Frustrating Automated Static Analysis of Binaries

Presented at ShmooCon I (2005), Feb. 5, 2005, 3 p.m. (60 minutes).

As industries evolve and mature, the natural progression is to turn toward the automation of tasks. The computer security space is not immune to this law of business, and consequently, the prevailing trend in software vulnerability detection is toward automation. While tools for detection of vulnerabilities are not new, they have historically performed a grep-style check of the source for known unsafe functions, rather than performing any useful logical analysis of the software.

Currently, analysis is taking the leap into the next generation. We are beginning to see the first generation of auditing tools which transcend source code pattern matching, and perform legitimate logic and flow analysis. In this age when the security of software is finally beginning to become a focus of industry and government, these tools will supplant the efforts of manual auditors when the security of a product must be confirmed. Their consistency and thoroughness will be relied upon heavily.

This paper will discuss several techniques for frustrating the automated analysis and reverse engineering of binaries using techniques at the source code, assembly, and binary level. These techniques will then be demonstrated against such tools as Ida, in order to show that it is possible to hide data not only from simple pattern based tools such as virus scanners, but also from more robust decompilation tools.


Presenters:

  • Pusscat - Ghetto Hackers
    Puss was so sadly terrified at the sight of malicious code so near her that she immediately got into the debugger, not without abundance of trouble and danger, because of its obfuscation, which was of no use at all to her in analyzing the program. A little while after, when Puss saw that the program had resumed its natural form, she stopped the debugger, and owned she had been very much frightened. "I have been, moreover, informed," said the Cat, "but I know not how to believe it, that you have also the power to take on you the shape of safe code; for example, to change yourself into unreadable opcodes; but I must own to you I take this to be impossible!"

Links:

Similar Presentations: