OpenRCE

About Articles Book Store Distributed RCE Downloads Event Calendar Forums Live Discussion Reference Library RSS Feeds Search Users What's New

Customize Theme

Flag: Tornado! Hurricane!

Created: Saturday, July 24 2010 06:23.54 CDT

Modified: Saturday, July 31 2010 05:41.04 CDT

Direct Link, View / Make / Edit Comments

Dr. Gadget IDAPython plugin

Author: dennis

# Views: 6785

Hi,

I wanted to share with you this little IDAPython plugin which helps in writing and analyzing return oriented payload. It uses IDA's custom viewers in order to display an array of DWORDs called 'items', where an item can be either a pointer to a gadget or a simple 'value'.
There are several keyboard shortcuts to access functionality that otherwise also is accessible via the context menu:

ESC   - closes the plugin
ENTER - jumps to item address in disassembly
O     - toggles item type (offset, value)
D     - deletes an item
I     - inserts an item
E     - edits an item's value

Functionality that is accessible via context menu only:

Load payload     - loads a payload from disk
Save payload     - saves a payload to disk

Auto analysis I  - tries to determine each item's type (offset, value)
Reset            - resets each item's type
Show disassembly - opens a disassembly subwindow

Below screenshots show the plugin's interface. The IDB is a disassembly
of 'BIB.dll' (MD5: 2ec16a4cdb828a31a432513a82cbafdf). _rop.bin is some
exploit's payload in binary form (more info:
http://blog.zynamics.com/2010/06/09/analyzing-the-currently-exploited-0-day-for-adobe-reader-and-adobe-flash/)

The plugin can be used either on a static disassembly or during an IDA debugging session.

The plugin is available here: http://www.openrce.org/repositories/users/dennis/drgadget.py
_rop.bin is available here: http://www.openrce.org/repositories/users/dennis/rop.bin

edit:
just uploaded v0.2 which adds Elias Bachaalany's "find instruction/opcode" script from
http://hexblog.com/2009/09/assembling_and_finding_instruc.html

Created: Thursday, January 10 2008 11:58.42 CST

Modified: Thursday, January 10 2008 12:11.10 CST

Direct Link, View / Make / Edit Comments

note to self

Author: dennis

# Views: 3712

when patching drivers such as tcpip.sys by hand, do not forget to update the image checksum before rebooting ;-)

Created: Friday, June 29 2007 09:43.02 CDT

Modified: Friday, June 29 2007 09:46.41 CDT

Direct Link, View / Make / Edit Comments

How to launch an executable...

Author: dennis

# Views: 9287

...without creating it on disk. Ever wondered how to do that?
So did I. So I've taken apart an interesting executable crypter that
I found the other day. Not one of those crypters adding code/sections
to an existing PE file but one of those crypters that embed the "target"
executable as a resource into its loader code.

The technique is simple, yet interesting (for _various_ purposes).

1. launch a copy of the loader process in suspended mode.
2. get the context structure of the copy of the loader process.
3. retrieve the imagebase of the process by parsing its PEB structure (ebx at process start!).
4. free all the data belonging to the process by calling ZwUnmapViewOfSection and passing it the imagebase.
5. get the SizeOfImage value of the embedded executable from its PE header.
6. allocate a new block of memory starting at the imagebase with the size of the SizeOfImage value.
7. copy all the headers (pe header, section header etc.) to the allocated block of memory.
8. copy each section of the embedded executable to the allocated block of memory, setting their memory protection according to their section characteristics.
9. the imagebase in the PEB of the process has to patched to equal the address of the allocated block of memory
10. set eax of the process to point to the entrypoint of the process
11. resume the process, if all went well.

For a better understanding, have a look at the disassembly.

Created: Wednesday, June 13 2007 05:49.53 CDT

Modified: Wednesday, June 13 2007 06:14.09 CDT

Direct Link, View / Make / Edit Comments

can you read binary code? ;-)

Author: dennis

# Views: 4799

I love this comic. Actually it's pretty old, but today I wondered if that binary code is anything meaningful ;-)

Created: Thursday, May 31 2007 14:35.07 CDT

Modified: Thursday, May 31 2007 14:41.06 CDT

Direct Link, View / Make / Edit Comments

Adding code to ROM(image)s

Author: dennis

# Views: 3497

For anyone who is/was interested in trainers/adding code,
I've put source code of trainers for some NES games into my repository. They explain how to add code to an existing ROM image, how to patch memory on the M6502 and how to win if you suck at games ;-)

If you're too lazy to assemble the source code yourself, you can use the included IPS files to patch your own ROM image.

Be sure to check out this as well.

Archived Entries for dennis

Subject	# Views	Created On
Canaries and format strings	2424	Sunday, May 27 2007
VSCP IDA Pro plugin	1374	Friday, May 25 2007
IDABone	1259	Wednesday, May 23 2007
InsColor	1939	Thursday, March 29 2007
gotoSEH	1967	Tuesday, February 20 2007

There are 28,226 total registered users.

Recently Created Topics
Reverse Engineering ...	Jan/23
Career: DoD Agency I...	Jan/22
"Disappearing&q...	Jan/17
Career: Software Sec...	Jan/11
Where is the call st...	Jan/07
IDA Pro 6.1 Breakpoi...	Jan/01
How to create data s...	Dec/30
can i search all mod...	Dec/23
IDA symbol table exp...	Dec/20
An anti-attach trick	Dec/17

Recent Forum Posts
Reverse Engineering ...	NirIzr
"Disappearing&q...	NirIzr
Reverse Engineering ...	charlie
"Disappearing&q...	charlie
An anti-attach trick	Bass
An anti-attach trick	waleeda...
An anti-attach trick	Bass
An anti-attach trick	waleeda...
An anti-attach trick	Bass
Looking for value in...	NirIzr

Recent Blog Entries
	cmathieu	Feb/07
Hacker Carnival
	waleedassar	Feb/06
OllyDbg v1.10 And Hardware ...
	waleedassar	Jan/31
Yet Another Anti-Debug Trick
	RolfRolles	Jan/22
Finding Bugs in VMs with a ...
	waleedassar	Jan/13
An OllyDbg Bug Disables Sof...
More ...

Recent Blog Comments
	waleedassar on:	Feb/07
OllyDbg v1.10 And Hardware ...
	NirIzr on:	Feb/07
OllyDbg v1.10 And Hardware ...
	NirIzr on:	Feb/05
Yet Another Anti-Debug Trick
	trolotou on:	Feb/05
Doudoune Moncler -Pennies F...
	waleedassar on:	Feb/01
Yet Another Anti-Debug Trick
More ...

Imagery

SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit