1
00:00:00,330 --> 00:00:03,120
- This morning, we have a
pre-recorded talk for you.

2
00:00:03,120 --> 00:00:04,470
Atlas is gonna be talking to us

3
00:00:04,470 --> 00:00:07,410
about Emulation Driven
Reverse Engineering.

4
00:00:07,410 --> 00:00:08,710
Please sit back and enjoy.

5
00:00:11,310 --> 00:00:14,820
- I unfortunately was unable
to make it out there this year

6
00:00:14,820 --> 00:00:16,623
due to family health issues,

7
00:00:17,490 --> 00:00:19,260
but hopefully I'll be
back there next year.

8
00:00:19,260 --> 00:00:22,620
Thankfully, Nikita was kind enough

9
00:00:22,620 --> 00:00:24,690
to let me record something
and send it out to you.

10
00:00:24,690 --> 00:00:25,990
Hopefully you'll enjoy it.

11
00:00:32,970 --> 00:00:35,100
Now, some of you have
seen me speak in the past,

12
00:00:35,100 --> 00:00:37,110
and if you've seen me talk
in the last few years,

13
00:00:37,110 --> 00:00:39,360
you've noticed that I've
talked a lot about emulation.

14
00:00:39,360 --> 00:00:42,030
I've talked a lot about symbolic execution

15
00:00:42,030 --> 00:00:45,390
and emulation and static analysis

16
00:00:45,390 --> 00:00:47,700
for reversing and bug hunting.

17
00:00:47,700 --> 00:00:52,440
So today's talk, unsurprisingly,
is about emulation.

18
00:00:52,440 --> 00:00:55,590
Today is about emulation-driven RE.

19
00:00:55,590 --> 00:00:58,530
You'll figure out what that
means in a few minutes,

20
00:00:58,530 --> 00:01:00,720
basically, how do we
let the computer do more

21
00:01:00,720 --> 00:01:01,830
of the hard work

22
00:01:01,830 --> 00:01:05,523
so you can do more of the fun
stuff and not rot your brain?

23
00:01:06,630 --> 00:01:08,700
So a little bit about who am I,

24
00:01:08,700 --> 00:01:10,530
many of you know me,

25
00:01:10,530 --> 00:01:14,250
I've broke out a VMware
with an amazing team,

26
00:01:14,250 --> 00:01:16,080
done a lot of power grid hacking,

27
00:01:16,080 --> 00:01:18,150
generated a tool called RfCat,

28
00:01:18,150 --> 00:01:19,950
done a lot of car hacking lately

29
00:01:19,950 --> 00:01:22,590
and I'm a Vivisect core dev.

30
00:01:22,590 --> 00:01:24,570
I played a lot of capture the flag.

31
00:01:24,570 --> 00:01:26,820
Some might say that I'm addicted.

32
00:01:26,820 --> 00:01:29,190
More importantly, I am a Jesus follower,

33
00:01:29,190 --> 00:01:31,287
a daddy husband and,

34
00:01:31,287 --> 00:01:33,690
not a daddy husband,
a daddy and a husband.

35
00:01:33,690 --> 00:01:36,640
And I'm a principal researcher
for the company named GRIMM.

36
00:01:37,620 --> 00:01:38,760
Just to give you a quick refresher

37
00:01:38,760 --> 00:01:41,370
before we jump into the
fun stuff on emulation,

38
00:01:41,370 --> 00:01:42,300
what is emulation?

39
00:01:42,300 --> 00:01:43,350
How do you do emulation?

40
00:01:43,350 --> 00:01:45,150
Oh my gosh! You're going crazy.

41
00:01:45,150 --> 00:01:47,760
Emulation is actually very simple.

42
00:01:47,760 --> 00:01:50,430
You have to keep track of registers,

43
00:01:50,430 --> 00:01:52,740
you have to keep track of memory

44
00:01:52,740 --> 00:01:56,100
and you have to implement instructions

45
00:01:56,100 --> 00:01:57,930
that an architecture would

46
00:01:57,930 --> 00:02:02,460
that act on the memory and the registers.

47
00:02:02,460 --> 00:02:04,410
You might implement peripherals

48
00:02:04,410 --> 00:02:06,840
if you're trying to go
a little bit further.

49
00:02:06,840 --> 00:02:08,700
I know that QMU and a lot of the emulators

50
00:02:08,700 --> 00:02:11,190
that you see definitely do.

51
00:02:11,190 --> 00:02:15,090
For our purposes is not
necessarily always important.

52
00:02:15,090 --> 00:02:16,710
Sometimes can help.

53
00:02:16,710 --> 00:02:19,770
Sometimes you'll also implement
system calls and interrupts

54
00:02:19,770 --> 00:02:20,853
and handle those.

55
00:02:21,870 --> 00:02:24,930
So what does emulation do for us?

56
00:02:24,930 --> 00:02:25,763
Well, in many cases,

57
00:02:25,763 --> 00:02:28,410
we can write analysis
modules using an emulator,

58
00:02:28,410 --> 00:02:31,080
a lightweight emulator
that can answer questions

59
00:02:31,080 --> 00:02:34,787
that might be a lot harder to answer,

60
00:02:36,330 --> 00:02:38,820
or at least abstract
to cover a whole bunch

61
00:02:38,820 --> 00:02:41,340
of different circumstances
in architectures.

62
00:02:41,340 --> 00:02:44,610
You can also use emulator
to get immediate context,

63
00:02:44,610 --> 00:02:46,620
and I'll show you about
that in just a minute,

64
00:02:46,620 --> 00:02:48,213
within a function.

65
00:02:49,380 --> 00:02:52,770
And basically the answer of the day,

66
00:02:52,770 --> 00:02:54,840
emulation does the thing you need it to.

67
00:02:54,840 --> 00:02:58,020
So it's like you're creating
these little minions

68
00:02:58,020 --> 00:02:59,940
that you go off and you
tell them to do this thing,

69
00:02:59,940 --> 00:03:04,440
and they return back with this
big milk crate full of junk

70
00:03:04,440 --> 00:03:06,600
that may have really awesome stuff in it,

71
00:03:06,600 --> 00:03:08,880
may have a little bit of craft;
you gotta weed through it,

72
00:03:08,880 --> 00:03:10,950
or you write your code
even more intelligent

73
00:03:10,950 --> 00:03:12,990
to weed through it even better.

74
00:03:12,990 --> 00:03:16,320
So a little bit more beyond
the idea of emulation,

75
00:03:16,320 --> 00:03:18,750
'cause you guys have run
into emulation before

76
00:03:18,750 --> 00:03:21,603
with whether it's Game
Boy emulation or QMU.

77
00:03:22,560 --> 00:03:26,430
Partial emulation is the
idea of emulating code

78
00:03:26,430 --> 00:03:28,830
that you don't have the full context for.

79
00:03:28,830 --> 00:03:30,930
So most emulators that you would run into,

80
00:03:30,930 --> 00:03:34,230
probably all the emulators
you knowingly ran into,

81
00:03:34,230 --> 00:03:35,610
start at a given point

82
00:03:35,610 --> 00:03:37,320
like the start of a binary program

83
00:03:37,320 --> 00:03:39,270
or the start of a firmware.

84
00:03:39,270 --> 00:03:42,600
And you start off and it's got
the initialization process,

85
00:03:42,600 --> 00:03:46,170
and it goes through everything,
setting up everything.

86
00:03:46,170 --> 00:03:48,810
And gee, that sounds a lot like execution

87
00:03:48,810 --> 00:03:51,510
and you can debug execution.

88
00:03:51,510 --> 00:03:54,270
Partial emulation allows
you to get around some

89
00:03:54,270 --> 00:03:59,040
of the issues of getting full context

90
00:03:59,040 --> 00:04:01,560
by providing things like
safe reads and writes.

91
00:04:01,560 --> 00:04:04,500
If the emulator runs into
a read of memory location

92
00:04:04,500 --> 00:04:07,170
that doesn't exist or a
write, it'll just say,

93
00:04:07,170 --> 00:04:09,600
phew, let's pretend that that worked.

94
00:04:09,600 --> 00:04:12,870
And then on a read, it'll just
give you the correct amount

95
00:04:12,870 --> 00:04:16,500
of bytes back of some known
value so that you can say,

96
00:04:16,500 --> 00:04:19,770
oh, hey, that looks like a
lower case a or a bunch of them.

97
00:04:19,770 --> 00:04:23,130
In our case, that's what
we'll run into for safe reads.

98
00:04:23,130 --> 00:04:26,640
We can log reads and writes
through an emulation pass.

99
00:04:26,640 --> 00:04:30,930
So if you run through a
function, emulate through it,

100
00:04:30,930 --> 00:04:33,912
you can have all the
things that are read to

101
00:04:33,912 --> 00:04:36,360
and written to tracked for you

102
00:04:36,360 --> 00:04:41,360
as well as a path that
your emulation pass carved

103
00:04:41,760 --> 00:04:43,503
through the function or code.

104
00:04:44,430 --> 00:04:46,470
You can also snap in AnalysisMonitors

105
00:04:46,470 --> 00:04:47,670
or emulation monitors.

106
00:04:47,670 --> 00:04:50,520
AnalysisMonitor is just
a special version of one

107
00:04:50,520 --> 00:04:52,620
with a lot of wrapped in goodies.

108
00:04:52,620 --> 00:04:54,390
An emulation monitor is simply something

109
00:04:54,390 --> 00:04:58,740
that gets to watch as emulation happens

110
00:04:58,740 --> 00:05:02,580
and maybe make decisions or
at least track information,

111
00:05:02,580 --> 00:05:04,920
and we'll talk about
that in a few minutes.

112
00:05:04,920 --> 00:05:06,663
And then taint tracking.

113
00:05:08,487 --> 00:05:11,490
We got a great taint
engine that we can say,

114
00:05:11,490 --> 00:05:13,440
hey, just gimme a number.

115
00:05:13,440 --> 00:05:15,450
I'm gonna show that
number in here and here,

116
00:05:15,450 --> 00:05:19,590
that number really means
initialized register RDX

117
00:05:19,590 --> 00:05:24,590
or this argument zero, for example.

118
00:05:24,750 --> 00:05:28,590
So this kind of feels
like baby monitor protocol

119
00:05:28,590 --> 00:05:32,100
and in a lot of really
amazing ways, it is.

120
00:05:32,100 --> 00:05:33,408
In a good way.

121
00:05:33,408 --> 00:05:34,680
Don't be offended.

122
00:05:34,680 --> 00:05:36,960
So a few examples of emulation at work.

123
00:05:36,960 --> 00:05:39,450
We're gonna talk about
four specific ones today.

124
00:05:39,450 --> 00:05:41,520
Immediate context, we've
already gone over it before

125
00:05:41,520 --> 00:05:42,900
if you've seen one of my previous talks,

126
00:05:42,900 --> 00:05:45,120
but it's still so amazing
and so easy to use

127
00:05:45,120 --> 00:05:46,710
that I gotta call it out.

128
00:05:46,710 --> 00:05:50,670
We're gonna talk about
the built in Vivisect i386

129
00:05:50,670 --> 00:05:52,530
calling convention analysis module

130
00:05:52,530 --> 00:05:54,750
because it uses AnalysisMonitors,

131
00:05:54,750 --> 00:05:57,410
it uses a lot of the emulation stuff

132
00:05:57,410 --> 00:05:58,560
that we're talking about.

133
00:05:58,560 --> 00:06:01,950
And then we'll go on to a
little gizmo that I created

134
00:06:01,950 --> 00:06:05,310
and continue to implement
on my own called FuncRecon

135
00:06:05,310 --> 00:06:06,690
or Function Recon.

136
00:06:06,690 --> 00:06:09,240
I implemented it as a Vivisect extension.

137
00:06:09,240 --> 00:06:12,123
Vivisect is my tool of choice,

138
00:06:13,208 --> 00:06:14,041
and it provides a ton

139
00:06:14,041 --> 00:06:16,773
of these partial emulation toys for me.

140
00:06:18,270 --> 00:06:19,590
And then at the end,

141
00:06:19,590 --> 00:06:21,090
the whole reason that you're here

142
00:06:21,090 --> 00:06:24,180
and not at a previous talk is NinjaEmu,

143
00:06:24,180 --> 00:06:26,790
and how we can use emulators

144
00:06:26,790 --> 00:06:28,833
to drive our reverse engineering.

145
00:06:29,940 --> 00:06:32,550
So starting off, immediate context.

146
00:06:32,550 --> 00:06:37,550
so built into Vivisect when
you're displaying a function,

147
00:06:38,400 --> 00:06:42,300
you can right click on
anywhere in the function

148
00:06:42,300 --> 00:06:44,493
and go to the function sub menu,

149
00:06:45,600 --> 00:06:48,180
and there's an option
called show emulator state.

150
00:06:48,180 --> 00:06:53,180
Basically what's gonna happen
is when you click on this,

151
00:06:53,580 --> 00:06:56,580
Vivisect is going to spin
up a workspace emulator,

152
00:06:56,580 --> 00:06:58,920
which has all the bells and
whistles with safe reads

153
00:06:58,920 --> 00:07:01,420
and taint tracking and
path tracking and all that.

154
00:07:02,580 --> 00:07:05,850
And it will say I'm going to find a path

155
00:07:05,850 --> 00:07:07,860
and emulate to this location,

156
00:07:07,860 --> 00:07:11,640
and what I do, I'm going
to spit out the context

157
00:07:11,640 --> 00:07:12,473
of that path.

158
00:07:12,473 --> 00:07:14,760
So at the bottom of the
screen is the output

159
00:07:14,760 --> 00:07:17,880
from show emulator state,
running emulator to,

160
00:07:17,880 --> 00:07:19,860
and it's that address, 32d0e.

161
00:07:19,860 --> 00:07:23,520
And you can see that right in
the function title at the head

162
00:07:23,520 --> 00:07:25,020
or on the top.

163
00:07:25,020 --> 00:07:28,020
showing register/magic
state at that location.

164
00:07:28,020 --> 00:07:29,040
Stack Delta 0.

165
00:07:29,040 --> 00:07:31,830
We haven't actually
changed the stack at all.

166
00:07:31,830 --> 00:07:33,630
Okay, that's good to know.

167
00:07:33,630 --> 00:07:36,153
And here's the instruction 32d0e,

168
00:07:37,710 --> 00:07:42,710
is the ldrh r2 from a D
reference of the r2 register.

169
00:07:44,580 --> 00:07:47,943
This is a power PC, or I'm
sorry, this is an r function.

170
00:07:50,430 --> 00:07:55,430
Now it says, I know these
operants, operant r2.

171
00:07:55,470 --> 00:07:58,503
I know that that is at
this emulation point,

172
00:08:00,080 --> 00:08:01,080
0x08010e0c.

173
00:08:04,260 --> 00:08:06,480
And here's the decimal version of it.

174
00:08:06,480 --> 00:08:11,480
And the other operant,
which is a d reference

175
00:08:11,820 --> 00:08:14,010
of the register r2,

176
00:08:14,010 --> 00:08:17,370
shows the d references
of r2, same address.

177
00:08:17,370 --> 00:08:18,840
It's the same register.

178
00:08:18,840 --> 00:08:22,560
And it spits back capital A's, 41414141.

179
00:08:22,560 --> 00:08:26,820
Now, the original safe reads used

180
00:08:26,820 --> 00:08:28,590
to read all capital A's

181
00:08:28,590 --> 00:08:33,060
we shifted to lowercase
a's for various reasons.

182
00:08:33,060 --> 00:08:35,553
And actually it is settable now.

183
00:08:37,200 --> 00:08:40,620
So this can be wildly beneficial

184
00:08:40,620 --> 00:08:44,100
while trying to reverse
through a complicated function,

185
00:08:44,100 --> 00:08:48,420
trying to get an idea of
where you've taken an argument

186
00:08:48,420 --> 00:08:50,610
and you've added to it and
you're subtracted to it

187
00:08:50,610 --> 00:08:52,953
and yada, yada, yada, down the line.

188
00:08:54,420 --> 00:08:57,573
Next example, we're gonna
talk about the calling.py,

189
00:09:00,354 --> 00:09:03,023
the analysis module used for Intel i3B6,

190
00:09:04,530 --> 00:09:07,470
in other words, 32 bit functions

191
00:09:07,470 --> 00:09:11,040
to identify special
things like the arguments

192
00:09:11,040 --> 00:09:12,660
to a function call,

193
00:09:12,660 --> 00:09:15,300
the local variables that
are using a function call,

194
00:09:15,300 --> 00:09:19,470
how deep the stack goes and
including something cool

195
00:09:19,470 --> 00:09:20,880
called pneumonic distribution,

196
00:09:20,880 --> 00:09:23,790
where it goes through all the
instructions and the function,

197
00:09:23,790 --> 00:09:26,220
and it just tracks how many usage

198
00:09:26,220 --> 00:09:28,740
of each are in the function.

199
00:09:28,740 --> 00:09:31,080
So if you've got 32 moves,

200
00:09:31,080 --> 00:09:34,290
it'll say mov 32,

201
00:09:34,290 --> 00:09:36,900
and any pushes, pops,

202
00:09:36,900 --> 00:09:39,137
other reads, writes, XOR.

203
00:09:39,137 --> 00:09:41,160
XOR is a pretty interesting one.

204
00:09:41,160 --> 00:09:43,320
And it just stores that
as part of the metadata

205
00:09:43,320 --> 00:09:44,790
for the function,

206
00:09:44,790 --> 00:09:47,340
and which can be very useful,

207
00:09:47,340 --> 00:09:49,980
particularly when finding
interesting things

208
00:09:49,980 --> 00:09:53,700
like hash functions, crypto
functions, things like that.

209
00:09:53,700 --> 00:09:56,790
One example of using emulation in Vivisect

210
00:09:56,790 --> 00:10:00,960
on a daily basis is calling
convention identification.

211
00:10:00,960 --> 00:10:02,070
So for example,

212
00:10:02,070 --> 00:10:05,460
what I'm talking about is
this function right here,

213
00:10:05,460 --> 00:10:08,200
sub 020a030

214
00:10:09,174 --> 00:10:13,020
in this code has a number
of arguments to it.

215
00:10:13,020 --> 00:10:16,830
It is identified as a system5amd64call

216
00:10:16,830 --> 00:10:19,170
and has these stack variables identified.

217
00:10:19,170 --> 00:10:20,790
And we can go through and we can name them

218
00:10:20,790 --> 00:10:22,800
as we do analysis.

219
00:10:22,800 --> 00:10:26,220
This is all done on
Intel 386, for example.

220
00:10:26,220 --> 00:10:29,220
We're just going to use
this for our example.

221
00:10:29,220 --> 00:10:31,830
Each of the architectures
have their own version.

222
00:10:31,830 --> 00:10:33,180
We have an analysis module,

223
00:10:33,180 --> 00:10:35,790
which starts out as analysis modules do,

224
00:10:35,790 --> 00:10:36,890
using analyzeFunction.

225
00:10:39,900 --> 00:10:42,990
The calling.py has analyzedFunction.

226
00:10:42,990 --> 00:10:45,690
We hand in a Vivisect workspace

227
00:10:45,690 --> 00:10:48,090
and a function virtual address.

228
00:10:48,090 --> 00:10:50,370
It immediately spins up an emulator

229
00:10:50,370 --> 00:10:52,980
and this AnalysisMonitor,

230
00:10:52,980 --> 00:10:56,520
and snaps in the emulation
monitor right here

231
00:10:56,520 --> 00:10:58,200
and then runs the function.

232
00:10:58,200 --> 00:10:59,700
Here's it says runFunction.

233
00:10:59,700 --> 00:11:01,680
Here's the virtual address, maxhit=1.

234
00:11:01,680 --> 00:11:03,720
So do all the paths,

235
00:11:03,720 --> 00:11:07,110
if you're run into something
you've done before, quit.

236
00:11:07,110 --> 00:11:10,120
Down here, it then calls buildFunctionApi

237
00:11:11,310 --> 00:11:14,940
based on the results
of that emulation pass.

238
00:11:14,940 --> 00:11:17,880
So it hands in the workspace,
the function address,

239
00:11:17,880 --> 00:11:22,530
the emulator itself and
the emulation monitor.

240
00:11:22,530 --> 00:11:27,120
And what we get back from
that allows the setting

241
00:11:27,120 --> 00:11:31,590
of all the things that
Vivisect makes use of.

242
00:11:31,590 --> 00:11:34,740
So let's take a look at
that buildFunctionApi.

243
00:11:34,740 --> 00:11:39,740
Specifically, one of the
things that it does is it grabs

244
00:11:40,440 --> 00:11:44,610
the number of arguments and
it starts off determining

245
00:11:44,610 --> 00:11:48,600
that using the emulation monitors
tracking of the stackmax;

246
00:11:48,600 --> 00:11:51,570
what is the maximum stack
address that was accessed?

247
00:11:51,570 --> 00:11:55,020
Because for Intel 386,

248
00:11:55,020 --> 00:11:56,520
you put your arguments on the stack.

249
00:11:56,520 --> 00:12:01,520
So from the base, you access
up from the stack base.

250
00:12:04,680 --> 00:12:07,830
So if we end up with
more than 40 arguments,

251
00:12:07,830 --> 00:12:09,810
we think maybe that's a little weird,

252
00:12:09,810 --> 00:12:13,470
so we default to cdecl
calling convention in i386

253
00:12:13,470 --> 00:12:15,750
or dozens of calling conventions

254
00:12:15,750 --> 00:12:17,700
and the compilers all went nuts,

255
00:12:17,700 --> 00:12:19,833
thought their stuff was the best.

256
00:12:23,220 --> 00:12:28,220
But then if we return using
the ret number for Intel,

257
00:12:28,920 --> 00:12:30,480
that means return,

258
00:12:30,480 --> 00:12:33,420
but also clear off this
much space off the stat

259
00:12:33,420 --> 00:12:35,310
'cause that was arguments.

260
00:12:35,310 --> 00:12:38,313
Basically it's the calling cleanup.

