DEF CON 23 - CHRIS DOMAS - REpsych
0 likes53 views
The document discusses reverse engineering techniques and obfuscation using only the mov instruction. It describes how an experienced reverse engineer would approach analyzing code that has been obfuscated to only use mov instructions by tracking data flows and values. An example of obfuscated mov-only code is provided.
![4004e9: mov DWORD PTR [rbp-0x8],0x0
4004f2: push 600004
4004f8: call printf
4004fa: pop eax
4004fc: add DWORD PTR [rbp-0x8],0x1
400500: cmp DWORD PTR [rbp-0x8],0x100
400507: jle 4004f2 <main+0xb>](https://image.slidesharecdn.com/defcon-23-chris-domas-repsych-200502123400/85/DEF-CON-23-CHRIS-DOMAS-REpsych-9-320.jpg)
![4004e9: mov DWORD PTR [rbp-0x8],0x0
4004f2: push 600004
4004f8: call printf
4004fa: pop eax
4004fc: add DWORD PTR [rbp-0x8],0x1
400500: cmp DWORD PTR [rbp-0x8],0x100
400507: jle 4004f2 <main+0xb>](https://image.slidesharecdn.com/defcon-23-chris-domas-repsych-200502123400/85/DEF-CON-23-CHRIS-DOMAS-REpsych-13-320.jpg)
![80515bc: mov eax,ds:0x835d81a
80515c1: mov ebx,DWORD PTR [eax+0x835d6fc]
80515c7: mov edx,DWORD PTR ds:0x835d7da
80515cd: mov eax,0x0
80515d2: mov al,BYTE PTR [ebx+edx*1]
80515d5: mov al,BYTE PTR [eax+0x835dc7e]
80515db: mov BYTE PTR [ebx+edx*1],al
80515de: mov eax,ds:0x835d81a
80515e3: mov ebx,DWORD PTR [eax+0x835d6fc]
80515e9: mov edx,DWORD PTR ds:0x835d7da
80515ef: mov eax,0x0
80515f4: mov al,BYTE PTR [ebx+edx*1]](https://image.slidesharecdn.com/defcon-23-chris-domas-repsych-200502123400/85/DEF-CON-23-CHRIS-DOMAS-REpsych-14-320.jpg)
![mov [dword 0x80a0451],edx
mov eax,0x0
mov ax,[0x80a0451]
mov byte [eax+0x80e17bc],0x0
mov al,[eax+0x80e17bc]
mov [0x80a0451],al
mov eax,[0x80a0556]
mov edx,[eax+0x80a058e]
mov eax,[0x80a0451]
mov eax,[eax+edx]
mov [0x80a044d],eax
mov eax,[0x80a044d]
mov eax,[eax+0x80a054e]
mov dword [eax],0x139
mov eax,[0x80a044d]
mov eax,[eax+0x80a055e]
mov dword [eax],0x0
mov eax,[0x80a044d]
mov eax,[eax+0x80a056e]
mov dword [eax],0x4
mov eax,[0x80a0556]
mov eax,[eax+0x80a05a6]
mov [0x80a0451],eax
mov eax,0x0
mov ax,[0x80a0546]
mov byte [eax+0x80e17bc],0x0
mov al,[eax+0x80e17bc]
mov [0x80a044d],al
mov eax,[0x80a044d]
mov edx,[eax+0x80a058e]
mov eax,[0x80a0451]
mov eax,[eax+edx]
mov [0x80a044d],eax
mov eax,[0x80a0566]
mov eax,[eax+0x80a05a6]
mov [0x80a0451],eax
mov eax,[0x80a044d]
mov edx,[eax+0x80a058e]
mov eax,[0x80a0556]
mov ebx,[eax+0x80a051e]
mov eax,[ebx]
mov edx,0x0
mov dx,[eax+eax+0x80c0bba]
mov [ebx],edx
mov eax,[0x80a0556]
mov ebx,[eax+0x80a051e]
mov eax,[ebx]
mov edx,0x0
mov dx,[eax+eax+0x80c0bba]
mov [ebx],edx
mov eax,[0x80a0556]
mov ebx,[eax+0x80a051e]
mov eax,[ebx]
mov edx,0x0
mov dx,[eax+eax+0x80c0bba]
mov [ebx],edx
mov eax,[0x80a0556]
mov ebx,[eax+0x80a051e]
mov eax,[ebx]
mov edx,0x0
mov dx,[eax+eax+0x80c0bba]
mov [ebx],edx
mov eax,[0x80a0556]
mov ebx,[eax+0x80a051e]
mov eax,[ebx]
mov edx,0x0
mov dx,[eax+eax+0x80c0bba]
mov [ebx],edx
mov eax,[0x80a0556]
mov ebx,[eax+0x80a051e]
mov eax,[ebx]
mov edx,0x0
mov dx,[eax+eax+0x80c0bba]
mov [ebx],edx
mov eax,[0x80a0556]
mov ebx,[eax+0x80a051e]
mov eax,[ebx]
mov edx,0x0
mov dx,[eax+eax+0x80c0bba]
mov [ebx],edx
mov eax,[0x80a0556]
mov ebx,[eax+0x80a051e]
mov eax,[ebx]
mov edx,0x0
mov dx,[eax+eax+0x80c0bba]
mov [ebx],edx
mov eax,[0x80a0556]
mov ebx,[eax+0x80a051e]
mov eax,[ebx]
mov edx,0x0
mov dx,[eax+eax+0x80c0bba]
mov [ebx],edx
mov eax,[0x80a0556]
mov ebx,[eax+0x80a051e]
mov eax,[ebx]
mov edx,0x0
mov dx,[eax+eax+0x80c0bba]
mov [ebx],edx
mov eax,[0x80a0556]
mov ebx,[eax+0x80a051e]
mov eax,[ebx]
mov edx,0x0
mov dx,[eax+eax+0x80c0bba]
mov [ebx],edx
mov eax,[0x80a0556]
mov ebx,[eax+0x80a051e]
mov eax,[ebx]
mov edx,0x0
mov dx,[eax+eax+0x80c0bba]
mov [ebx],edx
mov eax,[0x80a0556]
mov ebx,[eax+0x80a051e]
mov eax,[ebx]
mov edx,0x0
mov dx,[eax+eax+0x80c0bba]
mov [ebx],edx
mov eax,[0x80a0556]
mov ebx,[eax+0x80a051e]
mov eax,[ebx]
mov edx,0x0
mov dx,[eax+eax+0x80c0bba]
mov [ebx],edx
mov eax,[0x80a0556]
mov ebx,[eax+0x80a051e]
mov eax,[ebx]
mov edx,0x0
mov dx,[eax+eax+0x80c0bba]
mov [ebx],edx
mov eax,[0x80a0556]
mov ebx,[eax+0x80a051e]
mov eax,[ebx]
mov edx,0x0
mov dx,[eax+eax+0x80c0bba]
mov [ebx],edx
mov eax,[0x80a0556]
mov ebx,[eax+0x80a051e]
mov eax,[ebx]
mov edx,0x0
mov dx,[eax+eax+0x80c0bba]
mov [ebx],edx
mov eax,[0x80a0556]
mov ebx,[eax+0x80a051e]
mov eax,[ebx]
mov edx,0x0
mov dx,[eax+eax+0x80c0bba]
mov [ebx],edx
mov eax,[0x80a0556]
mov ebx,[eax+0x80a051e]
mov eax,[ebx]
mov edx,0x0
mov dx,[eax+eax+0x80c0bba]
mov [ebx],edx
mov eax,[0x80a0556]
mov ebx,[eax+0x80a051e]
mov eax,[ebx]
mov edx,0x0
mov dx,[eax+eax+0x80c0bba]
mov [ebx],edx
mov eax,[0x80a0556]
mov ebx,[eax+0x80a051e]
mov eax,[ebx]
mov edx,0x0
mov dx,[eax+eax+0x80c0bba]
mov [ebx],edx
mov eax,[0x80a0556]
mov ebx,[eax+0x80a051e]
mov eax,[ebx]
mov edx,0x0
mov dx,[eax+eax+0x80c0bba]
mov [ebx],edx
mov eax,[0x80a0556]
mov ebx,[eax+0x80a051e]
mov eax,[ebx]
mov edx,0x0
mov dx,[eax+eax+0x80c0bba]
mov [ebx],edx
mov eax,[0x80a0556]
mov ebx,[eax+0x80a051e]
mov eax,[ebx]
mov edx,0x0
mov dx,[eax+eax+0x80c0bba]
mov [ebx],edx
mov eax,[0x80a0556]
mov ebx,[eax+0x80a0438]
mov edx,[dword 0x80a0516]
mov eax,0x0
mov al,[ebx+edx]
mov al,[eax+0x80a09ba]
mov edx,[eax+0x80a058e]
mov eax,[0x80a0451]](https://image.slidesharecdn.com/defcon-23-chris-domas-repsych-200502123400/85/DEF-CON-23-CHRIS-DOMAS-REpsych-19-320.jpg)
![mov [dword 0x80a0451],edx
mov eax,0x0
mov ax,[0x80a0451]
mov byte [eax+0x80e17bc],0x0
mov al,[eax+0x80e17bc]
mov [0x80a0451],al
mov eax,[0x80a0556]
mov edx,[eax+0x80a058e]
mov eax,[0x80a0451]
mov eax,[eax+edx]
mov [0x80a044d],eax
mov eax,[0x80a044d]
mov eax,[eax+0x80a054e]
mov dword [eax],0x139
mov eax,[0x80a044d]
mov eax,[eax+0x80a055e]
mov dword [eax],0x0
mov eax,[0x80a044d]
mov eax,[eax+0x80a056e]
mov dword [eax],0x4
mov eax,[0x80a0556]
mov eax,[eax+0x80a05a6]
mov [0x80a0451],eax
mov eax,0x0
mov ax,[0x80a0546]
mov byte [eax+0x80e17bc],0x0
mov al,[eax+0x80e17bc]
mov [0x80a044d],al
mov eax,[0x80a044d]
mov edx,[eax+0x80a058e]
mov eax,[0x80a0451]
mov eax,[eax+edx]
mov [0x80a044d],eax
mov eax,[0x80a0566]
mov eax,[eax+0x80a05a6]
mov [0x80a0451],eax
mov eax,[0x80a044d]
mov edx,[eax+0x80a058e]
mov eax,[0x80a0556]
mov ebx,[eax+0x80a051e]
mov eax,[ebx]
mov edx,0x0
mov dx,[eax+eax+0x80c0bba]
mov [ebx],edx
mov eax,[0x80a0556]
mov ebx,[eax+0x80a051e]
mov eax,[ebx]
mov edx,0x0
mov dx,[eax+eax+0x80c0bba]
mov [ebx],edx
mov eax,[0x80a0556]
mov ebx,[eax+0x80a051e]
mov eax,[ebx]
mov edx,0x0
mov dx,[eax+eax+0x80c0bba]
mov [ebx],edx
mov eax,[0x80a0556]
mov ebx,[eax+0x80a051e]
mov eax,[ebx]
mov edx,0x0
mov dx,[eax+eax+0x80c0bba]
mov [ebx],edx
mov eax,[0x80a0556]
mov ebx,[eax+0x80a051e]
mov eax,[ebx]
mov edx,0x0
mov dx,[eax+eax+0x80c0bba]
mov [ebx],edx
mov eax,[0x80a0556]
mov ebx,[eax+0x80a051e]
mov eax,[ebx]
mov edx,0x0
mov dx,[eax+eax+0x80c0bba]
mov [ebx],edx
mov eax,[0x80a0556]
mov ebx,[eax+0x80a051e]
mov eax,[ebx]
mov edx,0x0
mov dx,[eax+eax+0x80c0bba]
mov [ebx],edx
mov eax,[0x80a0556]
mov ebx,[eax+0x80a051e]
mov eax,[ebx]
mov edx,0x0
mov dx,[eax+eax+0x80c0bba]
mov [ebx],edx
mov eax,[0x80a0556]
mov ebx,[eax+0x80a051e]
mov eax,[ebx]
mov edx,0x0
mov dx,[eax+eax+0x80c0bba]
mov [ebx],edx
mov eax,[0x80a0556]
mov ebx,[eax+0x80a051e]
mov eax,[ebx]
mov edx,0x0
mov dx,[eax+eax+0x80c0bba]
mov [ebx],edx
mov eax,[0x80a0556]
mov ebx,[eax+0x80a051e]
mov eax,[ebx]
mov edx,0x0
mov dx,[eax+eax+0x80c0bba]
mov [ebx],edx
mov eax,[0x80a0556]
mov ebx,[eax+0x80a051e]
mov eax,[ebx]
mov edx,0x0
mov dx,[eax+eax+0x80c0bba]
mov [ebx],edx
mov eax,[0x80a0556]
mov ebx,[eax+0x80a051e]
mov eax,[ebx]
mov edx,0x0
mov dx,[eax+eax+0x80c0bba]
mov [ebx],edx
mov eax,[0x80a0556]
mov ebx,[eax+0x80a051e]
mov eax,[ebx]
mov edx,0x0
mov dx,[eax+eax+0x80c0bba]
mov [ebx],edx
mov eax,[0x80a0556]
mov ebx,[eax+0x80a051e]
mov eax,[ebx]
mov edx,0x0
mov dx,[eax+eax+0x80c0bba]
mov [ebx],edx
mov eax,[0x80a0556]
mov ebx,[eax+0x80a051e]
mov eax,[ebx]
mov edx,0x0
mov dx,[eax+eax+0x80c0bba]
mov [ebx],edx
mov eax,[0x80a0556]
mov ebx,[eax+0x80a051e]
mov eax,[ebx]
mov edx,0x0
mov dx,[eax+eax+0x80c0bba]
mov [ebx],edx
mov eax,[0x80a0556]
mov ebx,[eax+0x80a051e]
mov eax,[ebx]
mov edx,0x0
mov dx,[eax+eax+0x80c0bba]
mov [ebx],edx
mov eax,[0x80a0556]
mov ebx,[eax+0x80a051e]
mov eax,[ebx]
mov edx,0x0
mov dx,[eax+eax+0x80c0bba]
mov [ebx],edx
mov eax,[0x80a0556]
mov ebx,[eax+0x80a051e]
mov eax,[ebx]
mov edx,0x0
mov dx,[eax+eax+0x80c0bba]
mov [ebx],edx
mov eax,[0x80a0556]
mov ebx,[eax+0x80a051e]
mov eax,[ebx]
mov edx,0x0
mov dx,[eax+eax+0x80c0bba]
mov [ebx],edx
mov eax,[0x80a0556]
mov ebx,[eax+0x80a051e]
mov eax,[ebx]
mov edx,0x0
mov dx,[eax+eax+0x80c0bba]
mov [ebx],edx
mov eax,[0x80a0556]
mov ebx,[eax+0x80a051e]
mov eax,[ebx]
mov edx,0x0
mov dx,[eax+eax+0x80c0bba]
mov [ebx],edx
mov eax,[0x80a0556]
mov ebx,[eax+0x80a051e]
mov eax,[ebx]
mov edx,0x0
mov dx,[eax+eax+0x80c0bba]
mov [ebx],edx
mov eax,[0x80a0556]
mov ebx,[eax+0x80a0438]
mov edx,[dword 0x80a0516]
mov eax,0x0
mov al,[ebx+edx]
mov al,[eax+0x80a09ba]
mov edx,[eax+0x80a058e]
