not a good idea in the PR 2.0 age. Anyone found emails explaining why they did this?
kissickas 16y ago
Many of the emails in that article are ordered newest to oldest... not a great link.
jeffreyg 16y ago
"Throughout the following emails it is revealed that HBGary Federal may have been planning to use Stuxnet for their own purposes" what does that even mean? nonsensical.
- nailer 16y ago
  Parses fine here. "Here are some emails that show this company was planning to use Stuxnet" Stuxnet is a distributed bot. It can be commanded. The post is saying this company planned to do that. I don't know whether that's true or not but it seems easy to understand.
  - jeffreyg 16y ago
    late reply but hopefully you'll see. AFAIK, stuxnet is not an application where you can simply 'remove' the centrifuge-targeting payload and add your own. That, combined with the fact that all 4 0-days have been patched, means that I don't think the author's commentary is accurate. There are much better options for HBGary had they wanted command of a distributed botnet and they would have known that.
kens 16y ago
Is this decompiler output accurate? I'm suspicious because proc12 [¹] looks like memcpy, except it's advancing a byte at a time and copying an int at a time: *(int*)local6 = *(int*)local5; local5++; local6++; Either the memcpy code is strangely broken, or the decompiler is putting int * where it means char *. [¹] See full code at https://github.com/Laurelai/decompile-dump/blob/master/output/a/a.c#L1163 https://github.com/Laurelai/decompile-dump/blob/master/outpu... and same for proc20: https://github.com/Laurelai/decompile-dump/blob/master/output/a/a.c#L1514 https://github.com/Laurelai/decompile-dump/blob/master/outpu...
leon_ 16y ago
it's just building the stack frames in C. at the end this is just assembly with C syntax - and the reason why I rather like disassemblies than decompilates.

by rst 16y ago

viraptor 16y ago

A silly decompiler that doesn't even recognise for loop with a break (https://github.com/Laurelai/decompile-dump/blob/master/output/30DF51C9F0D9B010350DC09ABE1E4E97/30DF51C9F0D9B010350DC09ABE1E4E97.c https://github.com/Laurelai/decompile-dump/blob/master/outpu...) That said... I wonder how useful would github be as a collaborative decompilation space - grab a file, annotate / simplify as much as possible, send pull request, repeat...

soulclap 16y ago
'collaborative decompilation space' (github-based or not) sounds like a sick idea, actually.
- nitrogen 16y ago
  I wonder if Google's translation tools could be adapted to the task: "Suggest a better decompilation," perhaps? Does anybody have a good reference for how decompilers work? When converting assembly to C by hand I always went through multiple passes (not necessarily in this order): first a literal pass that looked a lot like this dump with gotos and variables named after registers, then I'd identify if/else and switch blocks, then I'd convert any reverse gotos into a while loop, convert while loops into for loops, identify data structures, duplicate lines that had been optimized to a single reference with jmps, etc.
  - NateLawson 16y ago
    Pretty much that, yes. Also, you have specific idioms for popular compilers (vc, gcc, icc, borland) and value propagation. You could even include an SMT solver to identify constraints and propagate the range to child basic blocks.
- NateLawson 16y ago
  Bincrowd http://www.zynamics.com/bincrowd.html http://www.zynamics.com/bincrowd.html The plugin is open source and the community server is free.
  - mukyu 16y ago
    I wanted to post about this, but I could not remember the name and googling things like '(collaborative OR crowdsource) static binary analysis' was futile. Thanks, it was driving me insane.
rst 16y ago
Although in this case, the object code may have been deliberately obscured. On reflection, I can't help wondering how much of the seemingly pointless diddling of local variables is the result of turning a naive decompiler on a bytestream where the actual instructions are somehow encrypted or masked.
- viraptor 16y ago
  I really don't think so. The decompilation result is genuinely silly. For example look at: if (*(int*)(local2 + global0) == 0x4550) { local5 = *(unsigned short*)(local2 + global0 + 20); Either local2 or global0 are pointers to a structure. Neither is detected. Most sensible decompilers would change the names and just make it `local5 = global0[local2].blah` instead. Advanced decompilers also can avoid gotos in almost any case. It also uses function calls without parameters or output, assuming some stack layout probably. It's a really really bad output, not a result of obscured compilation.
  - DCoder 16y ago
    I've seen HexRays do the same thing - most of the time you need to actually tell it that a variable is a pointer before it tries to do that. Stating the function type explicitly also helps it display the right arguments given to it. This output could be significantly improved if the assembly version were available as well.
  - updog 16y ago
    This came from one of the better known commercial decompilers. Which ones do you consider 'advanced'?
    - viraptor 16y ago
      Pointed out before: http://news.ycombinator.com/item?id=2214052 http://news.ycombinator.com/item?id=2214052 - this is from boomerang - not a known commercial decompiler really.
  - NateLawson 16y ago
deleted 16y ago
[deleted]

levigross 16y ago

this is just in time for the RSA show that is starting on Monday.

yuhong 16y ago

"(For public purposes, the CEO wants everyone to know, they know nothing about it, but Aaron Barr was talking about it with various people anyway.)" Which is of course not a good idea in the PR 2.0 age. Anyone found emails explaining why they did this?

kissickas 16y ago

Many of the emails in that article are ordered newest to oldest... not a great link.

jeffreyg 16y ago

"Throughout the following emails it is revealed that HBGary Federal may have been planning to use Stuxnet for their own purposes" what does that even mean? nonsensical.

nailer 16y ago
Parses fine here. "Here are some emails that show this company was planning to use Stuxnet" Stuxnet is a distributed bot. It can be commanded. The post is saying this company planned to do that. I don't know whether that's true or not but it seems easy to understand.
- jeffreyg 16y ago
  late reply but hopefully you'll see. AFAIK, stuxnet is not an application where you can simply 'remove' the centrifuge-targeting payload and add your own. That, combined with the fact that all 4 0-days have been patched, means that I don't think the author's commentary is accurate. There are much better options for HBGary had they wanted command of a distributed botnet and they would have known that.

kens 16y ago

Is this decompiler output accurate? I'm suspicious because proc12 [¹] looks like memcpy, except it's advancing a byte at a time and copying an int at a time: *(int*)local6 = *(int*)local5; local5++; local6++; Either the memcpy code is strangely broken, or the decompiler is putting int * where it means char *. [¹] See full code at https://github.com/Laurelai/decompile-dump/blob/master/output/a/a.c#L1163 https://github.com/Laurelai/decompile-dump/blob/master/outpu... and same for proc20: https://github.com/Laurelai/decompile-dump/blob/master/output/a/a.c#L1514 https://github.com/Laurelai/decompile-dump/blob/master/outpu...

leon_ 16y ago

it's just building the stack frames in C. at the end this is just assembly with C syntax - and the reason why I rather like disassemblies than decompilates.