261
00:12:39,540 --> 00:12:42,780
We have a different way
to identify the arg count

262
00:12:42,780 --> 00:12:47,780
because that retbytes divide
that by 4, 32 bits each,

263
00:12:48,210 --> 00:12:51,723
actually is the number of
arguments, clear and simple.

264
00:12:52,890 --> 00:12:54,930
We then go on to say,

265
00:12:54,930 --> 00:12:59,930
hey, any uninitialized
registers that are used

266
00:13:00,060 --> 00:13:02,430
in the function without an initialization,

267
00:13:02,430 --> 00:13:03,990
let's figure that out

268
00:13:03,990 --> 00:13:06,658
and identify calling
convention from there,

269
00:13:06,658 --> 00:13:09,060
'cause cdecl standard
call are very common,

270
00:13:09,060 --> 00:13:11,940
but there are a whole bunch
of derivations off them

271
00:13:11,940 --> 00:13:15,227
that add in handing in argument in EAX,

272
00:13:16,087 --> 00:13:18,210
and ECX and yada yada.

273
00:13:18,210 --> 00:13:21,090
So we have a dictionary that we look up

274
00:13:21,090 --> 00:13:23,940
based on the undefined registers,

275
00:13:23,940 --> 00:13:27,120
and voila, we got our calling convention

276
00:13:27,120 --> 00:13:28,533
and our argument count.

277
00:13:30,300 --> 00:13:32,340
All right, next example
we're gonna talk about

278
00:13:32,340 --> 00:13:33,720
is probably code.

279
00:13:33,720 --> 00:13:38,670
This is another internal
function of a Vivisect

280
00:13:38,670 --> 00:13:41,920
that heuristically determines
what a pointer points to

281
00:13:43,380 --> 00:13:46,533
particularly looking for executable code.

282
00:13:47,580 --> 00:13:50,460
It's part of a family
of it, is probably is,

283
00:13:50,460 --> 00:13:52,950
and you will show that in just a second.

284
00:13:52,950 --> 00:13:55,410
It starts out by spinning
up a workspace emulator

285
00:13:55,410 --> 00:13:57,870
with partially-emu bells and whistles.

286
00:13:57,870 --> 00:14:00,570
It attaches an AnalysisMonitor

287
00:14:00,570 --> 00:14:02,430
and then emulates every branch.

288
00:14:02,430 --> 00:14:05,400
Now, one of the cool things
about our partial emulation,

289
00:14:05,400 --> 00:14:07,170
if I didn't mention earlier,

290
00:14:07,170 --> 00:14:09,060
is the ability to say,

291
00:14:09,060 --> 00:14:11,613
hey, we're going to go
to a conditional branch.

292
00:14:12,840 --> 00:14:14,310
Yeah, let's do both.

293
00:14:14,310 --> 00:14:16,320
So I'm gonna take one path this time.

294
00:14:16,320 --> 00:14:18,810
We'll just store off the state over here.

295
00:14:18,810 --> 00:14:20,790
And then when I'm done doing this path,

296
00:14:20,790 --> 00:14:24,060
I'll come back and I'll emulate
through that path as well.

297
00:14:24,060 --> 00:14:27,543
Given the same state
that we hit right there.

298
00:14:29,490 --> 00:14:30,870
Wildly powerful.

299
00:14:30,870 --> 00:14:34,950
And so we hand in what's
the argument maxhit.

300
00:14:34,950 --> 00:14:38,610
So sometimes as we're
going through a function,

301
00:14:38,610 --> 00:14:40,530
we'll get to a loop or
we'll get to something

302
00:14:40,530 --> 00:14:42,870
where we've got a couple different paths

303
00:14:42,870 --> 00:14:44,340
that end up in the same place.

304
00:14:44,340 --> 00:14:49,340
And as soon as we run into
the same arg code twice

305
00:14:50,010 --> 00:14:51,150
in the same location,

306
00:14:51,150 --> 00:14:53,160
then we just say, ah, we're good.

307
00:14:53,160 --> 00:14:55,200
We have enough,

308
00:14:55,200 --> 00:14:58,830
which allows us to get through all code

309
00:14:58,830 --> 00:15:02,040
without triggering the halting problem

310
00:15:02,040 --> 00:15:04,983
and using up all the time, all the rams,

311
00:15:06,215 --> 00:15:07,770
all the resources in the universe.

312
00:15:07,770 --> 00:15:09,390
And at the end make a decision,

313
00:15:09,390 --> 00:15:10,223
Is this code?

314
00:15:10,223 --> 00:15:11,056
Is it not?

315
00:15:12,060 --> 00:15:15,010
So this example of using partial emulation

316
00:15:15,990 --> 00:15:20,313
is built in analysis
module for Vivisect proper.

317
00:15:21,300 --> 00:15:25,320
I wanna take you through
the core code here.

318
00:15:25,320 --> 00:15:27,843
AnalyzePointer is called
a number of places,

319
00:15:28,738 --> 00:15:31,020
wherever Viv finds a pointer.

320
00:15:31,020 --> 00:15:32,430
And it looks first to see

321
00:15:32,430 --> 00:15:34,320
if there's already a location specified,

322
00:15:34,320 --> 00:15:37,230
'cause at that point you don't care.

323
00:15:37,230 --> 00:15:38,430
Is it probably unicode?

324
00:15:38,430 --> 00:15:39,900
It checks to see if it's unicode,

325
00:15:39,900 --> 00:15:41,760
or then it checks to see if it's a string,

326
00:15:41,760 --> 00:15:45,030
and then it calls this is probably code.

327
00:15:45,030 --> 00:15:47,280
So is probably code,

328
00:15:47,280 --> 00:15:50,599
makes use of partial emulation,

329
00:15:50,599 --> 00:15:53,043
a Vivisect workspace emulator.

330
00:15:54,300 --> 00:15:55,950
We handed in a virtual address,

331
00:15:55,950 --> 00:15:59,370
the location that we're
looking at to see if it's code.

332
00:15:59,370 --> 00:16:01,950
And it does a few simple checks like,

333
00:16:01,950 --> 00:16:03,090
hey, is this executable,

334
00:16:03,090 --> 00:16:04,890
if not, probably not code.

335
00:16:04,890 --> 00:16:06,390
Or is there a function signature?

336
00:16:06,390 --> 00:16:09,120
If so, and very likely it is.

337
00:16:09,120 --> 00:16:12,600
And other things is,
have we already run this?

338
00:16:12,600 --> 00:16:14,130
We then set down log level

339
00:16:14,130 --> 00:16:18,270
so we can emulate through
nasty stuff that's not code

340
00:16:18,270 --> 00:16:20,270
and not throw error messages everywhere.

341
00:16:21,150 --> 00:16:23,880
We then call getEmulator.

342
00:16:23,880 --> 00:16:26,490
And since this is the workspace itself

343
00:16:26,490 --> 00:16:28,020
is calling it on itself,

344
00:16:28,020 --> 00:16:30,810
normally I will name a
workspace emulator VW,

345
00:16:30,810 --> 00:16:33,273
so you'll often see in
my code vw.getemulator.

346
00:16:34,320 --> 00:16:37,860
And it hands in anything
that we happen to hand in to,

347
00:16:37,860 --> 00:16:39,333
and is probably code.

348
00:16:41,666 --> 00:16:44,277
And then creates this watcher object,

349
00:16:46,560 --> 00:16:49,140
which is an analysis
module that we'll look at

350
00:16:49,140 --> 00:16:50,670
in just a second.

351
00:16:50,670 --> 00:16:54,870
We call SetEmulationMonitor
onto the emulator

352
00:16:54,870 --> 00:16:56,370
that we just created

353
00:16:56,370 --> 00:16:58,350
and we hand in the watcher

354
00:16:58,350 --> 00:17:00,150
and then we try to run the function.

355
00:17:00,150 --> 00:17:02,310
We hand in specifically
the virtual address

356
00:17:02,310 --> 00:17:05,250
that we want to run and the maxhit.

357
00:17:05,250 --> 00:17:10,250
So if you remember a
lot of partial emulation

358
00:17:10,800 --> 00:17:12,870
isn't straight through code.

359
00:17:12,870 --> 00:17:14,940
It actually says, oh,
there's a branch here.

360
00:17:14,940 --> 00:17:15,810
Save that for later.

361
00:17:15,810 --> 00:17:17,220
We'll run it again later,

362
00:17:17,220 --> 00:17:20,190
and we're just gonna
continue through one branch.

363
00:17:20,190 --> 00:17:23,940
And so this is a way of
saying emulate everything.

364
00:17:23,940 --> 00:17:26,130
But if you run into code,

365
00:17:26,130 --> 00:17:28,980
you've already run into
in some other branch,

366
00:17:28,980 --> 00:17:32,400
just stop, call that an end.

367
00:17:32,400 --> 00:17:35,850
And that allows us to actually
emulate through every part

368
00:17:35,850 --> 00:17:38,880
of code without eating up a ton of time

369
00:17:38,880 --> 00:17:43,263
and give relatively good
context to each instruction.

370
00:17:45,150 --> 00:17:48,000
If we throw an exception,
then no, it's not code.

371
00:17:48,000 --> 00:17:50,460
So we destroy that, it's not code.

372
00:17:50,460 --> 00:17:53,040
And we then do a check at the end.

373
00:17:53,040 --> 00:17:54,660
Hey watcher, does it look good?

374
00:17:54,660 --> 00:17:56,040
Is that code cool?

375
00:17:56,040 --> 00:17:57,180
If it is, we store it.

376
00:17:57,180 --> 00:17:58,650
If not, we move on.

377
00:17:58,650 --> 00:18:01,290
So let's take a look at this watcher,

378
00:18:01,290 --> 00:18:03,213
which is an emulation monitor,

379
00:18:05,790 --> 00:18:09,603
and it stores a number of
different local fields,

380
00:18:11,191 --> 00:18:12,690
and it has this ability to log anomalies.

381
00:18:12,690 --> 00:18:15,540
If something goes weird,
we can log anomalies,

382
00:18:15,540 --> 00:18:18,630
and then it's looks good, and is code.

383
00:18:18,630 --> 00:18:22,353
But specifically,

384
00:18:23,790 --> 00:18:27,360
this emulation monitor has a pre-hook,

385
00:18:27,360 --> 00:18:30,930
so before each instruction is emulated,

386
00:18:30,930 --> 00:18:32,643
this pre-code is run.

387
00:18:33,480 --> 00:18:37,050
And so we handed an emulator,

388
00:18:37,050 --> 00:18:38,250
the emulator we're using,

389
00:18:38,250 --> 00:18:41,190
we hand in the op code
that we've parsed out

390
00:18:41,190 --> 00:18:43,563
and the starting instruction pointer.

391
00:18:44,850 --> 00:18:48,210
If our opt code is in
our list of bad opt code.

392
00:18:48,210 --> 00:18:50,880
So we've generated a list of bad opt codes

393
00:18:50,880 --> 00:18:52,020
that are very, very common

394
00:18:52,020 --> 00:18:54,520
when you're looking
through firmware or code

395
00:18:56,370 --> 00:19:00,786
and including like how
do you parse out zeros?

396
00:19:00,786 --> 00:19:03,780
How do you parse out
all ones like FFFFFFFF?