mov eax,[0x80a0451]](https://image.slidesharecdn.com/defcon-23-chris-domas-repsych-200502123400/85/DEF-CON-23-CHRIS-DOMAS-REpsych-20-320.jpg)
![“Empty” pixel still needs 2 lines
Increase contrast by reducing impact of those 2
Reduce impact by increasing height
Increase height by increasing width
vfmaddsub132ps xmm0, xmm1, xmmword ptr cs:[edi+esi*4+8068860h]
Enhance contrast](https://image.slidesharecdn.com/defcon-23-chris-domas-repsych-200502123400/85/DEF-CON-23-CHRIS-DOMAS-REpsych-88-320.jpg)
![movzx eax, bh
movzx ecx, dh
dec ecx
xor ebx, ecx
lea ebx, [ebp+1*4]
mov eax, 3526025642
or eax, 188401817
mov ah, 4
lea eax, [ecx+4*edx]
test edx, eax
mov cl, 2
add ebx, ecx
shr eax, 21
movzx ecx, dl
add ebx, ecx
shr eax, 25
mov ah, 4
test edx, eax
shr ecx, 19
movzx eax, bh
or eax, 2742937504
mov ah, 4
and edx, eax](https://image.slidesharecdn.com/defcon-23-chris-domas-repsych-200502123400/85/DEF-CON-23-CHRIS-DOMAS-REpsych-98-320.jpg)
DEF CON 23 - CHRIS DOMAS - REpsych
- 1. REpsych : psycholigical warfare in reverse engineering def con 2015 // domas{
- 2. This serves no purpose Warning
- 3. Taking something apart … … to figure out how it works With software… Interfacing Documentation Obsolescence Bug fixing Academic Reverse Engineering?
- 4. Taking something apart … … to figure out how it works With software… Military/commercial espionage Unauthorized duplication Security analysis Vulnerability analysis Malware analysis Reverse Engineering?
- 5. Whenever we write something awesome… Video game Encryption algorithm Malware 0-Day RAT … someone, at some point, is going to … Capture it Dissect it Reverse it Reverse Engineering?
- 6. If you don’t want your work destroyed … … it pays to plan ahead Anti-RE
- 8. objdump –d –Mintel a.out Reverse Engineering.
- 9. 4004e9: mov DWORD PTR [rbp-0x8],0x0 4004f2: push 600004 4004f8: call printf 4004fa: pop eax 4004fc: add DWORD PTR [rbp-0x8],0x1 400500: cmp DWORD PTR [rbp-0x8],0x100 400507: jle 4004f2 <main+0xb>
- 10. mov is Turing-complete Stephen Dolan http://www.cl.cam.ac.uk/~sd601/papers/mov.pdf mov
- 12. Any code we write … … can be written as a set of movs instead … and nothing else Really? That’d be tough to reverse engineer, wouldn’t it? Turing Complete?
- 13. 4004e9: mov DWORD PTR [rbp-0x8],0x0 4004f2: push 600004 4004f8: call printf 4004fa: pop eax 4004fc: add DWORD PTR [rbp-0x8],0x1 400500: cmp DWORD PTR [rbp-0x8],0x100 400507: jle 4004f2 <main+0xb>
- 14. 80515bc: mov eax,ds:0x835d81a 80515c1: mov ebx,DWORD PTR [eax+0x835d6fc] 80515c7: mov edx,DWORD PTR ds:0x835d7da 80515cd: mov eax,0x0 80515d2: mov al,BYTE PTR [ebx+edx*1] 80515d5: mov al,BYTE PTR [eax+0x835dc7e] 80515db: mov BYTE PTR [ebx+edx*1],al 80515de: mov eax,ds:0x835d81a 80515e3: mov ebx,DWORD PTR [eax+0x835d6fc] 80515e9: mov edx,DWORD PTR ds:0x835d7da 80515ef: mov eax,0x0 80515f4: mov al,BYTE PTR [ebx+edx*1]
- 15. mov-only C Compiler https://github.com/xoreaxeaxeax First single instruction C compiler! The M/o/Vfuscator
- 18. How would an experienced reverse engineer approach this?
- 19. mov [dword 0x80a0451],edx mov eax,0x0 mov ax,[0x80a0451] mov byte [eax+0x80e17bc],0x0 mov al,[eax+0x80e17bc] mov [0x80a0451],al mov eax,[0x80a0556] mov edx,[eax+0x80a058e] mov eax,[0x80a0451] mov eax,[eax+edx] mov [0x80a044d],eax mov eax,[0x80a044d] mov eax,[eax+0x80a054e] mov dword [eax],0x139 mov eax,[0x80a044d] mov eax,[eax+0x80a055e] mov dword [eax],0x0 mov eax,[0x80a044d] mov eax,[eax+0x80a056e] mov dword [eax],0x4 mov eax,[0x80a0556] mov eax,[eax+0x80a05a6] mov [0x80a0451],eax mov eax,0x0 mov ax,[0x80a0546] mov byte [eax+0x80e17bc],0x0 mov al,[eax+0x80e17bc] mov [0x80a044d],al mov eax,[0x80a044d] mov edx,[eax+0x80a058e] mov eax,[0x80a0451] mov eax,[eax+edx] mov [0x80a044d],eax mov eax,[0x80a0566] mov eax,[eax+0x80a05a6] mov [0x80a0451],eax mov eax,[0x80a044d] mov edx,[eax+0x80a058e] mov eax,[0x80a0556] mov ebx,[eax+0x80a051e] mov eax,[ebx] mov edx,0x0 mov dx,[eax+eax+0x80c0bba] mov [ebx],edx mov eax,[0x80a0556] mov ebx,[eax+0x80a051e] mov eax,[ebx] mov edx,0x0 mov dx,[eax+eax+0x80c0bba] mov [ebx],edx mov eax,[0x80a0556] mov ebx,[eax+0x80a051e] mov eax,[ebx] mov edx,0x0 mov dx,[eax+eax+0x80c0bba] mov [ebx],edx mov eax,[0x80a0556] mov ebx,[eax+0x80a051e] mov eax,[ebx] mov edx,0x0 mov dx,[eax+eax+0x80c0bba] mov [ebx],edx mov eax,[0x80a0556] mov ebx,[eax+0x80a051e] mov eax,[ebx] mov edx,0x0 mov dx,[eax+eax+0x80c0bba] mov [ebx],edx mov eax,[0x80a0556] mov ebx,[eax+0x80a051e] mov eax,[ebx] mov edx,0x0 mov dx,[eax+eax+0x80c0bba] mov [ebx],edx mov eax,[0x80a0556] mov ebx,[eax+0x80a051e] mov eax,[ebx] mov edx,0x0 mov dx,[eax+eax+0x80c0bba] mov [ebx],edx mov eax,[0x80a0556] mov ebx,[eax+0x80a051e] mov eax,[ebx] mov edx,0x0 mov dx,[eax+eax+0x80c0bba] mov [ebx],edx mov eax,[0x80a0556] mov ebx,[eax+0x80a051e] mov eax,[ebx] mov edx,0x0 mov dx,[eax+eax+0x80c0bba] mov [ebx],edx mov eax,[0x80a0556] mov ebx,[eax+0x80a051e] mov eax,[ebx] mov edx,0x0 mov dx,[eax+eax+0x80c0bba] mov [ebx],edx mov eax,[0x80a0556] mov ebx,[eax+0x80a051e] mov eax,[ebx] mov edx,0x0 mov dx,[eax+eax+0x80c0bba] mov [ebx],edx mov eax,[0x80a0556] mov ebx,[eax+0x80a051e] mov eax,[ebx] mov edx,0x0 mov dx,[eax+eax+0x80c0bba] mov [ebx],edx mov eax,[0x80a0556] mov ebx,[eax+0x80a051e] mov eax,[ebx] mov edx,0x0 mov dx,[eax+eax+0x80c0bba] mov [ebx],edx mov eax,[0x80a0556] mov ebx,[eax+0x80a051e] mov eax,[ebx] mov edx,0x0 mov dx,[eax+eax+0x80c0bba] mov [ebx],edx mov eax,[0x80a0556] mov ebx,[eax+0x80a051e] mov eax,[ebx] mov edx,0x0 mov dx,[eax+eax+0x80c0bba] mov [ebx],edx mov eax,[0x80a0556] mov ebx,[eax+0x80a051e] mov eax,[ebx] mov edx,0x0 mov dx,[eax+eax+0x80c0bba] mov [ebx],edx mov eax,[0x80a0556] mov ebx,[eax+0x80a051e] mov eax,[ebx] mov edx,0x0 mov dx,[eax+eax+0x80c0bba] mov [ebx],edx mov eax,[0x80a0556] mov ebx,[eax+0x80a051e] mov eax,[ebx] mov edx,0x0 mov dx,[eax+eax+0x80c0bba] mov [ebx],edx mov eax,[0x80a0556] mov ebx,[eax+0x80a051e] mov eax,[ebx] mov edx,0x0 mov dx,[eax+eax+0x80c0bba] mov [ebx],edx mov eax,[0x80a0556] mov ebx,[eax+0x80a051e] mov eax,[ebx] mov edx,0x0 mov dx,[eax+eax+0x80c0bba] mov [ebx],edx mov eax,[0x80a0556] mov ebx,[eax+0x80a051e] mov eax,[ebx] mov edx,0x0 mov dx,[eax+eax+0x80c0bba] mov [ebx],edx mov eax,[0x80a0556] mov ebx,[eax+0x80a051e] mov eax,[ebx] mov edx,0x0 mov dx,[eax+eax+0x80c0bba] mov [ebx],edx mov eax,[0x80a0556] mov ebx,[eax+0x80a051e] mov eax,[ebx] mov edx,0x0 mov dx,[eax+eax+0x80c0bba] mov [ebx],edx mov eax,[0x80a0556] mov ebx,[eax+0x80a051e] mov eax,[ebx] mov edx,0x0 mov dx,[eax+eax+0x80c0bba] mov [ebx],edx mov eax,[0x80a0556] mov ebx,[eax+0x80a0438] mov edx,[dword 0x80a0516] mov eax,0x0 mov al,[ebx+edx] mov al,[eax+0x80a09ba] mov edx,[eax+0x80a058e] mov eax,[0x80a0451]
- 20. mov [dword 0x80a0451],edx mov eax,0x0 mov ax,[0x80a0451] mov byte [eax+0x80e17bc],0x0 mov al,[eax+0x80e17bc] mov [0x80a0451],al mov eax,[0x80a0556] mov edx,[eax+0x80a058e] mov eax,[0x80a0451] mov eax,[eax+edx] mov [0x80a044d],eax mov eax,[0x80a044d] mov eax,[eax+0x80a054e] mov dword [eax],0x139 mov eax,[0x80a044d] mov eax,[eax+0x80a055e] mov dword [eax],0x0 mov eax,[0x80a044d] mov eax,[eax+0x80a056e] mov dword [eax],0x4 mov eax,[0x80a0556] mov eax,[eax+0x80a05a6] mov [0x80a0451],eax mov eax,0x0 mov ax,[0x80a0546] mov byte [eax+0x80e17bc],0x0 mov al,[eax+0x80e17bc] mov [0x80a044d],al mov eax,[0x80a044d] mov edx,[eax+0x80a058e] mov eax,[0x80a0451] mov eax,[eax+edx] mov [0x80a044d],eax mov eax,[0x80a0566] mov eax,[eax+0x80a05a6] mov [0x80a0451],eax mov eax,[0x80a044d] mov edx,[eax+0x80a058e] mov eax,[0x80a0556] mov ebx,[eax+0x80a051e] mov eax,[ebx] mov edx,0x0 mov dx,[eax+eax+0x80c0bba] mov [ebx],edx mov eax,[0x80a0556] mov ebx,[eax+0x80a051e] mov eax,[ebx] mov edx,0x0 mov dx,[eax+eax+0x80c0bba] mov [ebx],edx mov eax,[0x80a0556] mov ebx,[eax+0x80a051e] mov eax,[ebx] mov edx,0x0 mov dx,[eax+eax+0x80c0bba] mov [ebx],edx mov eax,[0x80a0556] mov ebx,[eax+0x80a051e] mov eax,[ebx] mov edx,0x0 mov dx,[eax+eax+0x80c0bba] mov [ebx],edx mov eax,[0x80a0556] mov ebx,[eax+0x80a051e] mov eax,[ebx] mov edx,0x0 mov dx,[eax+eax+0x80c0bba] mov [ebx],edx mov eax,[0x80a0556] mov ebx,[eax+0x80a051e] mov eax,[ebx] mov edx,0x0 mov dx,[eax+eax+0x80c0bba] mov [ebx],edx mov eax,[0x80a0556] mov ebx,[eax+0x80a051e] mov eax,[ebx] mov edx,0x0 mov dx,[eax+eax+0x80c0bba] mov [ebx],edx mov eax,[0x80a0556] mov ebx,[eax+0x80a051e] mov eax,[ebx] mov edx,0x0 mov dx,[eax+eax+0x80c0bba] mov [ebx],edx mov eax,[0x80a0556] mov ebx,[eax+0x80a051e] mov eax,[ebx] mov edx,0x0 mov dx,[eax+eax+0x80c0bba] mov [ebx],edx mov eax,[0x80a0556] mov ebx,[eax+0x80a051e] mov eax,[ebx] mov edx,0x0 mov dx,[eax+eax+0x80c0bba] mov [ebx],edx mov eax,[0x80a0556] mov ebx,[eax+0x80a051e] mov eax,[ebx] mov edx,0x0 mov dx,[eax+eax+0x80c0bba] mov [ebx],edx mov eax,[0x80a0556] mov ebx,[eax+0x80a051e] mov eax,[ebx] mov edx,0x0 mov dx,[eax+eax+0x80c0bba] mov [ebx],edx mov eax,[0x80a0556] mov ebx,[eax+0x80a051e] mov eax,[ebx] mov edx,0x0 mov dx,[eax+eax+0x80c0bba] mov [ebx],edx mov eax,[0x80a0556] mov ebx,[eax+0x80a051e] mov eax,[ebx] mov edx,0x0 mov dx,[eax+eax+0x80c0bba] mov [ebx],edx mov eax,[0x80a0556] mov ebx,[eax+0x80a051e] mov eax,[ebx] mov edx,0x0 mov dx,[eax+eax+0x80c0bba] mov [ebx],edx mov eax,[0x80a0556] mov ebx,[eax+0x80a051e] mov eax,[ebx] mov edx,0x0 mov dx,[eax+eax+0x80c0bba] mov [ebx],edx mov eax,[0x80a0556] mov ebx,[eax+0x80a051e] mov eax,[ebx] mov edx,0x0 mov dx,[eax+eax+0x80c0bba] mov [ebx],edx mov eax,[0x80a0556] mov ebx,[eax+0x80a051e] mov eax,[ebx] mov edx,0x0 mov dx,[eax+eax+0x80c0bba] mov [ebx],edx mov eax,[0x80a0556] mov ebx,[eax+0x80a051e] mov eax,[ebx] mov edx,0x0 mov dx,[eax+eax+0x80c0bba] mov [ebx],edx mov eax,[0x80a0556] mov ebx,[eax+0x80a051e] mov eax,[ebx] mov edx,0x0 mov dx,[eax+eax+0x80c0bba] mov [ebx],edx mov eax,[0x80a0556] mov ebx,[eax+0x80a051e] mov eax,[ebx] mov edx,0x0 mov dx,[eax+eax+0x80c0bba] mov [ebx],edx mov eax,[0x80a0556] mov ebx,[eax+0x80a051e] mov eax,[ebx] mov edx,0x0 mov dx,[eax+eax+0x80c0bba] mov [ebx],edx mov eax,[0x80a0556] mov ebx,[eax+0x80a051e] mov eax,[ebx] mov edx,0x0 mov dx,[eax+eax+0x80c0bba] mov [ebx],edx mov eax,[0x80a0556] mov ebx,[eax+0x80a051e] mov eax,[ebx] mov edx,0x0 mov dx,[eax+eax+0x80c0bba] mov [ebx],edx mov eax,[0x80a0556] mov ebx,[eax+0x80a0438] mov edx,[dword 0x80a0516] mov eax,0x0 mov al,[ebx+edx] mov al,[eax+0x80a09ba] mov edx,[eax+0x80a058e] mov eax,[0x80a0451]
- 21. Anti-RE Code doesn’t have to be hard to reverse Just need to make the reverser give up Realization
- 22. Demoralization Break down the reverser Psychological Warfare
- 23. How else can we make a reverser quit? Psychological Warfare
- 26. ..cantor.dust..
- 27. Visualize data patterns Default: entropy distribution ..cantor.dust..
- 28. ..cantor.dust..
- 29. Send a message? Run a message through an inverse Hilbert transform Rebuild program to match desired entropy ..cantor.dust..
- 30. ..cantor.dust..
- 32. These are horrible… No one will ever see the message And if they do, they won’t care Need something better… Sending messages
- 33. IDA
- 34. IDA
- 36. IDA…
- 37. Hopper…
- 38. BinNavi…
- 39. Radare…
- 40. We’ll look at IDA But the algorithm will work on anything IDA
- 41. If you stare at these control graphs long enough… … they almost start to look like things Idea…
- 45. Could we send a message through a CFG? Reverse engineer IDA? Yep! Drawing with CFGs
- 46. Draw horizontal lines: Switch “Orphan” jumps jmp a jmp a jmp a jmp a jmp a jmp a a: Idea 1
- 48. Draw vertical lines: Non-branching code nop nop nop nop nop nop Idea 1
- 50. Combining the two Etch-a-sketch, in IDA! Idea 1
- 51. top: jmp left jmp top_end … ; repeat jmp right_side top_end: jmp $ left_side: nop … ; repeat jmp bottom_left right_side: nop … ; repeat jmp bottom_right bottom: botton_left: jmp bottom_end … ; repeat bottom_right: bottom_end: ret
- 53. IDA tries to align blocks in a given row Observation
- 54. top: jmp left jmp top_end … ; repeat jmp right_side top_end: jmp $ left_side: jmp $+2 … ; repeat jmp bottom_left right_side: jmp $+2 … ; repeat jmp bottom_right bottom: botton_left: jmp bottom_end … ; repeat bottom_right: bottom_end: ret
- 56. IDA tries to keep rows/columns together But minimize branching distance Observation
- 57. Hour of tinkering Couldn’t make it work Try something else Separating the columns
- 58. We have some control over how rows are arranged Depends on nodes between IDA has all the control over columns Can rearrange parent nodes and branches to keep columns close together R.I.P. Idea 1
- 59. Force IDA to keep things in order Tie nodes together as tightly as possible Prevent rearranging Idea 2
- 60. A node
- 61. A tightly woven CFG
