Two very small reverse engineering tools: a python disassembling engine and an iterative reverse engineering framework

Presented at REcon 2008, June 15, 2008, noon (30 minutes).

A couple of years ago in ReCon 2006 Pedram Amini presented PAIMEI. This awesome framework depends on IDA to disassemble binaries and get functions and basic block information. The first tool we present is an incomplete replacement of IDA (in this context) with an extra tweak on how jump-in-the-middle-of-instruction obfuscation is handled. The second tool may be useful when reversing from binary back to C code. The idea is very simple: The reverser reads assembly and writes C, one function at a time, this new reversed C code can be compiled as a fragment and relinked into the original application. The result is a hybrid application, part original part new. This new application can be debugged, in assembly for the original part, and in C for the new reversed part. The main idea is to have, all the time, a working version of the application which is iteratively reverse engineered into C, while the reverser doesn't have to wait until the end to test the result. WARNING: The simplicity of the implementation will probably disappoint you.


Presenters:

  • Gera
    In the last 15 years Gerardo 'gera' Richarte has been dedicated to computer security. He has spoken in different conferences including BlackHat, CanSecWest and PacSec among others, and taught assembly language and exploit writing classes for private, public and military students. For the last 12 years he's been part of Core Security Technologies, where he was a Sr. Security Consulting, Sr. Security Software Engineer and Reverse-Engineer, and has been working, for the last 5 years, as an Expert Exploit Writer, technically leading the exploit writing team for the CORE IMPACT product. During all these years he's published some papers, advisories and open source tools as a humble thank you to the community that has given so much to him.

Links:

Similar Presentations: