Scribd Logo
Upload

Welcome to Scribd!

  • 212 views

    Anti Reverse Engineering

    Uploaded by

    Ataklti Gebremedhin
    This document discusses anti-reverse engineering techniques used by crimeware and unpacking methods. It begins with an introduction and overview of common anti-debugging and anti-virtual machine techniques used by malware authors. The document then covers custom packers and encryption, methods for detecting packed files, and techniques for unpacking samples to analyze the real code. Specific examples of anti-VM detection code and custom packers are shown. The presentation concludes with a discussion of reconstructing import tables and dumping processes after unpacking.

    Copyright:

    Attribution Non-Commercial (BY-NC)
    Download as PDF, TXT or read online from Scribd

    Anti Reverse Engineering

    Uploaded by

    Ataklti Gebremedhin
    212 views25 pages
    This document discusses anti-reverse engineering techniques used by crimeware and unpacking methods. It begins with an introduction and overview of common anti-debugging and anti-virtual machine techniques used by malware authors. The document then covers custom packers and encryption, methods for detecting packed files, and techniques for unpacking samples to analyze the real code. Specific examples of anti-VM detection code and custom packers are shown. The presentation concludes with a discussion of reconstructing import tables and dumping processes after unpacking.

    Copyright

    © Attribution Non-Commercial (BY-NC)

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    This document discusses anti-reverse engineering techniques used by crimeware and unpacking methods. It begins with an introduction and overview of common anti-debugging and anti-virtual machine techniques used by malware authors. The document then covers custom packers and encryption, methods for detecting packed files, and techniques for unpacking samples to analyze the real code. Specific examples of anti-VM detection code and custom packers are shown. The presentation concludes with a discussion of reconstructing import tables and dumping processes after unpacking.

    Copyright:

    Attribution Non-Commercial (BY-NC)
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    212 views25 pages

    Anti Reverse Engineering

    Uploaded by

    Ataklti Gebremedhin
    This document discusses anti-reverse engineering techniques used by crimeware and unpacking methods. It begins with an introduction and overview of common anti-debugging and anti-virtual machine techniques used by malware authors. The document then covers custom packers and encryption, methods for detecting packed files, and techniques for unpacking samples to analyze the real code. Specific examples of anti-VM detection code and custom packers are shown. The presentation concludes with a discussion of reconstructing import tables and dumping processes after unpacking.

    Copyright:

    Attribution Non-Commercial (BY-NC)
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    of 25

    Crimeware Anti-Reverse Engineering Uncovered APWG 2006

    Nicolas Brulez
    Virus Researcher

    Agenda
    Introduction Crimeware and Anti Reverse Engineering Techniques Anti Debugging Anti Virtual Machine Custom Packers / Protectors Detecting and Removing New Packers File Format Analysis Unpacking Questions

    Introduction
    Anti Reverse Engineering Techniques are becoming very common in CrimeWare. Phishing Trojans use those techniques as well as custom Packers. Those trojans are updated quite often with new anti emulation techniques Bots are using custom packers/protectors as well.

    CrimeWare and Anti Reverse Engineering Techniques


    Anti Debugging
    Common Techniques: IsDebuggerPresent is still the most common and simple. CreateFileA on Debuggers Diver: NTICE etc SEH : Structured Exception Handling to mess with debuggers Less Common: FindWindow to detect Debuggers like OllyDbg CloseHandle on invalid handles to generate an Exception (and then use some timing detection to detect tracing) ZwQueryInformationProcess with ProcessDebugPort Parameter SetUnhandledExceptionFilter can be used to redirect code flow if a debugger is present PEB_LDR_DATA+48h used to check for a debugger. (we should have the imagebase of the process when there is no debugger attached) A lot more techniques are found every now and then.
    4

    CrimeWare and Anti Reverse Engineering Techniques Anti Virtual Machine


    Example from a Banking Trojan:

    CrimeWare and Anti Reverse Engineering Techniques


    Vmware Detection

    CrimeWare and Anti Reverse Engineering Techniques


    Virtual PC detection:

    CrimeWare and Anti Reverse Engineering Techniques


    Newer version of the Banking Trojan uses Generic Virtual Machine detection

    CrimeWare and Anti Reverse Engineering Techniques


    Interrupt Descriptor Table Base Address Check. This one will detect about every Virtual Machine you can find:

