OpenRCE

📚 OpenRCE is preserved as a read-only archive. Launched at RECon Montreal in 2005. Registration and posting are disabled.

About Articles Book Store Distributed RCE Downloads Event Calendar Forums Live Discussion Reference Library RSS Feeds Search Users What's New

Customize Theme

Flag: Tornado! Hurricane!

Created: Monday, March 9 2009 08:55.00 CDT

Modified: Monday, March 9 2009 09:04.07 CDT

This is an imported entry. View original.

Direct Link

Reverse Engineering / Bug hunting trainings in Amsterdam

Author:

halvar

# Views: 3978

Hey all,

I havent given a reverse engineering trainings class in Amsterdam for a few years, but this year is different :-) -- I will be at BH Amsterdam, and there are still seats open in the trainings class for April 14th and 15th.

What will be done in the course ? Well, for one thing, well go bug-hunting in some interesting piece of code. Furthermore, well talk quite a bit about C++ and its effects in the binary. Well do a fair bit of differential debugging, some more bug-hunting, and a lot of IDA automation. Questions like

given a C++ executable, how do I recover an inheritance diagram of the classes ?
given a big and ugly executable, how do I find the interesting places to focus on ?
how do I make sure IDAPython and NaviPython make my life easier ?

will be treated thoroughly.

So, if you still have some trainings/travel budget left in spite of the crisis, you can find more
details here.

Created: Wednesday, March 4 2009 12:01.00 CST

Modified: Wednesday, March 4 2009 13:29.35 CST

This is an imported entry. View original.

Direct Link

Diffing x86 vs ARM code

Author:

halvar

# Views: 3966

I posted a while ago about the new DiffDeluxe comparison engine, and that wed release it in Q1 2009. Well, were almost there, the engine is now in beta. If you are a BinDiff user and wish to give the new engine a try, send mail to [email protected] :-)

I mentioned in my last post on the topic that DiffDeluxe was designed to facilitate symbol porting, and to allow comparisons between executables that are "far away" from each other.

In the last post I wrote about Mozilla JS engine vs. Acrobat EScript.dll. Today I am going to try something slightly crazier: In order to evaluate how well these matching algorithms work, we will be diffing an executable that was compiled for ARM against a very similar executable compiled for x86.

My coworker Vincenzo is a big fan of all things OSX, and he brought up the idea of comparing x86 and ARM versions of the OSX dynamic loader -- namely the disassembly of dyld on the iphone against the disassembly of dyld on OSX.

Now, the first voices are going to yell: "You have names for all functions, BinDiffing is easy then!". Well, true, but we will run DiffDeluxe without taking the names into account, and then just using the names to validate the results.

The two executables have 704 (x86) and 618 (ARM) functions respectively. Without name
matching, we match 345 functions. Inspecting the symbols, we see that we have matched
160 of these functions in full accordance with the symbols. Lets have a look at some of the details:

Cute, eh ? Lets look at some more...

It is almost surprising how far one can get without actually looking at the instruction semantics.

If we take the names into account, matching functions becomes easy, but matching basic blocks properly ends up the difficulty. With name matching enabled, DiffDeluxe matches 3809 basic blocks, out of 7904 respective 5196.

So to summarize: The structural comparison is sufficiently strong to yield some useful results even accross two different CPUs. While there is still (a good amount) of room for improvement, I am quite happy with these results so far :-)

So, if you want to beta, and you already use BinDiff, drop us a line !

Created: Thursday, February 5 2009 09:41.00 CST

Modified: Thursday, February 5 2009 09:48.30 CST

This is an imported entry. View original.

Direct Link

Washington DC, Trainings, Demos :-)

Author:

halvar

# Views: 3476

Hey all,

I will be in Washington DC from the 16th to the 20th of February. Amongst other things, I will be teaching a course at Blackhat DC. The economic crisis is clearly hitting -- e.g. there are still seats available. We will also get around to using some of the nice features of BinNavi v2 in class, which I am looking forwards to.

