Packer Genetics: The selfish code

•Télécharger en tant que PPT, PDF•

3 j'aime•4,355 vues

jduart

Slides presented at ReCon 2010 about the concepts used by the new generic automated unpacker built by zynamics.

Technologie

Packer Genetics: ,[object Object],[object Object],[object Object]

Pythonized Bochs Compiler blood ties The selfish code Unpacking automation for fun and profit

Pythonized Bochs ,[object Object],[object Object],[object Object],[object Object]

Why CPU emulation ,[object Object],[object Object],[object Object],[object Object]

Why CPU emulation ,[object Object],[object Object],[object Object]

Bochs ,[object Object],[object Object],[object Object],[object Object],[object Object]

Drawbacks ,[object Object],[object Object]

Our approach to unpacking ,[object Object],[object Object],[object Object],[object Object],[object Object]

Keep it simple, Stupid! ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Keep it simple, Stupid! ,[object Object],[object Object],[object Object],[object Object],[object Object]

Issues to solve ,[object Object],[object Object],[object Object]

Compiler blood ties Source1 Source2 Source3 Compiler Flags Executables

Different compilers ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Different compilers ,[object Object],[object Object]

Same compiler ,[object Object],[object Object],[object Object]

Blood ties ,[object Object],[object Object],[object Object],compiler-code detection” binaries binary opcodes

Genetics and packers ,[object Object],[object Object]

Genetics and packers .text ,[object Object],[object Object],[object Object]

Gene selection Non packed Packed Gene Candidate Gene Pool Matching Scoring Survival + -

Packed executable Packer code and resources Original binary (compressed, encrypted, etc)

Unpacking process Packer code and resources Original code (unpacked)

Unpacking stats ,[object Object],[object Object],[object Object],[object Object],[object Object]

Problems... ,[object Object],[object Object],[object Object]

Problems... ,[object Object],[object Object],[object Object],[object Object],[object Object]

Work in progress ,[object Object],[object Object],[object Object],[object Object],[object Object],[1] Rotalume: A Tool for Automatic Reverse Engineering of Malware Emulators. http://bit.ly/9XtAeb

Contenu connexe

Tendances

Introduction to Writing Readable and Maintainable Perl (YAPC::EU 2011 Version)Alex Balhatchet

Python programming introductionSiddique Ibrahim

Programmingmonishagoyal4

Presentation of Python, Django, DockerStackDavid Sanchez

ConFoo Montreal - Approaches for application request throttlingMaarten Balliauw

Python pptMohita Pandey

The why and how of moving to php 8Wim Godden

Python final pptRipal Ranpara

The why and how of moving to php 7Wim Godden

Python Programming - I. IntroductionRanel Padon

Python by RjShree M.L.Kakadiya MCA mahila college, Amreli

Object Oriented ApologeticsVance Lucas

Python Tutorial Part 2Haitham El-Ghareeb

Net serializationGreg Sohl

Python Seminar PPTShivam Gupta

Assignment1 B 0Mahmoud

Perl Modulesstn_tkiller

Intro to Pythonprimeteacher32

Python - the basicsUniversity of Technology

File handling & regular expressions in python programmingSrinivas Narasegouda

Tendances (20)

Introduction to Writing Readable and Maintainable Perl (YAPC::EU 2011 Version)

Python programming introduction

Programming

Presentation of Python, Django, DockerStack

ConFoo Montreal - Approaches for application request throttling

Python ppt

The why and how of moving to php 8

Python final ppt

The why and how of moving to php 7

Python Programming - I. Introduction

Python by Rj

Object Oriented Apologetics

Python Tutorial Part 2

Net serialization

Python Seminar PPT

Assignment1 B 0

Perl Modules

Intro to Python

Python - the basics

File handling & regular expressions in python programming

En vedette

ShaREing is Caringzynamics GmbH

Architectural Diversity (German)zynamics GmbH

How to really obfuscate your pdf malwarezynamics GmbH

0-knowledge fuzzing white paperVincenzo Iozzo

Introduction to ida pythongeeksec80

0-knowledge fuzzingVincenzo Iozzo

44CON 2014 - Binary Protocol Analysis with CANAPE, James Forshaw44CON

Formale Methoden im Reverse Engineeringzynamics GmbH

Uni mannheim debuggerszynamics GmbH

En vedette (9)

ShaREing is Caring

Architectural Diversity (German)

How to really obfuscate your pdf malware

0-knowledge fuzzing white paper

Introduction to ida python

0-knowledge fuzzing

44CON 2014 - Binary Protocol Analysis with CANAPE, James Forshaw

Formale Methoden im Reverse Engineering

Uni mannheim debuggers

Similaire à Packer Genetics: The selfish code

Elasticwulf Pycon TalkPeter Skomoroch

Unmanaged Parallelization via P/InvokeDmitri Nesteruk

12 tricks to avoid hackers breaks your CI / CDDaniel Garcia (a.k.a cr0hn)

Exploring .NET memory management - JetBrains webinarMaarten Balliauw

Introduction to Programming in GoAmr Hassan

Steelcon 2014 - Process Injection with Pythoninfodox

How to Meta-Sumo - Using Logs for Agile Monitoring of Production ServicesChristian Beedgen

Dive into exploit developmentPayampardaz

Native client (Евгений Эльцин)Ontico

[CB16] COFI break – Breaking exploits with Processor trace and Practical cont...CODE BLUE

