![TAINT ANALYSIS
taint RAX
mov RCX, RAX
push RCX
…….
mov RCX, ptr [0x1234]](https://image.slidesharecdn.com/postmodernbinaryanalysis-160512150049/85/The-Postmodern-Binary-Analysis-21-320.jpg)
![TAINT ANALYSIS
taint RAX
mov RCX, RAX
push RCX
…….
mov RCX, ptr [0x1234]
pop RBX](https://image.slidesharecdn.com/postmodernbinaryanalysis-160512150049/85/The-Postmodern-Binary-Analysis-22-320.jpg)
![TAINT ANALYSIS
taint RAX
mov RCX, RAX
push RCX
…….
mov RCX, ptr [0x1234]
pop RBX
stop tainting](https://image.slidesharecdn.com/postmodernbinaryanalysis-160512150049/85/The-Postmodern-Binary-Analysis-23-320.jpg)
![TAINT ANALYSIS
taint RAX
mov RCX, RAX
push RCX
…….
mov RCX, ptr [0x1234]
pop RBX
stop tainting
Which are the tainted regs?](https://image.slidesharecdn.com/postmodernbinaryanalysis-160512150049/85/The-Postmodern-Binary-Analysis-24-320.jpg)
![TAINT ANALYSIS
taint RAX
mov RCX, RAX
push RCX
…….
mov RCX, ptr [0x1234]
pop RBX
stop tainting
Which are the tainted regs?
Which are the tainted mems?](https://image.slidesharecdn.com/postmodernbinaryanalysis-160512150049/85/The-Postmodern-Binary-Analysis-25-320.jpg)
![TAINT ANALYSIS
taint RAX
mov RCX, RAX
push RCX
…….
mov RCX, ptr [0x1234]
pop RBX
stop tainting
Which are the tainted regs?
Which are the tainted mems?
RAX, RBX and 8 addresses
from the stack](https://image.slidesharecdn.com/postmodernbinaryanalysis-160512150049/85/The-Postmodern-Binary-Analysis-26-320.jpg)
The Postmodern Binary Analysis
- 1. THE POSTMODERN BINARY ANALYSIS Onur ALANBEL
- 2. $ id -un ➤ Computer Engineer (IZTECH) ➤ Developer @TaintAll (taintall.com) ➤ AppSec Researcher ➤ Blog: onuralanbel.pro ➤ @onuralanbel ➤ https://packetstormsecurity.com/search/?q=onur+alanbel
- 3. AGENDA ➤ Dynamic Binary Instrumentation ➤ Taint Analysis ➤ Constraint Solving With Z3 ➤ Symbolic/Concolic Execution
- 4. DYNAMIC BINARY INSTRUMENTATION ➤ Inject instrumentation code into a running binary.
- 5. DYNAMIC BINARY INSTRUMENTATION ➤ Inject instrumentation code into a running binary. ➤ Instrumentation code executes as normal instructions.
- 6. DYNAMIC BINARY INSTRUMENTATION ➤ Inject instrumentation code into a running binary. ➤ Instrumentation code executes as normal instructions. ➤ Instrumentation is transparent to the application.
- 7. DBI FRAMEWORKS ➤ Intel PIN Framework ➤ Win, Lin, OS X ➤ No IL
- 8. DBI FRAMEWORKS ➤ Intel PIN Framework ➤ Win, Lin, OS X ➤ No IL ➤ Valgrind ➤ Lin, OS X ➤ IL
- 9. DBI FRAMEWORKS ➤ Intel PIN Framework ➤ Win, Lin, OS X ➤ No IL ➤ Valgrind ➤ Lin, OS X ➤ IL ➤ DynamoRIO ➤ Win, Lin, Android ➤ No IL
- 10. DBI FRAMEWORKS ➤ Intel PIN Framework ➤ Win, Lin, OS X ➤ No IL ➤ Valgrind ➤ Lin, OS X ➤ IL ➤ DynamoRIO ➤ Win, Lin, Android ➤ No IL ➤ May be others like ➤ PEMU ➤ …
- 12. SIMPLE SIDE CHANNEL ATTACK
- 13. CAN WE DO BETTER? ➤ Use snapshots instead of Re-run
- 14. CAN WE DO BETTER? ➤ Use snapshots instead of Re-run ➤ Use multi-threading
- 15. CAN WE DO BETTER? ➤ Use snapshots instead of Re-run ➤ Use multi-threading ➤ What about doing something smarter?
- 16. TAINT ANALYSIS ➤ Which parts of the code can be controlled or affected by tainted data (usually user input)
- 17. TAINT ANALYSIS ➤ Which parts of the code can be controlled or affected by tainted data (usually user input)
- 19. TAINT ANALYSIS taint RAX mov RCX, RAX
- 20. TAINT ANALYSIS taint RAX mov RCX, RAX push RCX
- 21. TAINT ANALYSIS taint RAX mov RCX, RAX push RCX ……. mov RCX, ptr [0x1234]
- 22. TAINT ANALYSIS taint RAX mov RCX, RAX push RCX ……. mov RCX, ptr [0x1234] pop RBX
- 23. TAINT ANALYSIS taint RAX mov RCX, RAX push RCX ……. mov RCX, ptr [0x1234] pop RBX stop tainting
- 24. TAINT ANALYSIS taint RAX mov RCX, RAX push RCX ……. mov RCX, ptr [0x1234] pop RBX stop tainting Which are the tainted regs?