Now, aside from the course: If you are in the DC area and interested in a product demo for BinDiff (and the upcoming DiffDeluxe), BinNavi v2 (including REIL), or the latest VxClass (now available as service and virtual appliance), do not hesitate to drop a line to [email protected] :-)

Created: Monday, January 5 2009 01:49.00 CST

Modified: Monday, January 5 2009 01:50.53 CST

This is an imported entry. View original.

Direct Link

Correction: Clam *does* have some unpacking support

Author:

halvar

# Views: 3434

Correction of my last post: It appears that Clam has *some* unpacking support. It is not as comprehensive as some of us would like, but progress is being made :-)

Created: Sunday, January 4 2009 09:41.00 CST

Modified: Sunday, January 4 2009 09:42.56 CST

This is an imported entry. View original.

Direct Link

ClamAV and unpackers

Author:

halvar

# Views: 3474

Hey all,

this might be a rather odd question, but given the (unfortunate) fact that ClamAV cant unpack
even the simplest packers, has nobody ever contemplated writing packer-specific unpackers
for ClamAV ?

Cheers,
Halvar

Archived Entries for halvar

Subject	# Views	Created On
TAOSSA blog post I didnt see but will comment on :-)	551	Friday, December 26 2008
Sometimes, diffing can remove obfuscation (albeit rarely)	527	Friday, December 26 2008
A good protocol attack ...	1499	Saturday, November 15 2008
BinDiff / BinNavi User Forum	1407	Tuesday, November 11 2008
Malicious Office/PDFs	1379	Tuesday, November 11 2008
BinNavi v2 and PHP !	1693	Monday, November 10 2008
German ways of expressing optimism	1251	Saturday, November 8 2008
The joys of the Volkswagen Caddy Natural Gas car	1123	Sunday, October 26 2008
For those playing with the printer bug...	1610	Wednesday, October 15 2008
My bros comments on the financial crisis	1357	Sunday, October 5 2008
A few things I forgot to mention :-)	1694	Wednesday, October 1 2008
Improving Binary Comparison (and its implication for malware classification)	2503	Monday, September 29 2008
	439	Thursday, July 31 2008
	493	Saturday, July 26 2008
	554	Tuesday, July 22 2008
	600	Monday, July 21 2008
	837	Sunday, July 13 2008
	630	Sunday, July 13 2008
	489	Thursday, July 10 2008
	636	Wednesday, July 2 2008
	667	Saturday, June 28 2008
	547	Sunday, June 15 2008
	547	Sunday, June 15 2008
	695	Thursday, June 12 2008
	866	Monday, April 28 2008
	866	Friday, April 25 2008
	749	Friday, April 25 2008
	966	Wednesday, April 2 2008
	818	Tuesday, April 1 2008
	366	Tuesday, April 1 2008
	369	Tuesday, March 11 2008
	492	Friday, March 7 2008
	294	Tuesday, February 12 2008
	406	Tuesday, January 8 2008
	474	Sunday, October 7 2007
	643	Monday, September 24 2007
	773	Tuesday, September 4 2007
	1276	Saturday, August 4 2007
	68	Thursday, August 2 2007
	1170	Thursday, August 2 2007
	1010	Tuesday, July 31 2007
	719	Sunday, July 29 2007
	540	Sunday, July 29 2007
	582	Thursday, July 12 2007
	466	Saturday, July 7 2007
	681	Wednesday, June 13 2007
	989	Friday, April 27 2007
	1167	Friday, March 23 2007
	1124	Wednesday, February 21 2007
	1144	Monday, February 5 2007
	926	Thursday, January 18 2007
	906	Wednesday, December 13 2006
	694	Tuesday, November 21 2006
	508	Tuesday, November 21 2006
	462	Monday, November 20 2006
	396	Thursday, October 5 2006
	335	Thursday, October 5 2006
	246	Friday, September 8 2006
	318	Friday, September 8 2006
	254	Monday, August 21 2006
	329	Friday, August 11 2006
The security world never ceases to amaze me. A few...	1482	Wednesday, July 26 2006
I will have an 8-hour layover in Toronto tomorrow ...	1686	Wednesday, July 26 2006
The article at this link is a bit funny, but if it...	1581	Tuesday, July 11 2006
I know that I am going to draw the hate of many pe...	1278	Monday, July 10 2006
Question for the Blogosphere: Does anyone know of ...	1853	Tuesday, July 4 2006
This Ebay posting for a Yacht that was previously ...	1679	Sunday, July 2 2006
I used to read security blogs via http://www.dayio...	1350	Saturday, July 1 2006
On bug disclosure and contact with vendors After ...	1578	Saturday, June 24 2006
I really enjoyed reading Ilfaks blog post today :...	1506	Friday, June 23 2006
Compression, Statistics and such In the process o...	1439	Monday, June 12 2006
Some shameless self-promotion: Rolf and me are goi...	1641	Monday, June 5 2006
Extra extra: Google/Sun discover the existence of ...	1679	Saturday, June 3 2006
My prediction for the next two years: Apple, Syman...	1747	Sunday, May 28 2006
MSASN1 is hard to read these days -- the code make...	1746	Tuesday, May 23 2006
The Vodafone virus dropped by today and brought us...	1804	Saturday, May 20 2006
Quote from Lock, Stock and Two Smoking Barrels: "I...	1711	Saturday, May 20 2006
	0	Friday, May 19 2006
	0	Tuesday, May 16 2006
	0	Friday, May 12 2006
	0	Monday, May 8 2006
	0	Saturday, April 29 2006
	0	Friday, April 28 2006
	0	Friday, April 28 2006
	0	Wednesday, April 26 2006
	0	Wednesday, April 19 2006
	0	Wednesday, April 19 2006
	0	Monday, April 17 2006
	0	Monday, April 17 2006
	0	Saturday, April 1 2006
	0	Wednesday, March 15 2006
	0	Sunday, February 26 2006
	0	Saturday, February 18 2006
	0	Tuesday, February 7 2006
	0	Tuesday, February 7 2006
	0	Sunday, January 15 2006
	0	Saturday, December 17 2005
Blogging is strange. You write down a few lines of...	1744	Wednesday, December 14 2005
Allright, I have 8 minutes of free time before I n...	1682	Tuesday, December 13 2005
One of the lectures I am attending, "Algebra and A...	1744	Saturday, December 10 2005