Pi Is For PythonBrad Fortner

Embedded Recipes 2019 - Testing firmware the devops wayAnne Nicolas

Porting your favourite cmdline tool to AndroidVlatko Kosturjak

Itroduction about javasrmohan06

PHP Mega Meetup, Sep, 2020, Anti patterns in phpAhmed Abdou

Compilers and interpretersRAJU KATHI

Reverse engineering with pythonn|u - The Open Security Community

Python3.6 and asynchronous programmingAgeeleshwar K

Big Java Chapter 1Maria Joslin

Practical IoT Exploitation (DEFCON23 IoTVillage) - Lyon YangLyon Yang

Similaire à Packer Genetics: The selfish code (20)

Elasticwulf Pycon Talk

Unmanaged Parallelization via P/Invoke

12 tricks to avoid hackers breaks your CI / CD

Exploring .NET memory management - JetBrains webinar

Introduction to Programming in Go

Steelcon 2014 - Process Injection with Python

How to Meta-Sumo - Using Logs for Agile Monitoring of Production Services

Dive into exploit development

Native client (Евгений Эльцин)

[CB16] COFI break – Breaking exploits with Processor trace and Practical cont...

Pi Is For Python

Embedded Recipes 2019 - Testing firmware the devops way

Porting your favourite cmdline tool to Android

Itroduction about java

PHP Mega Meetup, Sep, 2020, Anti patterns in php

Compilers and interpreters

Reverse engineering with python

Python3.6 and asynchronous programming

Big Java Chapter 1

Practical IoT Exploitation (DEFCON23 IoTVillage) - Lyon Yang

Dernier

Finding Java's Hidden Performance Traps @ DevoxxUK 2024Victor Rentea

Apidays New York 2024 - Accelerating FinTech Innovation by Vasa Krishnan, Fin...apidays

Vector Search -An Introduction in Oracle Database 23ai.pptxRemote DBA Services

MINDCTI Revenue Release Quarter One 2024MIND CTI

Artificial Intelligence Chap.5 : UncertaintyKhushali Kathiriya

Repurposing LNG terminals for Hydrogen Ammonia: Feasibility and Cost SavingEdi Saputra

Apidays New York 2024 - Passkeys: Developing APIs to enable passwordless auth...apidays

Polkadot JAM Slides - Token2049 - By Dr. Gavin WoodJuan lago vázquez

Connector Corner: Accelerate revenue generation using UiPath API-centric busi...DianaGray10

Six Myths about Ontologies: The Basics of Formal Ontologyjohnbeverley2021

Why Teams call analytics are critical to your entire businesspanagenda

FWD Group - Insurer Innovation Award 2024The Digital Insurer

"I see eyes in my soup": How Delivery Hero implemented the safety system for ...Zilliz

AWS Community Day CPH - Three problems of TerraformAndrey Devyatkin

ProductAnonymous-April2024-WinProductDiscovery-MelissaKlemkeProduct Anonymous

Web Form Automation for Bonterra Impact Management (fka Social Solutions Apri...Jeffrey Haguewood

ICT role in 21st century education and its challengesrafiqahmad00786416

Strategies for Landing an Oracle DBA Job as a FresherRemote DBA Services

Apidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, Adobeapidays

DBX First Quarter 2024 Investor PresentationDropbox

Dernier (20)

Finding Java's Hidden Performance Traps @ DevoxxUK 2024

Apidays New York 2024 - Accelerating FinTech Innovation by Vasa Krishnan, Fin...

Vector Search -An Introduction in Oracle Database 23ai.pptx

MINDCTI Revenue Release Quarter One 2024

Artificial Intelligence Chap.5 : Uncertainty

Repurposing LNG terminals for Hydrogen Ammonia: Feasibility and Cost Saving

Apidays New York 2024 - Passkeys: Developing APIs to enable passwordless auth...

Polkadot JAM Slides - Token2049 - By Dr. Gavin Wood

Connector Corner: Accelerate revenue generation using UiPath API-centric busi...

Six Myths about Ontologies: The Basics of Formal Ontology

Why Teams call analytics are critical to your entire business

FWD Group - Insurer Innovation Award 2024

"I see eyes in my soup": How Delivery Hero implemented the safety system for ...

AWS Community Day CPH - Three problems of Terraform

ProductAnonymous-April2024-WinProductDiscovery-MelissaKlemke

Web Form Automation for Bonterra Impact Management (fka Social Solutions Apri...

ICT role in 21st century education and its challenges

Strategies for Landing an Oracle DBA Job as a Fresher

Apidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, Adobe

DBX First Quarter 2024 Investor Presentation

Packer Genetics: The selfish code

2. Pythonized Bochs Compiler blood ties The selfish code Unpacking automation for fun and profit

3. Pythonized Bochs Compiler blood ties The selfish code Unpacking automation for fun and profit

8. Overall Architecture

10.

11.

12.

13.

14. Pythonized Bochs Compiler blood ties The selfish code Unpacking automation for fun and profit

15. Compiler blood ties Source1 Source2 Source3 Compiler Flags Executables

16.

17.

18.

19.

20. Pythonized Bochs Compiler blood ties The selfish code Unpacking automation for fun and profit

21.

22. Genetics and packers

23.

24. Gene selection Non packed Packed Gene Candidate Gene Pool Matching Scoring Survival + -

25. Pythonized Bochs Compiler blood ties The selfish code Unpacking automation for fun and profit

26. Packed executable Packer code and resources Original binary (compressed, encrypted, etc)

27. Unpacking process Packer code and resources Original code (unpacked)

28. Gene[tr]ic unpacker

29. The stop problem

30. DEMO

31.

32.

33.

34.

35. Questions?

Packer Genetics: The selfish code

Recommandé

Recommandé

Contenu connexe

Tendances

Tendances (20)

En vedette

En vedette (9)

Similaire à Packer Genetics: The selfish code

Similaire à Packer Genetics: The selfish code (20)

Dernier

Dernier (20)

Packer Genetics: The selfish code