VB2013 - Security Research and Development Framework
Download as PPTX, PDF3 likes4,765 views
The document outlines the Security Research and Development Framework (SRDF) created by Amr Thabet, focusing on its purpose as a flexible, open-source development library designed for malware and packet analysis as well as antivirus and firewall tools. It includes major projects such as the Packetyzer and x86 Emulator, offering user-mode and kernel-mode design features with various security tools. The document emphasizes community-based development and provides links for further engagement and access to the framework's resources.
VB2013 - Security Research and Development Framework
- 1. LOGO Security Research and Development Framework By Amr Thabet Malware Researcher @Q-CERT
- 2. About The Author Malware Researcher at Q-CERT Wrote a Stuxnet Malware Analysis Paper Author of Pokas x86 Emulator Author of SRDF (what we will talk about)
- 3. Introduction Development Framework (Library) Contains many security classes/tools Created For: Malware Analysis Packet Analysis Antivirus and Firewall Tools Free and Open Source
- 4. Why SRDF? For This Guy !!
- 5. Why SRDF? Implement your Inovative Idea Don’t re-invent The Wheel Don’t waste your time Flexible Design Production Quality Community Based Development and Beta-testing
- 6. Contents Design • User-Mode • Kernel-Mode • Features Major Projects • Packetyzer • x86 Emulator Projects Based on SRDF • Inspector’s Gadget • Exploitation Detection System (EDS)
- 8. User-Mode Design Infrastructure: The Common Part at any Framework … not related to security Targets: What you will secure or secure from Libraries: The Security Tools are here … it’s divided into Malware and Network Core: The interface and the managment
- 9. Features Full OOP PE, ELF, PDF and Andorid File Parsers x86 Disassembler, Debugger and Emulator API Hooking Packet, Protocol and Network Flow Analysis Production Quality FREE and Open Source
- 10. Kernel-Mode Support x32 Bits until now Little bit old Should be extended to x64 Under Construction
- 12. Major Projects • Packetyzer • x86 Emulator
- 13. Packetyzer Created By Anwar Mohamed Packet Analysis Tool Session Separation Generating Packets and Send (Winpcap) Decodes: ARP,ICMP,TCP,UDP HTTP, DNS Parse PCAP Files Reassemble Packets
- 14. Design
- 15. Simple Demo – Read Pcap File
- 16. Simple Demo – DNS Streams
- 17. Simple Demo – HTTP Streams
- 18. Simple Demo – HTTP Output
- 19. Packetyzer Reach it at: https://github.com/AnwarMohamed/Packetyzer It’s also a Part of SRDF
- 20. Pokas Emulator For win32 Applications very powerful debugger Monitor Memory Writes Emulate PE Files and Shellcode Dump The Process Reconstruct Import Table SRDF has a Wrapper Class for it
- 21. Design
- 22. The Emulator’s Debugger Take String Condition Convert it into Native Code Very Fast Easy to Customize Have Predefined Functions Allow to Add Function
- 23. Examples “__isdirty(eip)“ "__disp() >=0x00401000 &&ecx>10“ "(eax& 0xff)> 5*(edx& 0xff) || __read(0x401000)==0x500“ "__isapiequal('getprocaddress') || __isapiequal('loadlibraryA')“
- 24. Demo: Unpack UPX - PEid
- 25. Demo: Unpack UPX – ImportTable
- 26. Demo: Unpack UPX - Code
- 27. Demo: Unpack UPX – Run Code
- 28. Demo: Unpack UPX - Unpacked
- 29. Demo: Unpack UPX - ImportTable
- 30. x86 Emulator Reach it at: https://github.com/AmrThabet/x86Emulator
- 31. Projects Based on SRDF • Inspector’s Gadget • Exploitation Detection System
- 32. Inspector’s Gadget Created by Jonas lykkegaard ROP gadget indexing and searching tool. Emulating Gadgets Scoring and Categorizing Flexible Search
- 33. Design
- 34. Features Categorizing by Behavior Scoring Gadgets Allow ret, pop/jmp, iret and ret far Depends on SQLite SQL Searching Predefined SQL Queries GUI Based
- 35. GUI
- 37. Exploitation Detection System Security Mitigation Tool Detect memory corruption exploits Based on SRDF Talked about it in Reach it at:Defcon 21 archive
- 38. Normal API call check
- 39. API call with Ret
- 40. Reach Us SRDF Links: https://github.com/AmrThabet/winSRDF FB: http://www.facebook.com/SecDevelop Twitter: https://twitter.com/winSRDF Website: http://security-framework.com/
- 41. Conclusion Development Framework for security Contains many tools in Malware and Network Flexible expandable Design Kernel-Mode and User-Mode Free and Open Source Join Us
- 42. Any Question?
- 43. LOGO