BSides Rochester 2018: Dave Kukfa: BinDbg: Easy Windows Debugging for Binary Ninja
- 1. BinDbg: Easy Windows Debugging for Binary Ninja Dave Kukfa https://kukfa.co @kukfa_
- 2. whoami ● Dave Kukfa ● Corporate security engineer by day ● Hobbyist reverse engineer by night ● RIT CSEC Graduate ● SF Bay Area ● Blog: https://kukfa.co ● Twitter: @kukfa_ Disclaimer: This talk and all materials are being released on my own behalf, not on behalf of my employer
- 3. Binary analysis tools ● Gold standard: IDA Pro ○ $$$ ○ Typically only justifiable by professionals ● Several recent challengers: ○ Radare ○ Hopper ○ Binary Ninja ● Binary Ninja is a powerful static analysis tool ○ Looking at the program’s disassembly without executing it ● I missed the dynamic (debugger) integrations that IDA had ○ So I set out to recreate it in Binja! Source: https://binary.ninja/ Source: https://www.hex-rays.com/products/ida/
- 4. BinDbg ● Binary Ninja plugin that syncs a running debugger (WinDbg) to Binary Ninja ○ Combining static and dynamic analyses ○ Use the debugger’s information to supplement Binary Ninja’s analysis ○ Control the debugger within Binary Ninja ● This has been done before ○ snare’s Binjatron: https://github.com/snare/binjatron ○ Eric Hennenfent’s Binja Dynamics: https://github.com/ehennenfent/binja_dynamics ● Windows support on existing solutions is lacking ○ Because I primarily reverse PEs, I wanted to create an easy-to-use Windows solution
- 5. Primary features (1/4) ● Launch and control debugging sessions directly from Binary Ninja ● Syncs Binja disassembly graph with WinDbg instruction pointer
- 6. Primary features (2/4) ● Set breakpoints and move instruction pointer directly on Binja’s disassembly graph
- 7. Primary features (3/4) ● Highlight branch decisions on disassembly graph (see where jumps are going)
- 8. Primary features (4/4) ● Resolve vtable calls and vtable references (determine object types)
- 9. Demo
- 10. Lessons learned ● Lots of time spent wrestling with pykd ○ Just catch its exceptions and keep going ¯_(ツ)_/¯ ● Determining object type using vtables is not 100% reliable ○ In the case of multiple inheritance, can’t just observe the first vtable and call it a day ● Windows is weird ○ Named pipes implementation ○ API and COM interfaces ● In hindsight, would have been easier to improve Windows support on existing tools