Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
Unicornを用いたDead Code除去
Search
@tkmru
March 20, 2017
0
230
Unicornを用いたDead Code除去
セキュリティ・キャンプ フォーラム 2017
@tkmru
March 20, 2017
Tweet
Share
More Decks by @tkmru
See All by @tkmru
Bring Your Own Container: When Containers Turn the Key to EDR Bypass/byoc-avtokyo2024
tkmru
2
1.4k
ipa-medit: Memory search and patch tool for IPA without Jailbreaking/ipa-medit-bh2022-europe
tkmru
0
330
Ipa-medit: Memory modification tool for iOS apps without Jailbreaking/ipa-medit-codeblue2022
tkmru
0
170
趣味と実益のための著名なOSSライブラリ起因の脆弱性の探求/seccamp2021-b5
tkmru
0
5.4k
Ipa-medit: Memory Search and Patch Tool for IPA Without Jailbreaking @Black Hat USA 2021 Arsenal/ipa-medit-bh2021-usa
tkmru
1
4.5k
Learn the essential way of thinking about vulnerabilities through post-exploitation on middlewares (MySQL/PostgreSQL編)/seccamp2020-b8
tkmru
3
880
apk-medit: memory search and patch tool for debuggable APK @CODE BLUE 2020 Bluebox
tkmru
0
200
apk-medit: memory search and patch tool for debuggable APK @Black Hat USA 2020 Arsenal/apk-medit-bh2020-usa
tkmru
0
4.1k
めんどうくさいゲームセキュリティ
tkmru
20
11k
Featured
See All Featured
Product Roadmaps are Hard
iamctodd
PRO
53
11k
Done Done
chrislema
184
16k
Templates, Plugins, & Blocks: Oh My! Creating the theme that thinks of everything
marktimemedia
30
2.4k
How to Think Like a Performance Engineer
csswizardry
23
1.6k
Fontdeck: Realign not Redesign
paulrobertlloyd
84
5.5k
Rails Girls Zürich Keynote
gr2m
94
13k
Making the Leap to Tech Lead
cromwellryan
133
9.3k
GitHub's CSS Performance
jonrohan
1031
460k
What's in a price? How to price your products and services
michaelherold
245
12k
Art, The Web, and Tiny UX
lynnandtonic
298
21k
Faster Mobile Websites
deanohume
307
31k
Put a Button on it: Removing Barriers to Going Fast.
kastner
60
3.9k
Transcript
UnicornΛ༻͍ͨDead Codeআڈ Security Camp Forum 2017 tkmruɹ
ࣗݾհ • ໊લ: ͚ͨ·Δ • ηΩϡϦςΟɾΩϟϯϓ શࠃେձ 2015 ଔۀੜ •
twitter ID: @tkmru • CTFνʔϜ: TomoriNao
Dead Codeͱ • Dead Code࣮ߦͯ͠ҙຯ͕ͳ͍ίʔυ • ΞϯνσόοάͷͨΊʹϚϧΣΞʹେྔʹDead Codeؚ͕·ΕΔ • ղੳͷোͱͳΔ
؆୯ͳྫ x86 asm • mov eax, 0x100000 • shr eax,
0x10 • add eax, 0x913 • and eax, 0x1fff • mov ecx, eax • mov eax, 0x1918632 • and ecx, 0x600 • mov ecx, 0x800
؆୯ͳྫ x86 asm • mov eax, 0x100000 • shr eax,
0x10 • add eax, 0x913 • and eax, 0x1fff • mov ecx, eax • mov eax, 0x1918632 • and ecx, 0x600 • mov ecx, 0x800 จࣈҎ֎Dead Code
ྫ) Themida(Packer) A Generic Approach to Automatic Deobfuscation of Executable
Code http://www.sysnet.ucsd.edu/~bjohanne/assets/papers/oakland2015.pdf
Nao(No-meaning Assembly Omiter) • Dead CodeআڈΛ͢ΔIDAϓϥάΠϯΛOSSͱͯ͠։ൃ • IDAPython • Unicorn(CPUΤϛϡϨʔλͷํ)
• https://github.com/tkmru/nao • ࣮ࡍʹΤϛϡϨʔλ্Ͱ࣮ߦ͢ΔͷͰɺߴ͍ਫ਼Ͱআ ڈͰ͖Δ • ෳͷΞʔΩςΫνϟʔʹରԠՄೳ
Unicornͱ • QEMU forkͷϚϧνϓϥοτϑΥʔϜɺϚϧνΞʔΩς ΫνϟͳCPUΤϛϡϨʔλ • όΠφϦղੳπʔϧ angrͰ༻͍ΒΕ͍ͯΔͷΛ͡ Ίɺ֤छπʔϧ։ൃͰΘΕ͍ͯΔ •
ηΩϡϦςΟք۾ͰͷOSS
Unicorn
Unicornͷshowcaseʹܝࡌ
ΞϧΰϦζϜ • IDAͷάϥϑϏϡʔʹදࣔ͞Ε͍ͯΔόΠφϦΛऔΓग़ ͢ • NOP໋ྩʹҰߦͣͭมߋ͠ɺUnicornΛ༻͍࣮ͯߦ • ࠷ऴతͳϨδελͷΛൺֱͯ͠அ • มߋ͞Ε͍ͯͨΒɺ݁ՌʹӨڹ͢ΔͷͰDead
Code Ͱͳ͍ • มߋ͞Ε͍ͯͳ͚Εɺ݁ՌʹӨڹ͍ͯ͠ͳ͍ͷͰɹ Dead CodeͰ͋Δͱஅ
؆୯ͳྫ x86 asm • mov eax, 0x100000 • shr eax,
0x10 • add eax, 0x913 • and eax, 0x1fff • mov ecx, eax • mov eax, 0x1918632 • and ecx, 0x600 • mov ecx, 0x800 ݁Ռ eax: 0x1918632 ecx: 0x800
؆୯ͳྫ x86 asm • mov eax, 0x100000 → nop •
shr eax, 0x10 → nop • add eax, 0x913 → nop • and eax, 0x1fff → nop • mov ecx, eax → nop • mov eax, 0x1918632 • and ecx, 0x600 → nop • mov ecx, 0x800 ݁Ռ eax: 0x1918632 ecx: 0x800 ফڈͯ݁͠ՌʹӨڹ͕ͳ͍ͷͰDead CodeͱஅͰ͖Δ
σϞ
͓ΘΓʹ • ಈ࡞ʹ͕͋ΔͷͰɺ·ͩमਖ਼͍ͯ͘͠ • Unicornͷ࡞ऀʹධՁͯ͠Β͑ͯΑ͔ͬͨ • ղੳऀͷิॿͱͳΔΑ͏ͳπʔϧΛOSSͱͯ͠ࠓޙ࡞ Γଓ͚͍͖͍ͯͨ