    CrimeWare and Anti Reverse Engineering Techniques


    One year ago a PE file infector W32.Bayan has been discovered. Its a Polymorphic Entry Point Obscuring Virus. It uses a random number of encryption layers. Each layer contains junk code. Some of those junk instructions will crash under Vmware (still does in the latest Vmware) Yes, its a virus BUT? A few months after, some Trojans were using the encryption layers from the virus: No more Vmware for the analysis. I wrote a custom tracer (as an Ollydbg Script) to trace and bypass every layers, removing the Anti Vmware instructions. Once the trojan is fully decrypted, we can dump it and analyse the code.
    10

    CrimeWare and Anti Reverse Engineering Techniques

    11

    CrimeWare and Anti Reverse Engineering Techniques


    Custom Packers/Encryption: This screenshot comes from an encrypted dropper. It was first used by a Windows Worm I have seen Trojans using this encrypted dropper Easy enough to be handled from IDA with a generic IDC script

    12

    CrimeWare and Anti Reverse Engineering Techniques


    Example of custom packers: Section name : .ccg (There is a chineese PE protector from a group called CCG, but they are quite different) 68 Exceptions during Self Unpacking Timing Detection with RDTSC to detect single stepping. Many more Anti Debugging tricks: Detect Software breakpoints inside the Application code with SEH etc. Removing the Packer: We can (ab)use the exceptions to quickly bypass every detection tricks. On last exception we can start tracing it (we need to take care of the Breakpoint detection tricks: Software BPX detection and Hardware Breakpoints removal)
    13

    CrimeWare and Anti Reverse Engineering Techniques


    Ollyscript to count the number of Exceptions (look inside the View Window)

    // Nicolas Brulez SEH counter var counter eoe lbl1 run lbl1: cob coe esto add counter, 1 log counter jmp lbl1

    14

    CrimeWare and Anti Reverse Engineering Techniques


    Exception logs from my script:

    15

    CrimeWare and Anti Reverse Engineering Techniques


    Ollyscript to stop before the last Exception so we can finish the debugging manually. // Nicolas Brulez Stop SEH var counter mov counter, 43 eob lbl1 eoe lbl1 run lbl1: cob coe log counter cmp counter, 0 je lbl2 esto sub counter, 1 jmp lbl1 lbl2: ret

    16

    CrimeWare and Anti Reverse Engineering Techniques


    A few Anti Break Points later ;-) : Fully decrypted sample

    17

    Detecting and Removing New Packers


    What is Packing anyway ? Allows to compress/encrypt applications You cant see the code of the application using a disassembler, you need to unpack it first. Packers compress applications and add a small loader to the file. The loader will uncompress the binary in memory, resolve imports, and call the Original Entry Point (OEP). We need to find OEP and dump the process to disk, and rebuild the import table.

    18

    First Steps: Is my file Packed?


    Is the last section executable ? Is the first section writeable ? Is the first section's raw size null ? Is the Entry Point starting in the last section ? Check the section names Check the Import Table : Very few imported functions ? Check the strings : no strings at all ? Is the Raw Size way smaller than the Virtual Size? Compressed!
    19

    First Steps: Is my file Packed?

    20

    Unpacking
    Unpacking knowledge is very handy for Reverse Engineers. Most malwares are packed to hide their real code from Disassemblers. There are a lot of different PE packers and PE protectors out there, and many have no public unpackers. Fortunately, most packers (and Protectors :P) are easy to remove.

    21

    First Steps: Unpacking


    Find the Original Entry Point Trace slowly until you jump to the real program code. Use Static Disassembly to find the jump to original entry point. Smart use of hardware breakpoints. (Write access is your friend). Breakpoints on API Functions. Use Stack (pushad is your friend)

    Dump the process to disk Using tools such as LordPE or Imprec Process dumpers.

    22

    First Steps : Unpacking


    Reconstruct the Import Table Trace the packers code and find where the IAT handling is, so you can grab information about the import table and reconstruct it manually, eventually. (or patch the protector so it will not destroy the imports at all ) You can just use Import Reconstructor to reconstruct the import table and get ride of the boring work most of the time. Sometimes we need to write plugins for Imprec, but usually it only takes a dozen minutes.

    23

    Automatic Anti VM Removal Demo

    Questions?
    English is not my native language, please ask slowly ;-) Thanks If you are interrested into Anti Reverse Engineering Techniques : http://honeynet.org/scans/scan33/ A challenge i made 2 years ago: My complete paper with all the submissions to see how you can attack armored binaries [email protected] http://WebsenseSecurityLabs.com http://www.reverse-engineer.org
    25

    You might also like