- 25. TAINT ANALYSIS taint RAX mov RCX, RAX push RCX ……. mov RCX, ptr [0x1234] pop RBX stop tainting Which are the tainted regs? Which are the tainted mems?
- 26. TAINT ANALYSIS taint RAX mov RCX, RAX push RCX ……. mov RCX, ptr [0x1234] pop RBX stop tainting Which are the tainted regs? Which are the tainted mems? RAX, RBX and 8 addresses from the stack
- 27. TAINT ANALYSIS taint RAX mov AL, 0x1
- 28. TAINT ANALYSIS taint RAX mov AL, 0x1 mov ECX, EAX
- 29. TAINT ANALYSIS taint RAX mov AL, 0x1 mov ECX, EAX cmp ECX, EBX
- 30. TAINT ANALYSIS taint RAX mov AL, 0x1 mov ECX, EAX cmp ECX, EBX jz 0x4321
- 31. TAINT ANALYSIS taint RAX mov AL, 0x1 mov ECX, EAX cmp ECX, EBX jz 0x4321 Can we control this branch?
- 32. TAINT ANALYSIS taint RAX mov AL, 0x1 mov ECX, EAX cmp CL, BL jz 0x4321 What about this one?
- 33. TAINT ANALYSIS taint RAX mov AL, 0x1 mov ECX, EAX cmp CL, BL jz 0x4321 What about this one? taint RCX xor RCX, RDX
- 34. TAINT ANALYSIS taint RAX mov AL, 0x1 mov ECX, EAX cmp CL, BL jz 0x4321 What about this one? taint RCX xor RCX, RDX add RAX, RCX
- 35. TAINT ANALYSIS taint RAX mov AL, 0x1 mov ECX, EAX cmp CL, BL jz 0x4321 What about this one? taint RCX xor RCX, RDX add RAX, RCX Should RAX be tainted?
- 36. TAINT ANALYSIS taint RAX mov AL, 0x1 mov ECX, EAX cmp CL, BL jz 0x4321 What about this one? taint RCX xor RCX, RCX mov RAX, RCX Now, should be ?
- 37. TAINT ANALYSIS ➤ With the help of PIN’s Inspection API (TaintAll)
- 38. TAINT ANALYSIS ➤ With the help of PIN’s Inspection API (TaintAll) ➤ With the help of Symbolic Execution (Triton Framework)
- 39. TAINT ANALYSIS ➤ With the help of PIN’s Inspection API (TaintAll) ➤ With the help of Symbolic Execution (Triton Framework) ➤ Using an Intermediate Language (TaintGrind)
- 40. TAINT ANALYSIS WITH TRITON Triton/src/examples/pin/ runtime_memory_tainting.py with a little modification
- 41. TAINT ANALYSIS WITH TRITON Triton/src/examples/pin/ runtime_memory_tainting.py with a little modification
- 42. A LITTLE BIT OF Z3 ➤ “Z3 is a state-of-the art theorem prover from Microsoft Research”
- 43. A LITTLE BIT OF Z3 ➤ “Z3 is a state-of-the art theorem prover from Microsoft Research” ➤ Input format is an extension of SMT-LIB 2.0 standard
- 44. A LITTLE BIT OF Z3 ➤ “Z3 is a state-of-the art theorem prover from Microsoft Research” ➤ Input format is an extension of SMT-LIB 2.0 standard
- 45. A LITTLE BIT OF Z3 ➤ “Z3 is a state-of-the art theorem prover from Microsoft Research” ➤ Input format is an extension of SMT-LIB 2.0 standard ➤ Or use Z3Py
- 47. For a real world example Search: “Reversing the petya ransomware with constraint solvers”
- 48. SYMBOLIC EXECUTION ➤ x = input() y = x * 5 if x < 20: print “ok” else: print “nope”
- 49. SYMBOLIC EXECUTION ➤ x = input() y = x * 5 if x < 20: print “ok” else: print “nope” y=sym_x*5 sym_x x < 20 ok nope
- 50. CONCRETE EXECUTION ➤ x = input() y = x * 5 if x < 20: print “ok” else: print “nope” y=sym_x*5 sym_x x < 20 ok nope
- 51. CONCOLIC EXECUTION ➤ x = input() y = x * 5 if x < 20: print “ok” else: print “nope” y=sym_x*5 sym_x x < 20 ok nope
- 53. OPEN SOURCE DBA FRAMEWORKS/TOOLS ➤ Triton ➤ Angr ➤ BitBlaze TEMU ➤ Valgrind Tools ➤ PIN Tools
- 54. REFERENCES ➤ http://uninformed.org/index.cgi?v=7&a=1&p=3 ➤ https://software.intel.com/sites/landingpage/pintool/docs/ 76991/Pin/html/ ➤ http://smtlib.cs.uiowa.edu/solvers.shtml