397
00:19:03,780 --> 00:19:06,540
And so we'll hand in, we'll parse that out

398
00:19:06,540 --> 00:19:08,913
and we'll get whatever
instruction that is.

399
00:19:09,780 --> 00:19:12,510
And then we have a list of
those we compare against.

400
00:19:12,510 --> 00:19:15,930
And if it's a bad op, meaning
we're emulating into something

401
00:19:15,930 --> 00:19:20,310
that's very likely just
all zeros or all ones,

402
00:19:20,310 --> 00:19:23,553
and so we throw an exception there.

403
00:19:24,810 --> 00:19:26,160
We then look through and say,

404
00:19:26,160 --> 00:19:31,160
hey, have we run into a return
in any of the code paths

405
00:19:31,980 --> 00:19:33,060
that we've emulated through?

406
00:19:33,060 --> 00:19:36,060
If we have, probably pretty good,

407
00:19:36,060 --> 00:19:38,100
so done with that.

408
00:19:38,100 --> 00:19:42,090
We then grab the location
of the current instruction

409
00:19:42,090 --> 00:19:44,283
as stored in the Vivisec database.

410
00:19:45,450 --> 00:19:48,723
If the type that we run
into is not an op code,

411
00:19:49,800 --> 00:19:51,213
okay, we're done.

412
00:19:52,590 --> 00:19:57,270
This is an API built into
Vivisect where we'll go through

413
00:19:57,270 --> 00:20:01,110
and analyze does this not actually return?

414
00:20:01,110 --> 00:20:02,130
So there are many functions,

415
00:20:02,130 --> 00:20:05,970
particularly in Libsie,
or Windows Kernel 32

416
00:20:05,970 --> 00:20:08,073
that legitimately, they don't return.

417
00:20:09,240 --> 00:20:12,240
Many of them are error codes
or exits or things like that,

418
00:20:12,240 --> 00:20:15,060
where you go here and you're just done.

419
00:20:15,060 --> 00:20:17,193
So we work hard to identify.

420
00:20:18,240 --> 00:20:19,830
And so we store that information,

421
00:20:19,830 --> 00:20:21,480
make it available to the API.

422
00:20:21,480 --> 00:20:23,820
Is this a known return VA?

423
00:20:23,820 --> 00:20:28,820
If it is, then we say, okay,
this is known not to return.

424
00:20:29,310 --> 00:20:32,040
So we're gonna say that it has a return

425
00:20:32,040 --> 00:20:33,990
because we want it to look good,

426
00:20:33,990 --> 00:20:37,710
and that's very likely code again.

427
00:20:37,710 --> 00:20:39,840
And then we tell the emulator to stop.

428
00:20:39,840 --> 00:20:44,580
So at the end we call after we've emulated

429
00:20:44,580 --> 00:20:47,640
through the function with a max of one,

430
00:20:47,640 --> 00:20:49,500
as long as it didn't throw an exception.

431
00:20:49,500 --> 00:20:51,000
And many times when you have code

432
00:20:51,000 --> 00:20:54,240
or if you're trying to emulate
things that aren't code,

433
00:20:54,240 --> 00:20:55,440
you'll throw an exception.

434
00:20:55,440 --> 00:20:57,740
Most often, it's just
not a valid instruction.

435
00:20:58,980 --> 00:21:01,350
And so this will catch most of the things.

436
00:21:01,350 --> 00:21:05,268
And if not, we ask the
watcher, does this look good?

437
00:21:05,268 --> 00:21:07,200
But it looks good. It's pretty simple.

438
00:21:07,200 --> 00:21:12,200
If it doesn't have a return
set or there is bad code,

439
00:21:14,850 --> 00:21:16,050
then return false.

440
00:21:16,050 --> 00:21:17,100
It doesn't look good.

441
00:21:18,240 --> 00:21:20,940
Otherwise if you have just repetitive

442
00:21:20,940 --> 00:21:22,143
of the same instruction,

443
00:21:23,460 --> 00:21:26,160
you can end up with what
looks like good code,

444
00:21:26,160 --> 00:21:27,410
but it just really isn't.

445
00:21:28,617 --> 00:21:30,360
And so we look through
the mnemonic distribution

446
00:21:30,360 --> 00:21:33,030
and we do some heuristics here and say,

447
00:21:33,030 --> 00:21:36,420
you know, if we're over
a certain percentage

448
00:21:36,420 --> 00:21:40,950
of one instruction, then
that's probably not code too.

449
00:21:40,950 --> 00:21:42,990
We're gonna just basically reproduce

450
00:21:42,990 --> 00:21:44,190
the functionality listed here,

451
00:21:44,190 --> 00:21:45,423
and is probably code.

452
00:21:46,350 --> 00:21:48,960
And we're going to use an area that came

453
00:21:48,960 --> 00:21:51,360
from the Hackers Hat
qualifier rounds this year,

454
00:21:52,230 --> 00:21:55,083
something from the
Resonante, the authenticator.

455
00:21:56,160 --> 00:21:57,930
So I've zeroed in,

456
00:21:57,930 --> 00:22:00,240
I've got an interesting function here,

457
00:22:00,240 --> 00:22:02,343
and I want to know more about it.

458
00:22:04,230 --> 00:22:05,802
All right, so I ran the function,

459
00:22:05,802 --> 00:22:07,323
maxhit=one and it completed.

460
00:22:08,430 --> 00:22:09,873
Okay, so watcher,

461
00:22:10,980 --> 00:22:13,683
these are all the details of watcher.

462
00:22:14,550 --> 00:22:17,610
Watcher, it's got the
workspace, tryva and hex.

463
00:22:17,610 --> 00:22:19,980
That's actually the
address that we handed in.

464
00:22:19,980 --> 00:22:21,150
Doesn't have a return?

465
00:22:21,150 --> 00:22:23,580
Yes, it has a return, yay!

466
00:22:23,580 --> 00:22:26,340
It has 27 different instructions.

467
00:22:26,340 --> 00:22:27,240
Is there bad code?

468
00:22:27,240 --> 00:22:28,440
No.

469
00:22:28,440 --> 00:22:30,093
So that looks pretty good.

470
00:22:31,320 --> 00:22:32,520
So I wanted to show you that

471
00:22:32,520 --> 00:22:37,520
because you create a emulation monitor,

472
00:22:38,910 --> 00:22:39,750
you store what's in it,

473
00:22:39,750 --> 00:22:44,160
you tell it what to do with
it and it drags along behind.

474
00:22:44,160 --> 00:22:46,770
So you can write an analysis module

475
00:22:46,770 --> 00:22:50,190
that easily straps in an emulation monitor

476
00:22:50,190 --> 00:22:51,690
and you let it go,

477
00:22:51,690 --> 00:22:53,040
and then you get back the results.

478
00:22:53,040 --> 00:22:54,840
You can look at...

479
00:22:54,840 --> 00:22:56,910
So here's our pneumonic distribution.

480
00:22:56,910 --> 00:22:58,410
Probably one of the coolest things about

481
00:22:58,410 --> 00:23:02,313
is the watcher emulation monitor.

482
00:23:03,270 --> 00:23:04,890
Okay, the next one we're gonna look at

483
00:23:04,890 --> 00:23:09,360
is the FunRecon Vivisect
extension that I wrote.

484
00:23:09,360 --> 00:23:13,620
It's my way of easily deciding

485
00:23:13,620 --> 00:23:16,530
or determining what kinds
of things are going on

486
00:23:16,530 --> 00:23:19,830
in a given function branch.

487
00:23:19,830 --> 00:23:22,410
So oftentimes you'll start
off maybe a main function

488
00:23:22,410 --> 00:23:25,200
or you'll have a main loop,
something deeper down in,

489
00:23:25,200 --> 00:23:30,200
but you've got huge amounts
of potential functionality,

490
00:23:30,960 --> 00:23:33,870
and you can get down a
rabbit hole really fast

491
00:23:33,870 --> 00:23:36,420
and lose complete sight
of where you're going,

492
00:23:36,420 --> 00:23:39,060
and where you've been and what's next.

493
00:23:39,060 --> 00:23:41,490
So I wrote Function
Recon so that I can say,

494
00:23:41,490 --> 00:23:43,650
oh, going through here, I
just wanna stay right here.

495
00:23:43,650 --> 00:23:45,420
I'll just do a recon of that function,

496
00:23:45,420 --> 00:23:48,510
recon of that function,
recon of that function

497
00:23:48,510 --> 00:23:53,430
and try to get a really fast feeling

498
00:23:53,430 --> 00:23:54,930
for what's going on there.

499
00:23:54,930 --> 00:23:59,177
So this is part of my own collection,

500
00:23:59,177 --> 00:24:02,520
is the Icharus collection
that I started years ago.

501
00:24:02,520 --> 00:24:06,060
And given a starting point, a function,

502
00:24:06,060 --> 00:24:09,690
we emulate through all the
paths and all the function calls

503
00:24:09,690 --> 00:24:11,850
and we grab information like strings,

504
00:24:11,850 --> 00:24:14,040
imports, functions, immediates,

505
00:24:14,040 --> 00:24:16,650
pointers and indirect branches,

506
00:24:16,650 --> 00:24:19,260
which actually isn't going
to be a part of today's demo

507
00:24:19,260 --> 00:24:21,110
because that's not ready for you yet.

508
00:24:22,290 --> 00:24:26,490
So now let's show you
Function Recon in action.

509
00:24:26,490 --> 00:24:29,190
We're gonna go back to our
Resonante authenticator

510
00:24:29,190 --> 00:24:30,273
from Hacker's Hat.

511
00:24:31,788 --> 00:24:33,540
And I've picked up a function here

512
00:24:33,540 --> 00:24:38,540
that's kind of annoying, (laughs)

513
00:24:38,700 --> 00:24:40,830
but a lot of stuff going on here.

514
00:24:40,830 --> 00:24:43,893
I'm just gonna say, let's run
function recon right here.

515
00:24:45,720 --> 00:24:46,560
Do that well.

516
00:24:46,560 --> 00:24:47,973
Let's magnify this.

517
00:24:50,490 --> 00:24:51,393
So.

518
00:24:58,770 --> 00:25:01,200
Okay, so I'm looking
through, and I see hmac,

519
00:25:01,200 --> 00:25:04,173
I see delete_auth,
create_auth, liborbital_totp.

520
00:25:05,310 --> 00:25:07,560
I'm seeing Decrypting protected data.

521
00:25:07,560 --> 00:25:08,393
I like that.

522
00:25:09,270 --> 00:25:10,140
Authdata.bin.

523
00:25:10,140 --> 00:25:12,590
That's something that they
provided along with a,

524
00:25:14,010 --> 00:25:14,970
with a binary...

525
00:25:14,970 --> 00:25:15,930
I see unset.

526
00:25:15,930 --> 00:25:16,800
I see rb.

527
00:25:16,800 --> 00:25:20,100
So we're probably gonna be
reading something with binary.

528
00:25:20,100 --> 00:25:23,820
I see decrypting, Using key,

529
00:25:23,820 --> 00:25:26,670
decrypted, blah, blah, blah file.

530
00:25:26,670 --> 00:25:28,293
And I see error messages.

531
00:25:29,310 --> 00:25:32,340
And then I see rollover period
and latitude and longitude.

532
00:25:32,340 --> 00:25:33,720
We're talking about (indistinct) set,

533
00:25:33,720 --> 00:25:35,940
so that's to be expected.

534
00:25:35,940 --> 00:25:38,130
HMAC Key, Secret_Key.

535
00:25:38,130 --> 00:25:42,210
Allow me to make a lot of
sense out of this function

536
00:25:42,210 --> 00:25:44,940
without actually having to delve into it.

537
00:25:44,940 --> 00:25:49,440
I also see that it's
importing a number of things,

538
00:25:49,440 --> 00:25:52,800
including dlopen and dlsym.

539
00:25:52,800 --> 00:25:56,973
That's a dynamic library,
loader and symbol resolver.

540
00:25:58,050 --> 00:25:59,577
We also see allocator

541
00:25:59,577 --> 00:26:03,720
and a bunch of C++ standard
lib function calls,

542
00:26:03,720 --> 00:26:05,853
which is probably why I chose this one.

543
00:26:07,560 --> 00:26:10,110
fopen, fseek, ftell,

544
00:26:10,110 --> 00:26:12,513
rewind, operator new.

545
00:26:13,890 --> 00:26:15,930
So these are the imports.

546
00:26:15,930 --> 00:26:17,010
And then it goes down and says,

547
00:26:17,010 --> 00:26:19,170
okay, do I recognize any functions

548
00:26:19,170 --> 00:26:22,380
that don't start in the
name sub underscore,

549
00:26:22,380 --> 00:26:25,510
which is the default
unknown function name?

550
00:26:25,510 --> 00:26:28,983
And so we see actually the PLT
entries for a lot of these.

551
00:26:30,550 --> 00:26:32,496
So I haven't updated the string version

552
00:26:32,496 --> 00:26:35,830
as recently as I've updated
the non stringing version

553
00:26:36,690 --> 00:26:37,523
where

554
00:26:41,430 --> 00:26:42,580
we can see

555
00:26:43,950 --> 00:26:47,010
here are the different
strings that are interesting,

556
00:26:47,010 --> 00:26:49,203
again, the same ones.

557
00:26:53,010 --> 00:26:55,683
Here are the imports that are referenced.

558
00:26:57,420 --> 00:26:58,770
And again, these are...

559
00:26:58,770 --> 00:27:01,740
I like this better than
the text version right now

560
00:27:01,740 --> 00:27:05,160
because it just reads nicer.

561
00:27:05,160 --> 00:27:08,730
I can select and show things

562
00:27:08,730 --> 00:27:12,753
and I can actually drag that into,

563
00:27:15,720 --> 00:27:17,670
I can drag that into someplace

564
00:27:17,670 --> 00:27:19,713
and view what's going on there.

565
00:27:24,000 --> 00:27:26,190
Down here, looking at the addresses,

566
00:27:26,190 --> 00:27:27,633
calling functions.

567
00:27:28,980 --> 00:27:30,980
I know what other functions that we saw.

568
00:27:32,490 --> 00:27:36,390
And then we've added in, since
the strings were updated,

569
00:27:36,390 --> 00:27:38,910
we've added in a search
for immediate values.

570
00:27:38,910 --> 00:27:41,880
So if there are immediate
values that we found

571
00:27:41,880 --> 00:27:46,053
during emulation including
where we build a pointer,

572
00:27:46,890 --> 00:27:48,660
on Intel, this isn't as big a deal,

573
00:27:48,660 --> 00:27:50,850
but on many risk architecture,

574
00:27:50,850 --> 00:27:53,913
actually almost every other
architecture besides Intel,

575
00:27:55,590 --> 00:27:57,570
you'll find the code building addresses

576
00:27:57,570 --> 00:27:58,920
that are absolute addresses

577
00:27:58,920 --> 00:28:01,440
because you've got a fixed instruction set

578
00:28:01,440 --> 00:28:03,600
that simply can't store the entire address

579
00:28:03,600 --> 00:28:04,470
in the instructions,

580
00:28:04,470 --> 00:28:06,870
so it'll say, okay, load this half

581
00:28:06,870 --> 00:28:09,810
and then add this half
to it or it or whatever.

582
00:28:09,810 --> 00:28:13,710
So the emulator will go through
that and each point say,

583
00:28:13,710 --> 00:28:14,880
hey, I got this number here.

584
00:28:14,880 --> 00:28:16,620
Is it interesting to you?

585
00:28:16,620 --> 00:28:19,140
And so we store immediate values.

586
00:28:19,140 --> 00:28:22,410
Zero is referenced 152 times.

587
00:28:22,410 --> 00:28:25,680
One is 34, kind like you'd expect.

588
00:28:25,680 --> 00:28:28,803
And then we've got
different smaller numbers.

589
00:28:32,160 --> 00:28:34,653
Safe reads will give you,

590
00:28:36,480 --> 00:28:39,180
in this case, it'll
give you lowercase a's,

591
00:28:39,180 --> 00:28:41,640
So hex 61616161.

592
00:28:41,640 --> 00:28:43,980
So if we see that we know that we've read

593
00:28:43,980 --> 00:28:46,290
from someplace that we didn't
know what to do with it,

594
00:28:46,290 --> 00:28:47,883
wasn't an existing map,

595
00:28:49,440 --> 00:28:53,110
or it was trying to reference
something built on an argument

596
00:28:54,267 --> 00:28:55,350
that wasn't legitimate.

597
00:28:55,350 --> 00:29:00,350
You'll also see these 4156 values.

598
00:29:00,540 --> 00:29:04,290
These represent Vivisect emulator taints.

599
00:29:04,290 --> 00:29:09,290
So at the beginning of an emulator pass,

600
00:29:09,810 --> 00:29:13,440
the emulator defaults to
loading all the things

601
00:29:13,440 --> 00:29:16,800
that could hold arguments
for a function call

602
00:29:16,800 --> 00:29:19,410
with a taint that indicates what it is.

603
00:29:19,410 --> 00:29:22,860
And all the registers are
pre-tainted with a taint

604
00:29:22,860 --> 00:29:26,280
that returns, oh, this
is uninitialized ECX

605
00:29:26,280 --> 00:29:28,230
or RCX or whatever.

606
00:29:28,230 --> 00:29:32,970
So as you can see, there's
a lot of potential value.

607
00:29:32,970 --> 00:29:36,540
So if you see the number 1024,
or you see the number 8080,

608
00:29:36,540 --> 00:29:40,950
or you see the number
C00 blah, blah, blah,

609
00:29:40,950 --> 00:29:42,123
some error message,

610
00:29:43,020 --> 00:29:46,080
these are numbers that just
inherently make sense to you

611
00:29:46,080 --> 00:29:48,450
once you've been reversing

612
00:29:48,450 --> 00:29:50,580
in particular areas long enough,

613
00:29:50,580 --> 00:29:52,590
and it can make your life a lot easier,

614
00:29:52,590 --> 00:29:56,463
like hex7DF, for example, if
you're an automotive person.

615
00:29:59,130 --> 00:30:02,040
Hey, next, let's jump on and
take a look at VivisectION.

616
00:30:02,040 --> 00:30:07,040
VivisectION is a huge helper trying

617
00:30:07,890 --> 00:30:12,890
to give you all the access
to be powerful in emulation

618
00:30:13,830 --> 00:30:17,103
and driving your reverse
engineering using an emulator.

619
00:30:18,180 --> 00:30:20,550
So the problem is reversing is,

620
00:30:20,550 --> 00:30:22,140
couldn't think of a good word,

621
00:30:22,140 --> 00:30:24,360
it's hard, it's tedious, it's exhausting.

622
00:30:24,360 --> 00:30:25,320
Yeah, it's all these things.

623
00:30:25,320 --> 00:30:26,580
But I don't wanna sound like a wimp,

624
00:30:26,580 --> 00:30:28,020
'cause reversing is really fun.

625
00:30:28,020 --> 00:30:29,520
I get a huge rise out of it.

626
00:30:29,520 --> 00:30:31,110
Is what gets me up in the morning,

627
00:30:31,110 --> 00:30:34,830
that and making tools that
allow reversing to be easier,

628
00:30:34,830 --> 00:30:37,890
but it can really rot your brain.

629
00:30:37,890 --> 00:30:40,590
You can get lost down big rabbit trails.

630
00:30:40,590 --> 00:30:42,960
I just recently had reverse engineer

631
00:30:42,960 --> 00:30:46,050
do vulnerability research on a modified

632
00:30:46,050 --> 00:30:49,590
form of Apache as part of a CTF.

633
00:30:49,590 --> 00:30:51,210
It was insane.

634
00:30:51,210 --> 00:30:53,640
Brain drain is very real.

635
00:30:53,640 --> 00:30:57,780
So how do we make tools that
allow for great understanding?

636
00:30:57,780 --> 00:30:59,910
Easy setup so that we can,

637
00:30:59,910 --> 00:31:01,890
it's a tool that we are not like,

638
00:31:01,890 --> 00:31:04,500
ah, I'm not sure if I really
wanna do that heavy...

639
00:31:04,500 --> 00:31:05,490
No, it's easy.

640
00:31:05,490 --> 00:31:07,050
Let's make that easy.

641
00:31:07,050 --> 00:31:08,580
We wanna make it so that it's repeatable,

642
00:31:08,580 --> 00:31:12,767
something that I don't
have to get the program

643
00:31:13,920 --> 00:31:16,050
to a certain point with a certain inputs

644
00:31:16,050 --> 00:31:18,780
with the debugger and stand on one toe

645
00:31:18,780 --> 00:31:20,220
and hold my hand up here,

646
00:31:20,220 --> 00:31:21,690
and then maybe it might be...

647
00:31:21,690 --> 00:31:23,010
No, I don't wanna have to...

648
00:31:23,010 --> 00:31:24,150
Again, easy setup.

649
00:31:24,150 --> 00:31:26,490
I want it to be repeatable easily.

650
00:31:26,490 --> 00:31:28,900
I want it to limit my brain drain

651
00:31:29,970 --> 00:31:31,800
and maybe be a little fun.

652
00:31:31,800 --> 00:31:32,970
I find it very fun.

653
00:31:32,970 --> 00:31:35,470
So that's why I'm actually
talking about it today.

654
00:31:36,540 --> 00:31:38,390
So NinjaEmu is a part of VivisectION,

655
00:31:39,840 --> 00:31:43,200
and it basically, it wraps
that workspace emulator

656
00:31:43,200 --> 00:31:46,110
that we can get from a Vivisec workspace.

657
00:31:46,110 --> 00:31:48,060
It provides interactive to debugging,

658
00:31:48,060 --> 00:31:52,440
kind of like a more
intelligent version of GDB.

659
00:31:52,440 --> 00:31:54,741
I wouldn't go as far as gef

660
00:31:54,741 --> 00:31:57,570
or one of those full GDB environments,

661
00:31:57,570 --> 00:32:00,093
but something more along the lines of,

662
00:32:01,230 --> 00:32:04,560
yeah, just giving you
what you need at each step

663
00:32:04,560 --> 00:32:05,730
along the way.