- 62. x: a0: je b1 b0: je c1 c0: je d1 d0: jmp F a1: je b2 b1: je c2 c1: je d2 d1: jmp F a2: je b3 b2: je c3 c2: je d3 d2: jmp F a3: b3: c3: d3: jmp F F:
- 65. %macro column 3-4 "nonempty" %assign r 0 %assign c %1 %rep %2-1 %assign nr r+1 %assign nc c+1 e_%+r%+_%+c: %ifidn %4, "empty" %else je e_%+nr%+_%+nc %endif %assign r r+1 %endrep e_%+r%+_%+c: jmp %3 %endmacro
- 67. “Weave” the CFG together Turn “pixel” off by removing node? Idea 2, continued
- 68. A tightly woven CFG
- 70. A tightly woven CFG
- 71. A tightly woven CFG, II
- 72. x: e_0_0: je e_1_1 jmp done e_0_1: je e_2_1 e_1_0: je e_2_1 jmp done e_0_2: je e_1_3 e_1_1: je e_2_2 e_2_0: je e_3_1 jmp done e_0_3: je done e_1_2: je e_2_3 e_2_1: je e_3_2 e_3_0: jmp done e_1_3: je done e_2_2: je e_3_3 e_3_1: jmp done e_2_3: je done e_3_2: jmp done e_3_3: jmp done done: ret ; e_0_0 e_0_1 e_0_2 e_0_3 ; e_1_0 e_1_1 e_1_2 e_1_3 ; e_2_0 e_2_1 e_2_2 e_2_3 ; e_3_0 e_3_1 e_3_2 e_3_3
- 74. ; row, column, width, height, done %macro diag 5 %assign r %1 %assign c %2 %assign width %3 %assign height %4 %rep 256 ; max size %assign nr r+1 %assign nc c+1 e_%+r%+_%+c: %if nr >= height %elif nc >= width je e_%+nr%+_%+c %else %if c == 0 jmp e_%+nr%+_%+nc %exitrep %else je e_%+nr%+_%+nc %endif %endif %assign r r+1 %assign c c-1 %if r>=width jmp %5 %exitrep %endif %endrep %endmacro
- 81. We still can’t remove a node R.I.P. Idea 2
- 82. Leave all nodes Fill with code if “on” Leave empty if “off” Idea 3
- 88. “Empty” pixel still needs 2 lines Increase contrast by reducing impact of those 2 Reduce impact by increasing height Increase height by increasing width vfmaddsub132ps xmm0, xmm1, xmmword ptr cs:[edi+esi*4+8068860h] Enhance contrast
- 95. Insert always on column Almost there
- 97. Add a junk code generator Almost there
- 98. movzx eax, bh movzx ecx, dh dec ecx xor ebx, ecx lea ebx, [ebp+1*4] mov eax, 3526025642 or eax, 188401817 mov ah, 4 lea eax, [ecx+4*edx] test edx, eax mov cl, 2 add ebx, ecx shr eax, 21 movzx ecx, dl add ebx, ecx shr eax, 25 mov ah, 4 test edx, eax shr ecx, 19 movzx eax, bh or eax, 2742937504 mov ah, 4 and edx, eax
- 99. BMP to %assign converter Almost there
- 100. %assign pixel_13_5 1 %assign pixel_14_5 1 %assign pixel_15_5 0 %assign pixel_16_5 1 %assign pixel_17_5 0 %assign pixel_18_5 1 %assign pixel_19_5 1 %assign pixel_20_5 0 %assign pixel_21_5 1 %assign pixel_22_5 0 %assign pixel_23_5 0 %assign pixel_24_5 0 %assign pixel_25_5 1 %assign pixel_0_6 1 %assign pixel_1_6 1 %assign pixel_2_6 1 %assign pixel_3_6 1 %assign pixel_4_6 1 %assign pixel_5_6 1 %assign pixel_6_6 1 %assign pixel_7_6 1
- 108. REpsych Toolchain Generates assembly … … to form images through CFGs (Demo) REpsych
- 111. Reverser is forced to sit and stare at whatever message you embed Use it to your advantage, crush their soul Psychological Warfare
- 115. (Draw an assembly selfie) Grayscale
- 117. Stego
- 120. QR a.k.a. the ultimate CTF problem More ideas
- 122. Creepiest malware ever Scans your hard disk Rewrites itself to match your personal images (Demo) More ideas
- 123. 14 lines of assembly 328 lines of preprocessor macros
- 124. github.com/xoreaxeaxeax REpysch M/o/Vfuscator 2.0 x86 0-day POC Etc. Feedback? domas @xoreaxeaxeax xoreaxeaxeax@gmail.com