4 ms·

Stuff like this deeply fascinates me. However, I can't help but feel like a lot of it could be improved with the help of some automation tooling. Is there anyt

by earlz 12y ago

Stuff like this deeply fascinates me. However, I can't help but feel like a lot of it could be improved with the help of some automation tooling. Is there anything out there for like a "language" of sorts (or API, etc) that can automate some of the debugging things required? Like I imagine very "active" debugging and code modification like "When we are at this location, and the past few instructions exected were X, Y, and Z at addresses A, B, and C, pop this item off the stack and push this hard coded value on the stack" Things that would take forever to do manually, especially when called in a loop, but would be fairly trivial to formalize into a programming language

AustinDizzy 12y ago
A lot of debuggers and disassemblers do exactly that. They're getting smarter every day, but they still take some knowledge of assembly and lower-level computer science concepts. IDA Pro [0] is a good example of an excellent debugger with plentiful features and productive disassembling tools. [0]: https://www.hex-rays.com/products/ida/ https://www.hex-rays.com/products/ida/
- tptacek 12y ago
  Most people here (and people I know in the industry) use programmable debuggers --- Ruby and Python libraries that implement the OS debug hooks. If you're on a Mac, like most people who do software security, Hopper.app is a fantastic alternative to IDA.
SEJeff 12y ago
gdb actually has amazingly good python scripting built in if you're using a reasonably new version of it. Redhat lead the charge[1] with what they called 'Project Archer', which was merged into gdb mainline as the python scriptability. [1] http://sourceware.org/gdb/wiki/ProjectArcher http://sourceware.org/gdb/wiki/ProjectArcher
- earlz 12y ago
  That's pretty interesting. I'll have to look at that more
yaur 12y ago
One thing to keep in mind is that there are only a handful of really good disassemblers and that anyone semi serious about keeping you away can throw in code that will confuse and/or crash them.
- sillysaurus3 12y ago
  It's possible to confuse or crash IDA Pro, Ollydbg, and Cheat Engine? If one tool won't work, just switch to another.
  - yaur 12y ago
    Sure see http://www.exploit-db.com/exploits/23524/ http://www.exploit-db.com/exploits/23524/ and https://forum.tuts4you.com/topic/28804-ollydbg-numberofsections-crash/ https://forum.tuts4you.com/topic/28804-ollydbg-numberofsecti... for instance.
  - drblast 12y ago
    It's very possible. Recently I had to manually patch code that was (in assembly) a conditional jump on conditions that at runtime were always true or always false, so the "conditional" part was a red herring. The fact that the conditional was there confused IDA such that it miscalculated the stack usage for many of the functions in the binary and refused to designate them as procedures (which can be decompiled). The telling part was that these conditionals had no other purpose other than to confuse IDA, so you could see the intent was malicious. That's just one example. You REALLY have to know what's going on with the hardware and the intentions of malware authors so you don't blindly accept what your tools are telling you. That's what makes the difference between someone who can do reverse engineering for a living and someone who is good at it. EDIT: One more thing...debugging malware is a last resort; it's very easy to behave one way for a debugger while doing something completely different elsewhere. If you start with automated detection/debugging tools you spend most of your time working around debug detection. If you'd like to know more my email address is in my profile.
    - sillysaurus3 12y ago
rjzzleep 12y ago
It all went downhill, when compuware bought numega and killed softice. yes, ollydbg and windbg work fine, but still...
- DEinspanjer 12y ago
  Hehe.. I worked for Numega back then. I did tech support and I still remember how often we got tech support requests from people and companies wanting a way to prevent SoftIce from being used to crack their software. So many times I tried to explain to people that there just wasn't really a good way to detect that it was happening that couldn't just be circumvented by the debugger.
- smilbandit 12y ago
  I handled the website at the time. Watching the referer entries in those logs would give you a who's who list of cracker sites from around the world.

by earlz 12y ago

AustinDizzy 12y ago

A lot of debuggers and disassemblers do exactly that. They're getting smarter every day, but they still take some knowledge of assembly and lower-level computer science concepts. IDA Pro [0] is a good example of an excellent debugger with plentiful features and productive disassembling tools. [0]: https://www.hex-rays.com/products/ida/ https://www.hex-rays.com/products/ida/

tptacek 12y ago
Most people here (and people I know in the industry) use programmable debuggers --- Ruby and Python libraries that implement the OS debug hooks. If you're on a Mac, like most people who do software security, Hopper.app is a fantastic alternative to IDA.

SEJeff 12y ago

gdb actually has amazingly good python scripting built in if you're using a reasonably new version of it. Redhat lead the charge[1] with what they called 'Project Archer', which was merged into gdb mainline as the python scriptability. [1] http://sourceware.org/gdb/wiki/ProjectArcher http://sourceware.org/gdb/wiki/ProjectArcher

earlz 12y ago
That's pretty interesting. I'll have to look at that more

yaur 12y ago

One thing to keep in mind is that there are only a handful of really good disassemblers and that anyone semi serious about keeping you away can throw in code that will confuse and/or crash them.

sillysaurus3 12y ago
It's possible to confuse or crash IDA Pro, Ollydbg, and Cheat Engine? If one tool won't work, just switch to another.
- yaur 12y ago
  Sure see http://www.exploit-db.com/exploits/23524/ http://www.exploit-db.com/exploits/23524/ and https://forum.tuts4you.com/topic/28804-ollydbg-numberofsections-crash/ https://forum.tuts4you.com/topic/28804-ollydbg-numberofsecti... for instance.
- drblast 12y ago
  It's very possible. Recently I had to manually patch code that was (in assembly) a conditional jump on conditions that at runtime were always true or always false, so the "conditional" part was a red herring. The fact that the conditional was there confused IDA such that it miscalculated the stack usage for many of the functions in the binary and refused to designate them as procedures (which can be decompiled). The telling part was that these conditionals had no other purpose other than to confuse IDA, so you could see the intent was malicious. That's just one example. You REALLY have to know what's going on with the hardware and the intentions of malware authors so you don't blindly accept what your tools are telling you. That's what makes the difference between someone who can do reverse engineering for a living and someone who is good at it. EDIT: One more thing...debugging malware is a last resort; it's very easy to behave one way for a debugger while doing something completely different elsewhere. If you start with automated detection/debugging tools you spend most of your time working around debug detection. If you'd like to know more my email address is in my profile.
  - sillysaurus3 12y ago

rjzzleep 12y ago

It all went downhill, when compuware bought numega and killed softice. yes, ollydbg and windbg work fine, but still...

DEinspanjer 12y ago
Hehe.. I worked for Numega back then. I did tech support and I still remember how often we got tech support requests from people and companies wanting a way to prevent SoftIce from being used to crack their software. So many times I tried to explain to people that there just wasn't really a good way to detect that it was happening that couldn't just be circumvented by the debugger.
smilbandit 12y ago
I handled the website at the time. Watching the referer entries in those logs would give you a who's who list of cracker sites from around the world.