You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Dynamic analysis means observing the behaviour of the binary, while it is running.
4
+
This is performed by tracing or sandboxing.
5
+
6
+
Tracing is the process during which various checkpoints are placed in the code, that send alerts when the execution has reached them.
7
+
Generally, the context (registers, stack, variables) is also displayed.
8
+
9
+
Sandboxing is a more complex process, in which you isolate a binary in a virtual machine (usually), run it and observe the changes made on the system: modified files, network traffic, etc.
10
+
11
+
Today, we are going to explore tracing.
12
+
13
+
## strace
14
+
15
+
`strace` shows system calls performed by a binary application.
16
+
That means opening any kind of file, reading and writing into files, `mprotect`s and other things.
17
+
It is useful to find out if the program does any changes to the system itself, or if it writes in some files.
18
+
19
+
## ltrace
20
+
21
+
`ltrace` shows calls to dynamic library functions, along with system calls.
22
+
It is similar to `strace`.
23
+
24
+
## gdb
25
+
26
+
GDB is the most powerful dynamic analysis tool available to the regular user.
27
+
It allows executing the code instruction by instruction, inspecting memory areas, changing memory areas, jumping to other pieces of code, that weren't executed normally.
28
+
GDB is best used when the user has knowledge about assembly language, which will be presented in the last 2 sessions.
it needs to be compiled and linked, becoming an executable
13
-
- the value of most symbols is placed in the binary file, in sections, and can be observed without actually running the executable
14
-
15
-
## Introduction
16
-
17
-
Today's session aims to give you some tools to analyze a binary, in order to determine what that binary does and if it can hurt your system.
18
-
19
-
## Static Analysis
1
+
# Static Analysis
20
2
21
3
Static analysis implies investigating the binary without running it.
22
4
This means looking into the effective binary file for strings, symbols, interesting addresses and so on.
23
5
24
-
###strings
6
+
## strings
25
7
26
8
`strings` is used to find strings in a binary file - very intuitive.
27
9
It is the most basic static analysis tool available.
28
10
Before any other more complex analysis takes place, a `strings` can find many hidden secrets.
29
11
30
-
###file
12
+
## file
31
13
32
14
`file` is another useful tool, not only for binary analysis.
33
15
It should be used before any investigation, to make sure that the binary is a binary file, and not an archive.
34
16
It also shows if the executable is statically-linked (lots of strings, functions) or dynamically-linked.
35
17
36
-
####Counter-measures
18
+
### Counter-measures
37
19
38
20
For `file` there is no counter-measure to hide the data that would be found by it.
39
21
For `strings`, one way to counter it is to encrypt / obfuscate important data.
40
22
But keep in mind that the codified content will be visible, and can be deciphered.
41
23
That's why they are, almost always, used first when analysing a binary.
42
24
43
-
###nm
25
+
## nm
44
26
45
27
`nm` is used to find **symbols** - variable names, function names, and their addresses.
46
28
It also shows where these symbols are placed: text (T or t), rodata (R or r), bss (B or b), etc.
@@ -51,90 +33,31 @@ Capital-letter symbols are global, meaning they can be referenced from other obj
51
33
Example: `object1.o` has a global symbol named `global_var`.
52
34
`object2.o` can use `global_var`, if `object1.o` and `object2.o` are linked together.
53
35
54
-
####Counter-measures: Strip
36
+
### Counter-measures: Strip
55
37
56
38
`strip` removes all symbols from a binary file.
57
39
If a binary is stripped, `nm` becomes useless.
58
40
59
-
###objdump
41
+
## objdump
60
42
61
43
`objdump` is a disassembler.
62
44
It takes binary files and transforms them to hexadecimal values and, where possible, assembly language.
63
45
It is useful in many cases: when we want to explore the sections of a program, when we want to see what a specific function does, or when we want to make sure that the binary won't crash more complex analysis tools (!).
64
46
`objdump` is a fast way to turn a binary file into more accessible format.
65
47
66
-
####Counter-measures
48
+
### Counter-measures
67
49
68
50
`objdump` is pretty good at what it must do.
69
51
It becomes less helpful if the binary is large, with multiple functions that call each other and we have a hard time understanding the flow of the application.
70
52
That's why it is a bad idea, generally, to break down real-life applications with `objdump`.
71
53
72
-
###Ghidra
54
+
## Ghidra
73
55
74
56
`Ghidra` is a decompiler: it turns a binary file back into C code.
75
57
It also does function analysis, meaning it constructs a tree of function calls.
76
58
It is the best tool to understand what a binary does, without running it.
77
59
78
-
####Counter-measures
60
+
### Counter-measures
79
61
80
62
Unorthodox code, self-changing code, polymorphic code and other measures were taken by various people to counter Ghidra.
81
63
[This talk](https://www.youtube.com/watch?v=HlUe0TUHOIc&ab_channel=DEFCONConference) by Christopher Domas is one of the best examples of measures taken to counter Ghidra and other decompilers.
82
-
83
-
## Dynamic Analysis
84
-
85
-
Dynamic analysis means observing the behaviour of the binary, while it is running.
86
-
This is performed by tracing or sandboxing.
87
-
88
-
Tracing is the process during which various checkpoints are placed in the code, that send alerts when the execution has reached them.
89
-
Generally, the context (registers, stack, variables) is also displayed.
90
-
91
-
Sandboxing is a more complex process, in which you isolate a binary in a virtual machine (usually), run it and observe the changes made on the system: modified files, network traffic, etc.
92
-
93
-
Today, we are going to explore tracing.
94
-
95
-
### strace
96
-
97
-
`strace` shows system calls performed by a binary application.
98
-
That means opening any kind of file, reading and writing into files, `mprotect`s and other things.
99
-
It is useful to find out if the program does any changes to the system itself, or if it writes in some files.
100
-
101
-
### ltrace
102
-
103
-
`ltrace` shows calls to dynamic library functions, along with system calls.
104
-
It is similar to `strace`.
105
-
106
-
### gdb
107
-
108
-
GDB is the most powerful dynamic analysis tool available to the regular user.
109
-
It allows executing the code instruction by instruction, inspecting memory areas, changing memory areas, jumping to other pieces of code, that weren't executed normally.
110
-
GDB is best used when the user has knowledge about assembly language, which will be presented in the last 2 sessions.
111
-
For this session, GDB isn't required.
112
-
113
-
## Summary
114
-
115
-
- Static analysis is the investigation of a binary file without actually running it.
116
-
It means disassembling, decompiling the executable, or directly reading the actual contents of the executable.
117
-
- Static analysis is performed with tools like `strings`, `file`, `nm`, `Ghidra`.
118
-
- Dynamic analysis the investigation of an executable while it is running
119
-
- Dynamic analysis is performed using tools like `strace`, `ltrace`, `gdb`.
120
-
121
-
## Activities
122
-
123
-
### Challenge: Easy to Spot
124
-
125
-
It's an easy challenge.
126
-
Really.
127
-
128
-
### Challenge: Packaging is Important
129
-
130
-
Someone delivered you a mysterious package.
131
-
132
-
### Challenge: Ghidra Killer
133
-
134
-
Some people just hate the people that use decompilers.
135
-
One of those people left you a binary, to investigate.
0 commit comments