664
00:32:05,730 --> 00:32:10,620
So NinjaEmu, in addition to this UI,

665
00:32:10,620 --> 00:32:12,240
allows you to hook function calls

666
00:32:12,240 --> 00:32:14,130
and then replace it with Python code.

667
00:32:14,130 --> 00:32:17,310
So let's say you have a function call

668
00:32:17,310 --> 00:32:22,310
into some logging thing
in the target binary

669
00:32:22,590 --> 00:32:24,240
that you know the arguments,

670
00:32:24,240 --> 00:32:26,370
you can kind of just write it in

671
00:32:26,370 --> 00:32:31,370
so you're not actually stepping
into custom focused code

672
00:32:32,700 --> 00:32:35,460
or maybe the code is fraught with peril,

673
00:32:35,460 --> 00:32:38,550
like things that need a ton of setup.

674
00:32:38,550 --> 00:32:40,800
And you're like, eh, I know what that is,

675
00:32:40,800 --> 00:32:42,120
I don't need to know how to set it up.

676
00:32:42,120 --> 00:32:42,953
Let's just go.

677
00:32:44,280 --> 00:32:45,360
We gonna hook,

678
00:32:45,360 --> 00:32:47,220
or one of the biggest uses

679
00:32:47,220 --> 00:32:50,943
that I've found is I hook
malloc, calloc, heapalloc,

680
00:32:52,140 --> 00:32:56,730
all the things that actually
do a memory allocation,

681
00:32:56,730 --> 00:32:58,650
I hook and I emulate.

682
00:32:58,650 --> 00:33:03,450
And I've got basically a
special heap implementation

683
00:33:03,450 --> 00:33:05,100
that actually doesn't free anything,

684
00:33:05,100 --> 00:33:08,340
so you end up tracking everything.

685
00:33:08,340 --> 00:33:09,780
It's not really good for heap grooming,

686
00:33:09,780 --> 00:33:11,430
but it's amazing for tracking,

687
00:33:11,430 --> 00:33:13,410
seeing what's what's going on in a system.

688
00:33:13,410 --> 00:33:16,110
You can hook system calls
like interrupt calls

689
00:33:16,110 --> 00:33:19,680
and hex80 or a 2e, not a problem.

690
00:33:19,680 --> 00:33:21,390
In the process of doing all this

691
00:33:21,390 --> 00:33:23,490
in order to support all the function calls

692
00:33:24,975 --> 00:33:26,310
that I wanted to emulate,

693
00:33:26,310 --> 00:33:30,570
we've created three
primary fake OS Kernels.

694
00:33:30,570 --> 00:33:33,300
We've got the fake Win32 Kernel.

695
00:33:33,300 --> 00:33:38,010
We've got the fake POSIX
Kernel for Linux, whatever.

696
00:33:38,010 --> 00:33:39,750
And we've got a Raw Kernel,

697
00:33:39,750 --> 00:33:42,900
which basically is just kind
of fitting in the Kernel space,

698
00:33:42,900 --> 00:33:47,100
but it's for firmware that
doesn't actually have a Kernel.

699
00:33:47,100 --> 00:33:49,770
But it allows us a great
deal of flexibility

700
00:33:49,770 --> 00:33:51,843
to expand and extend.

701
00:33:53,040 --> 00:33:54,570
We provide our own heap.

702
00:33:54,570 --> 00:33:57,030
We provide rudimentary
file system ability,

703
00:33:57,030 --> 00:34:01,620
including the ability to
create fake files just by name.

704
00:34:01,620 --> 00:34:02,610
Hey, here's a path,

705
00:34:02,610 --> 00:34:04,350
here are the bytes that are in that file

706
00:34:04,350 --> 00:34:07,920
and some attributes for the file.

707
00:34:07,920 --> 00:34:10,020
Or we also allow the mapping

708
00:34:10,020 --> 00:34:14,397
of a particular file directory,

709
00:34:15,780 --> 00:34:17,550
a fake directory space,

710
00:34:17,550 --> 00:34:22,550
and we redirect that into
a real directory space

711
00:34:22,950 --> 00:34:24,660
in your host operating system,

712
00:34:24,660 --> 00:34:26,060
so you wanna make sure that,

713
00:34:28,260 --> 00:34:30,483
be warned and be careful.

714
00:34:31,410 --> 00:34:33,630
Right now we don't actually allow,

715
00:34:33,630 --> 00:34:34,860
that we don't actually protect

716
00:34:34,860 --> 00:34:36,090
against directory reversals.

717
00:34:36,090 --> 00:34:40,680
So if you're reversing
something that knows

718
00:34:40,680 --> 00:34:45,600
that you're reversing it in
VivisectION, or in NinjaEmu,

719
00:34:45,600 --> 00:34:47,670
they may be able to do shenanigans.

720
00:34:47,670 --> 00:34:49,620
So just be warned.

721
00:34:49,620 --> 00:34:52,890
There's also developed final policies

722
00:34:52,890 --> 00:34:55,140
that try to help you keep
from shooting yourself

723
00:34:55,140 --> 00:34:56,790
in the foot.

724
00:34:56,790 --> 00:34:58,170
We also have a fake registry

725
00:34:58,170 --> 00:34:59,220
because a lot of times

726
00:34:59,220 --> 00:35:01,293
when you're reversing Windows programs,

727
00:35:02,490 --> 00:35:04,500
a fake registry is pretty important.

728
00:35:04,500 --> 00:35:07,170
And so you can just
stick in your own stuff

729
00:35:07,170 --> 00:35:09,963
and satisfy what you need to get by.

730
00:35:11,040 --> 00:35:12,720
And we also do environment variables,

731
00:35:12,720 --> 00:35:14,520
'cause those are very important as well.

732
00:35:14,520 --> 00:35:15,840
They're all hackery.

733
00:35:15,840 --> 00:35:17,400
This is not something that's intended

734
00:35:17,400 --> 00:35:20,220
to run a enterprise software solution on,

735
00:35:20,220 --> 00:35:24,003
so please don't yell at me
if it bites you in the ass.

736
00:35:26,430 --> 00:35:27,960
And then NinjaEmu.

737
00:35:27,960 --> 00:35:30,840
One of the more recent
additions is the ability

738
00:35:30,840 --> 00:35:33,330
to drive a Function Graph,

739
00:35:33,330 --> 00:35:36,000
to walk through emulation
through a Graph view.

740
00:35:36,000 --> 00:35:37,620
There are two ways that we do do this.

741
00:35:37,620 --> 00:35:42,360
First of all, we've got
in-process Function Graph driving,

742
00:35:42,360 --> 00:35:45,030
which means basically
from within Vivisect,

743
00:35:45,030 --> 00:35:48,510
you jump out, you drop out to
a shell from the same terminal

744
00:35:48,510 --> 00:35:50,940
that you started Vivisect up in.

745
00:35:50,940 --> 00:35:54,240
It gives you an IPython
or interactive prompt,

746
00:35:54,240 --> 00:35:58,200
and you set up the NinjaEmu
and you run it from there

747
00:35:58,200 --> 00:36:01,740
telling it what Function Graph
name that you want to drive.

748
00:36:01,740 --> 00:36:04,500
And as you emulate through,

749
00:36:04,500 --> 00:36:07,620
it will track it through
that Function Graph.

750
00:36:07,620 --> 00:36:09,900
The other way is the more

751
00:36:09,900 --> 00:36:13,740
massively online multiplayer version,

752
00:36:13,740 --> 00:36:16,590
either using a Viv server
or a shared workspace

753
00:36:16,590 --> 00:36:20,430
where they're intended
to have many people,

754
00:36:20,430 --> 00:36:23,793
all sharing a Vivisect workspace.

755
00:36:25,110 --> 00:36:29,100
We are able to set up a
follow the leader session

756
00:36:29,100 --> 00:36:32,850
from the EMU, and the
follow the leader session

757
00:36:32,850 --> 00:36:35,700
then just sends out where
it's at at any given point

758
00:36:35,700 --> 00:36:39,150
in time, and any number
of people can follow along

759
00:36:39,150 --> 00:36:41,253
with the emulator as it walks through.

760
00:36:42,150 --> 00:36:43,710
It is a lot of fun.

761
00:36:43,710 --> 00:36:45,960
A little bit of setup goes a long way,

762
00:36:45,960 --> 00:36:50,310
So you can start off with
basically not knowing anything

763
00:36:50,310 --> 00:36:53,250
and just spin up the
emulator and walk through.

764
00:36:53,250 --> 00:36:54,330
You'll have taint tracking,

765
00:36:54,330 --> 00:36:56,520
you'll have safe reads and writes,

766
00:36:56,520 --> 00:37:01,520
but as you start zeroing
in on important functions,

767
00:37:01,800 --> 00:37:04,500
you can then have special setup like,

768
00:37:04,500 --> 00:37:07,350
oh, make this the arg list.

769
00:37:07,350 --> 00:37:10,350
And I want to hand in this string,

770
00:37:10,350 --> 00:37:13,890
which will generate a
heap allocation for it

771
00:37:13,890 --> 00:37:16,740
and then put that value
into the right location.

772
00:37:16,740 --> 00:37:18,030
I wanna hand in this number

773
00:37:18,030 --> 00:37:20,040
and this number you hand in a list,

774
00:37:20,040 --> 00:37:24,360
and NinjaEmu sets it all up for you

775
00:37:24,360 --> 00:37:29,360
and allows you to just continue
to make more and more sense.

776
00:37:31,020 --> 00:37:35,010
Now, let's take a look
at this 2005F7C function

777
00:37:35,010 --> 00:37:36,990
that I mentioned earlier.

778
00:37:36,990 --> 00:37:39,180
It did turn out to be very interesting,

779
00:37:39,180 --> 00:37:40,560
But it's a little bland,

780
00:37:40,560 --> 00:37:43,623
but let's start off by running
function recon on this boy.

781
00:37:44,520 --> 00:37:49,520
So we don't see a whole heck
of a lot calls to calloc,

782
00:37:49,710 --> 00:37:52,953
memcopy, malloc and free.

783
00:37:53,910 --> 00:37:55,530
So pretty generic.

784
00:37:55,530 --> 00:37:58,440
But if you think about it
compared to the last thing

785
00:37:58,440 --> 00:38:01,470
that we looked at, very limited.

786
00:38:01,470 --> 00:38:04,260
This isn't really about Function Recon.

787
00:38:04,260 --> 00:38:07,863
This is about making sense
of what a function does.

788
00:38:09,390 --> 00:38:11,070
and you're gonna have to forgive me

789
00:38:11,070 --> 00:38:14,880
because I only have one screen
that I can present to you.

790
00:38:14,880 --> 00:38:18,990
I'm not going to be able to
do as good a job showing off

791
00:38:18,990 --> 00:38:20,493
just how awesome this is.

792
00:38:21,510 --> 00:38:23,370
Typically I will have
three monitors running

793
00:38:23,370 --> 00:38:24,203
at the same time,

794
00:38:24,203 --> 00:38:26,760
so I can do things on one

795
00:38:26,760 --> 00:38:30,060
and have my disassembler window

796
00:38:30,060 --> 00:38:32,250
completely full screen on another,

797
00:38:32,250 --> 00:38:35,310
and my emulator window open on another.

798
00:38:35,310 --> 00:38:37,140
This will be something that you select off

799
00:38:37,140 --> 00:38:39,420
of a context menu for a function.

800
00:38:39,420 --> 00:38:40,320
But for now,

801
00:38:40,320 --> 00:38:43,170
let's just walk you through
the old fashioned way.

802
00:38:43,170 --> 00:38:46,415
So for this example,

803
00:38:46,415 --> 00:38:48,865
a lot of times when I'm
using an Ninja ambulator,

804
00:38:49,830 --> 00:38:53,190
I am starting to set
up just function calls

805
00:38:53,190 --> 00:38:55,980
that set up the environment
the way that I want.

806
00:38:55,980 --> 00:38:57,333
This is not necessary.

807
00:38:58,230 --> 00:39:03,230
But as I dive deeper and I do more,

808
00:39:03,540 --> 00:39:06,327
I wanna set up the call with arguments,

809
00:39:08,550 --> 00:39:10,260
the way that I want them.

810
00:39:10,260 --> 00:39:12,123
So if we don't,

811
00:39:14,280 --> 00:39:15,113
I just jump in,

812
00:39:15,113 --> 00:39:19,263
we say import this section.

813
00:39:21,600 --> 00:39:24,260
Let's just say our NEMU is VivisectION.

814
00:39:28,436 --> 00:39:29,465
Oh, okay.

815
00:39:29,465 --> 00:39:32,465
(keyboard rattling)

816
00:39:37,657 --> 00:39:38,490
Okay.

817
00:39:38,490 --> 00:39:41,490
(keyboard rattling)

818
00:39:45,107 --> 00:39:45,940
Okay, so we start off,

819
00:39:45,940 --> 00:39:49,830
you look at the registers are printed here

820
00:39:49,830 --> 00:39:52,863
and you recognize these
now as being tainted,

821
00:39:54,660 --> 00:39:55,983
doped, if you will.

822
00:39:57,450 --> 00:40:01,170
This user interface
prints out the address,

823
00:40:01,170 --> 00:40:02,823
the bytes at the address,

824
00:40:03,720 --> 00:40:05,730
the instruction that we get there.

825
00:40:05,730 --> 00:40:10,680
And then as a comment, our first operant,

826
00:40:10,680 --> 00:40:13,080
'cause notice that this
actually has an operant

827
00:40:13,080 --> 00:40:14,730
which is the weirdest thing ever,

828
00:40:16,830 --> 00:40:20,550
is, and this is translating
from the taint value

829
00:40:20,550 --> 00:40:21,663
'cause as you can see,

830
00:40:23,130 --> 00:40:27,540
EDX is the actual,

831
00:40:27,540 --> 00:40:31,153
the full thing is RDX
and it is a taint value,

832
00:40:31,153 --> 00:40:33,360
and so that taint value translates back

833
00:40:33,360 --> 00:40:36,240
into uninitialized register RDX.

834
00:40:36,240 --> 00:40:37,113
So we know that.

835
00:40:38,460 --> 00:40:39,990
Our next thing, push rpb,

836
00:40:39,990 --> 00:40:42,330
which we also hopefully spit out

837
00:40:42,330 --> 00:40:45,900
that that's an uninitialized rpb register.

838
00:40:45,900 --> 00:40:48,309
And now we move rsp,

839
00:40:48,309 --> 00:40:51,330
and rbp and rsp is initialized,

840
00:40:51,330 --> 00:40:55,960
but still this is saying our first operant

841
00:40:57,163 --> 00:40:58,713
is an uninitialized rbp.

842
00:40:59,670 --> 00:41:02,850
So let's create some space on the stack,

843
00:41:02,850 --> 00:41:04,050
which you're not able to see.

844
00:41:04,050 --> 00:41:05,970
And I'm gonna move over
because you don't need

845
00:41:05,970 --> 00:41:09,183
to see everything going on with
the registers all the time.

846
00:41:10,080 --> 00:41:13,290
Do notice that registers that change,

847
00:41:13,290 --> 00:41:14,403
they get highlighted.

848
00:41:17,430 --> 00:41:19,830
But I'm just gonna drag this off over here

849
00:41:19,830 --> 00:41:22,290
like this for a moment.

850
00:41:22,290 --> 00:41:27,290
So we can see what's going
on on this side of the fence.

851
00:41:34,050 --> 00:41:37,173
Oh, nothing is going on
this side of the fence.

852
00:41:41,190 --> 00:41:42,840
Why? You might ask.

853
00:41:42,840 --> 00:41:45,300
Well, because I didn't tell it to.

854
00:41:45,300 --> 00:41:47,820
This is all stuff that's often set up

855
00:41:47,820 --> 00:41:49,540
and it will be set up for us

856
00:41:54,570 --> 00:41:59,070
as we move forward with the
release of bit of a VivisectION.

857
00:42:00,620 --> 00:42:02,103
So let's just say,

858
00:42:04,440 --> 00:42:05,910
yeah, we handed an emulator,

859
00:42:05,910 --> 00:42:08,730
but we didn't actually hand
in a gooey funk graph name.

860
00:42:08,730 --> 00:42:09,630
This is one way

861
00:42:09,630 --> 00:42:14,400
to have the emulator drive
a function graph around.

862
00:42:14,400 --> 00:42:17,280
There's another that is
more network friendly

863
00:42:17,280 --> 00:42:19,470
where you're gonna have a shared workspace

864
00:42:19,470 --> 00:42:23,550
and dozens of people can
follow along with the emulator.

865
00:42:23,550 --> 00:42:25,380
But I'm not gonna demo that for you today.

866
00:42:25,380 --> 00:42:28,330
That is a part of the VivisectION
release coming up though.

867
00:42:29,250 --> 00:42:30,780
So let's start over again.

868
00:42:30,780 --> 00:42:32,100
Run step.

869
00:42:32,100 --> 00:42:34,980
Okay, we got the same thing as we had.

870
00:42:34,980 --> 00:42:36,663
Now as we hit enter,

871
00:42:37,620 --> 00:42:40,920
we noticed that our function graph

872
00:42:40,920 --> 00:42:43,230
highlighted the next instruction.

873
00:42:43,230 --> 00:42:47,790
So this allows us to be
very emulator-driven.

874
00:42:47,790 --> 00:42:50,640
Even if I don't wanna pay
attention to the emulator,

875
00:42:50,640 --> 00:42:54,701
I can say I'm more interested
in the disassembly right now.

876
00:42:54,701 --> 00:42:57,293
So I'm gonna say that it's
not really that important,

877
00:42:58,800 --> 00:43:03,570
but I just hit enter into the emulator UI

878
00:43:03,570 --> 00:43:07,080
and it moves on and I'm
able to now look through

879
00:43:07,080 --> 00:43:09,090
as the code goes through,

880
00:43:09,090 --> 00:43:12,720
but sometimes looking I'm more
looking at patterns in here,

881
00:43:12,720 --> 00:43:16,080
and sometimes I will miss
actual detailed things.

882
00:43:16,080 --> 00:43:19,290
So sometimes having the
emulator forced me to just say,

883
00:43:19,290 --> 00:43:20,400
oh, okay, cool,

884
00:43:20,400 --> 00:43:25,230
going through and actively
visually helping me focus

885
00:43:26,280 --> 00:43:28,110
and identify what's going on.

886
00:43:28,110 --> 00:43:29,567
I'm gonna call into this getEmu,

887
00:43:29,567 --> 00:43:32,610
'cause that's gonna
return me into emulator,

888
00:43:32,610 --> 00:43:35,280
for do the crypto thing, decrypt.

889
00:43:35,280 --> 00:43:38,463
Now, I did some work for that name.

890
00:43:39,960 --> 00:43:41,040
We basically just say,

891
00:43:41,040 --> 00:43:42,600
hey, parse this expression.

892
00:43:42,600 --> 00:43:44,820
And here's a string I could have used,

893
00:43:44,820 --> 00:43:49,200
the file name plus an
offset or sub underscore,

894
00:43:49,200 --> 00:43:51,674
blah, blah, blah, whatever the name is.

895
00:43:51,674 --> 00:43:54,233
And it takes that string,
converts it into an integer.

896
00:43:55,110 --> 00:43:58,890
Then grab me an emulator
and set that address

897
00:43:58,890 --> 00:44:01,050
as the virtual address that we start.

898
00:44:01,050 --> 00:44:04,353
Let's log reads, let's log
writes and turn off safemem,

899
00:44:05,250 --> 00:44:08,790
because if it goes wonky and
tries to read from someplace

900
00:44:08,790 --> 00:44:11,310
that I don't want, then I
actually want to know it,

901
00:44:11,310 --> 00:44:13,310
so I can come back here and fix this up.

902
00:44:15,000 --> 00:44:19,230
And then we hand that emulator,
the workspace emulator,

903
00:44:19,230 --> 00:44:23,043
into this NinjaEmulator
that's generated here.

904
00:44:25,650 --> 00:44:30,150
We then read the authdata.bin
that I mentioned before

905
00:44:30,150 --> 00:44:34,020
and put that into the file

906
00:44:34,020 --> 00:44:35,430
if we don't hand in file data

907
00:44:35,430 --> 00:44:36,600
'cause I can hand in a string,

908
00:44:36,600 --> 00:44:39,093
that is the same thing as the file.

909
00:44:40,050 --> 00:44:41,250
And then I call...

910
00:44:41,250 --> 00:44:43,140
This is actually pretty magical.

911
00:44:43,140 --> 00:44:46,888
NinjaEmulator has a set up call function

912
00:44:46,888 --> 00:44:48,788
and then it takes a list of arguments.

913
00:44:50,670 --> 00:44:51,960
And if it's an integer,

914
00:44:51,960 --> 00:44:54,060
it'll push that to the right location,

915
00:44:54,060 --> 00:44:56,160
the stack or the register that's used

916
00:44:56,160 --> 00:44:57,560
for this calling convention.

917
00:44:59,190 --> 00:45:01,860
And file data is actually a string,

918
00:45:01,860 --> 00:45:05,790
so it's going to call its
internal malloc function,

919
00:45:05,790 --> 00:45:10,230
create some space that
NinjaEmulator manages

920
00:45:10,230 --> 00:45:14,400
and shove that string into that space

921
00:45:14,400 --> 00:45:16,020
just by handing it in here.

922
00:45:16,020 --> 00:45:18,150
We then hand in the
length of the file data.

923
00:45:18,150 --> 00:45:19,500
So that's just a number.

924
00:45:19,500 --> 00:45:23,040
It's going to push that into the register

925
00:45:23,040 --> 00:45:25,833
for the second argument.

926
00:45:26,700 --> 00:45:30,090
We then know that this is a secret key,

927
00:45:30,090 --> 00:45:31,593
I know it's super secret key.

928
00:45:32,910 --> 00:45:35,776
And so that is...

929
00:45:35,776 --> 00:45:37,307
The NinjaEmulator that takes
this says this as (indistinct).

930
00:45:37,307 --> 00:45:40,020
This a string, malloc something

931
00:45:40,020 --> 00:45:44,490
that's that size plus, you
know, some buffer space

932
00:45:44,490 --> 00:45:46,350
and store this here and then put

933
00:45:46,350 --> 00:45:49,410
that address into the appropriate location

934
00:45:49,410 --> 00:45:51,300
for the calling convention.

935
00:45:51,300 --> 00:45:54,600
And then here's a special way
of handing in an argument.

936
00:45:54,600 --> 00:45:56,733
I've labeled it out count.

937
00:45:58,830 --> 00:46:00,150
And I'm just gonna say,

938
00:46:00,150 --> 00:46:03,990
hey, this is a 64 bit value of zeros.

939
00:46:03,990 --> 00:46:08,580
I could have said, yeah, no,

940
00:46:08,580 --> 00:46:11,460
I wanted this to malloc out a location

941
00:46:11,460 --> 00:46:14,460
because it's gonna be
handed in by reference.

942
00:46:14,460 --> 00:46:16,680
So this will call malloc.

943
00:46:16,680 --> 00:46:20,760
It'll put in the emulator
metadata this name, out count,

944
00:46:20,760 --> 00:46:22,200
and give you the address

945
00:46:22,200 --> 00:46:25,383
so I can do post mortem
inspection when I'm done.

946
00:46:27,630 --> 00:46:29,130
And so that's initialized.

947
00:46:29,130 --> 00:46:31,023
So I'm just gonna go in and do that.

948
00:46:33,180 --> 00:46:34,950
Ah, there.

949
00:46:34,950 --> 00:46:38,510
So auth_emu is this thing
that I was just showing you.

950
00:46:38,510 --> 00:46:41,290
We get EMU do crypto thing decrypt

951
00:46:42,240 --> 00:46:44,840
and I hand it in the workspace
and it does the rest.

952
00:46:47,010 --> 00:46:48,393
And then I do run step.

953
00:46:49,890 --> 00:46:54,640
So if we emulate through
boom, boom, boom, boom.

954
00:46:54,640 --> 00:46:58,380
Okay, so rdi we're gonna store RDI.

955
00:46:58,380 --> 00:46:59,213
What is rdi?

956
00:47:00,390 --> 00:47:04,053
rdi is our first heap allocation.

957
00:47:05,100 --> 00:47:06,900
And we can look at the heap allocations

958
00:47:06,900 --> 00:47:08,193
by typing in heap here.

959
00:47:11,010 --> 00:47:13,650
And our heap dump shows.

960
00:47:13,650 --> 00:47:16,497
This is what was handed
in from the auth_data.

961
00:47:22,170 --> 00:47:25,590
Here's our passcode, our secret,

962
00:47:25,590 --> 00:47:28,833
and here's the output
buffer that was allocated.

963
00:47:29,670 --> 00:47:32,163
So if I wanted to,

964
00:47:34,413 --> 00:47:35,610
I'll talk about more about this later.

965
00:47:35,610 --> 00:47:37,203
But let's just take a look at,

966
00:47:38,040 --> 00:47:41,220
this looks like something
interesting probably as a string.

967
00:47:41,220 --> 00:47:44,460
So let's just say, hey,
show me that as a string.

968
00:47:44,460 --> 00:47:47,403
Sure enough, it's a string.

969
00:47:49,830 --> 00:47:53,940
There's a whole bunch of functionality

970
00:47:53,940 --> 00:47:57,240
that you can use from this
horrible command line.

971
00:47:57,240 --> 00:47:58,650
I apologize in advance.

972
00:47:58,650 --> 00:47:59,700
It looks horrible.

973
00:47:59,700 --> 00:48:01,500
We'll keep working on it,

974
00:48:01,500 --> 00:48:05,460
but we do have a help that
gives you the commands,

975
00:48:05,460 --> 00:48:08,190
including quit and go silent

976
00:48:08,190 --> 00:48:09,960
so that you don't print
out all this memory

977
00:48:09,960 --> 00:48:11,493
and register stuff.

978
00:48:12,781 --> 00:48:14,181
Then we can do a back trace.

979
00:48:16,281 --> 00:48:18,150
We use the go command to say,

980
00:48:18,150 --> 00:48:20,670
hey, go into this virtual address

981
00:48:20,670 --> 00:48:23,970
or go this number of instructions forward.

982
00:48:23,970 --> 00:48:26,940
Then we also have the next instruction.

983
00:48:26,940 --> 00:48:29,160
So if we go to a call for example,

984
00:48:29,160 --> 00:48:31,080
and we don't wanna actually
dive into the call,

985
00:48:31,080 --> 00:48:33,780
we can just do rni and skip it,

986
00:48:33,780 --> 00:48:34,710
it'll emulate it.

987
00:48:34,710 --> 00:48:37,230
It'll actually spit out all
the data from the emulation,

988
00:48:37,230 --> 00:48:39,080
but you won't have to single step it.

989
00:48:40,500 --> 00:48:42,510
B means emulate to the next branch,

990
00:48:42,510 --> 00:48:45,060
instead of again, single stepping.

991
00:48:45,060 --> 00:48:48,480
We can show our stack as we did before,

992
00:48:48,480 --> 00:48:49,313
but our stack,

993
00:48:51,690 --> 00:48:54,570
we can control how much of
the stack we wanna show.

994
00:48:54,570 --> 00:48:57,060
Apparently I ran past
the end of the stack,

995
00:48:57,060 --> 00:48:58,910
'cause there's not a hundred entries.

996
00:49:03,570 --> 00:49:08,520
I can create new heap items just because,

997
00:49:08,520 --> 00:49:10,980
like if I'm emulating through
and I run into a thing

998
00:49:10,980 --> 00:49:15,420
where I'm like, yeah, no,
that's really supposed

999
00:49:15,420 --> 00:49:18,540
to be a heapalloc that I
need to shove some data in.

1000
00:49:18,540 --> 00:49:23,540
So I can say, yeah, malloc
that give me a hundred bytes.

1001
00:49:24,960 --> 00:49:27,450
And it says, okay, your
new chunk is there.

1002
00:49:27,450 --> 00:49:28,950
So now I can say,

1003
00:49:28,950 --> 00:49:30,183
hey, make that,

1004
00:49:31,842 --> 00:49:35,020
and that's a string and
make that equal to yo dawg,

1005
00:49:37,740 --> 00:49:40,713
hello defcon crew.

1006
00:49:42,600 --> 00:49:43,590
Boom.

1007
00:49:43,590 --> 00:49:45,423
So now we say what's on the heap?

1008
00:49:47,430 --> 00:49:48,263
Okay, I can.

1009
00:49:50,760 --> 00:49:52,660
Let's take a look at that as a string.

1010
00:49:56,010 --> 00:49:57,300
All right.

1011
00:49:57,300 --> 00:49:59,670
So I mean, at that point, if we're like,

1012
00:49:59,670 --> 00:50:01,830
no, that really needs
to be an rbx right now,

1013
00:50:01,830 --> 00:50:05,200
we can say rbx equals

1014
00:50:07,860 --> 00:50:10,653
that address and then refresh.

1015
00:50:13,018 --> 00:50:14,880
And now we see rbx is that address.

1016
00:50:14,880 --> 00:50:15,990
And, you know, if that's the thing

1017
00:50:15,990 --> 00:50:17,280
that keeps the thing going,

1018
00:50:17,280 --> 00:50:20,130
you can go back and update
your starter script,

1019
00:50:20,130 --> 00:50:21,963
but you can also keep going.

1020
00:50:24,390 --> 00:50:27,960
Now, the beauty is if it doesn't work out

1021
00:50:27,960 --> 00:50:29,190
and I figure out,

1022
00:50:29,190 --> 00:50:30,483
oh, whoops, I screwed up,

1023
00:50:31,710 --> 00:50:34,410
if I have it in the starter
script, I can just say,

1024
00:50:34,410 --> 00:50:35,970
hey, go back to the starter script

1025
00:50:35,970 --> 00:50:37,770
and then go to this address

1026
00:50:37,770 --> 00:50:42,003
and it'll boom, snap
through all the stuff again.

1027
00:50:44,070 --> 00:50:46,260
All right, so moving right along.

1028
00:50:46,260 --> 00:50:47,520
So much I wanna show you.

1029
00:50:47,520 --> 00:50:50,426
I'm sorry I only have
a little bit of time.

1030
00:50:50,426 --> 00:50:51,856
Boom, boom, boom, boom, boom, boom,

1031
00:50:51,856 --> 00:50:52,860
boom, boom, boom, boom, boom, boom.

1032
00:50:52,860 --> 00:50:54,210
Oh, branch.

1033
00:50:54,210 --> 00:50:55,043
Okay, cool.

1034
00:50:55,043 --> 00:50:56,070
Branch.

1035
00:50:56,070 --> 00:50:58,290
I don't really care
what's going on in this,

1036
00:50:58,290 --> 00:50:59,400
okay, I really do care.

1037
00:50:59,400 --> 00:51:02,433
But for the sake of time we do nexty,

1038
00:51:04,830 --> 00:51:08,310
it emulates through the function returns.

1039
00:51:08,310 --> 00:51:11,910
I got a return value, huh?

1040
00:51:11,910 --> 00:51:14,580
Let's take a look at
the heap for a second.

1041
00:51:14,580 --> 00:51:18,513
So in addition to what I allocated there,

1042
00:51:19,410 --> 00:51:24,410
there is what looks to be
some text, some string data.

1043
00:51:26,430 --> 00:51:30,930
So let's see the return
value that they returned.

1044
00:51:30,930 --> 00:51:33,603
Let's just use rex string.

1045
00:51:36,210 --> 00:51:39,280
And this is looking very close

1046
00:51:40,590 --> 00:51:44,070
to what they gave us and the hint

1047
00:51:44,070 --> 00:51:48,690
for the Resonante authenticator challenge.

1048
00:51:48,690 --> 00:51:50,880
So that's VivisectION section guys.

1049
00:51:50,880 --> 00:51:53,670
Here is the location of the project.

1050
00:51:53,670 --> 00:51:57,000
It should be released
by the end of DEFCON.

1051
00:51:57,000 --> 00:51:58,950
And if you have any questions,

1052
00:51:58,950 --> 00:52:00,363
please feel free to holler.

1053
00:52:01,260 --> 00:52:03,600
Anyway, what are you waiting for?

1054
00:52:03,600 --> 00:52:05,880
Solve problems with emulation.

1055
00:52:05,880 --> 00:52:08,070
Reach out for help if you need it.

1056
00:52:08,070 --> 00:52:09,620
Here's how to get a hold of me.

1057
00:52:10,710 --> 00:52:12,783
Play around, the rest will come.

1058
00:52:14,250 --> 00:52:16,170
And when you get the slides,

1059
00:52:16,170 --> 00:52:20,373
there's a whole bunch
of salvage yard stuff.

1060
00:52:21,840 --> 00:52:22,980
Thank you very much.

1061
00:52:22,980 --> 00:52:25,230
Looking forward to seeing
you guys next year.

1062
00:52:28,183 --> 00:52:31,183
(audience applauds)