There are 31,328 total registered users.

Recently Created Topics
[help] Unpacking VMP...	Mar/12
Reverse Engineering ...	Jul/06
let 'IDAPython' impo...	Sep/24
set 'IDAPython' as t...	Sep/24
GuessType return une...	Sep/20
About retrieving the...	Sep/07
How to find specific...	Aug/15
How to get data depe...	Jul/07
Identify RVA data in...	May/06
Question about memor...	Dec/12

Recent Forum Posts
Finding the procedur...	rolEYder
Question about debbu...	rolEYder
Identify RVA data in...	sohlow
let 'IDAPython' impo...	sohlow
How to find specific...	hackgreti
Problem with ollydbg	sh3dow
How can I write olly...	sh3dow
New LoadMAP plugin v...	mefisto...
Intel pin in loaded ...	djnemo
OOP_RE tool available?	Bl4ckm4n

Recent Blog Entries
	halsten	Mar/14
Breaking IonCUBE VM
	oleavr	Oct/24
Anatomy of a code tracer
	hasherezade	Sep/24
IAT Patcher - new tool for ...
	oleavr	Aug/27
CryptoShark: code tracer ba...
	oleavr	Jun/25
Build a debugger in 5 minutes
More ...

Recent Blog Comments
	nieo on:	Mar/22
IAT Patcher - new tool for ...
	djnemo on:	Nov/17
Kernel debugger vs user mod...
	acel on:	Nov/14
Kernel debugger vs user mod...
	pedram on:	Dec/21
frida.github.io: scriptable...
	capadleman on:	Jun/19
Using NtCreateThreadEx for ...
More ...

Imagery

SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit