Next Generation Process Emulation with Binee

Presented at DEF CON 27 (2019), Aug. 10, 2019, 2 p.m. (45 minutes).

The capability to emulate x86 and other architectures has been around for some time. Malware analysts have several tools readily available in the public domain. However, most of the tools stop short of full emulation, halting or doing strange things when emulating library functions or system calls not implemented in the emulator. In this talk we introduce a new tool into the public domain, Binee, a Windows Process emulator. Binee creates a nearly identical Windows process memory model inside the emulator, including all dynamically loaded libraries and other Windows process structures. Binee mimics much of the OS kernel and outputs a detailed description of all function calls with human readable parameters through the duration of the process. We've designed Binee with two primary use cases in mind; data extraction at scale with a cost and speed similar to common static analysis tools, and second, for malware analysts that need a custom operating system and framework without the overhead of spinning up various configurations of virtual machines. Currently Binee can run on Windows, OS X, and Linux.

Presenters:

• Kyle Gwinnup - Senior Threat Researcher, Carbon Black
  Kyle is a Senior Threat Researcher in Carbon Black's TAU team. He has over 10 years of experience in many areas of computer science and IT. Prior to Carbon Black, Kyle worked in finance and with the DoD in various roles ranging from network/systems administrator, software engineer, reverse engineer, penetration tester and offensive tool developer. At Carbon Black, Kyle's focus is on large scale program analysis, primarily static but moving asymptotically toward dynamic analysis. Twitter: @switchp0rt
• John Holowczak - Threat Researcher
  John is a Threat Researcher on Carbon Black's Threat Analysis Unit, focusing on automation of threat detection and building out infrastructure for large scale malware analysis. Within the field of threat detection and analysis, John specializes his research in binary classification, dynamic analysis and reverse engineering. Twitter: @skipwich

Links:

• https://defcon.org/html/defcon-27/dc-27-speakers.html#Gwinnup
• https://infocon.org/cons/DEF CON/DEF CON 27/DEF CON 27 video and slides/DEF CON 27 - Kyle Gwinnup - Next Generation Process Emulation with Binee.mp4
• https://infocon.org/cons/DEF CON/DEF CON 27/DEF CON 27 video and slides/DEF CON 27 - Kyle Gwinnup - Next Generation Process Emulation with Binee.srt (subtitles)
• https://www.youtube.com/watch?v=z4OvVFw5pYI

Similar Presentations:

• Black Hat USA 2012 / File disinfection framework: Striking back at polymorphic viruses
• DEF CON 26 (2018) / Reverse Engineering Windows Defender's Emulator
• Black Hat USA 2018 / Windows Offender: Reverse Engineering Windows Defender's Antivirus Emulator