Practical Binary Analysis. Build Your Own Linux Tools for Binary Instrumentation, Analysis, and Disassembly

Brief Contents......Page 9
Contents in Detail......Page 11
Foreword......Page 19
Preface......Page 23
Acknowledgments......Page 25
Introduction......Page 27
What Is Binary Analysis, and Why Do You Need It?......Page 28
What Makes Binary Analysis Challenging?......Page 29
What's in This Book?......Page 30
Binary Format and Development Platform......Page 32
Code Sample and Virtual Machine......Page 33
Exercises......Page 34
Part I: Binary Formats......Page 35
Chapter 1: Anatomy of a Binary......Page 37
The Preprocessing Phase......Page 38
The Compilation Phase......Page 40
The Assembly Phase......Page 42
The Linking Phase......Page 43
Viewing Symbolic Information......Page 44
Another Binary Turns to the Dark Side: Stripping a Binary......Page 46
Looking Inside an Object File......Page 47
Examining a Complete Binary Executable......Page 49
Loading and Executing a Binary......Page 53
Summary......Page 55
Chapter 2: The ELF Format......Page 57
The Executable Header......Page 59
The e_ident Array......Page 60
The e_type, e_machine, and e_version Fields......Page 61
The e_flags Field......Page 62
The e_shstrndx Field......Page 63
Section Headers......Page 64
The sh_type Field......Page 65
The sh_link Field......Page 66
Sections......Page 67
The .text Section......Page 69
The .bss, .data, and .rodata Sections......Page 70
Lazy Binding and the .plt, .got, and .got.plt Sections......Page 71
The .rel.* and .rela.* Sections......Page 74
The .dynamic Section......Page 76
The .init_array and .fini_array Sections......Page 77
Program Headers......Page 78
The p_offset, p_vaddr, p_paddr, p_filesz, and p_memsz Fields......Page 80
Summary......Page 81
Chapter 3: The PE Format: A Brief Introduction......Page 83
The PE Signature, File Header, and Optional Header......Page 84
The PE File Header......Page 87
The Section Header Table......Page 88
Sections......Page 89
Padding in PE Code Sections......Page 90
Summary......Page 91
Chapter 4: Building a Binary Loader Using libbfd......Page 93
A Simple Binary-Loading Interface......Page 94
The Symbol Class......Page 97
Implementing the Binary Loader......Page 98
Initializing libbfd and Opening a Binary......Page 99
Parsing Basic Binary Properties......Page 101
Loading Symbols......Page 104
Loading Sections......Page 107
Testing the Binary Loader......Page 109
Summary......Page 111
Part II: Binary Analysis Fundamentals......Page 113
Chapter 5: Basic Binary Analysis in Linux......Page 115
Resolving Identity Crises Using file......Page 116
Using ldd to Explore Dependencies......Page 119
Viewing File Contents with xxd......Page 120
Parsing the Extracted ELF with readelf......Page 122
Parsing Symbols with nm......Page 125
Looking for Hints with strings......Page 128
Tracing System Calls and Library Calls with strace and ltrace......Page 130
Examining Instruction-Level Behavior Using objdump......Page 135
Dumping a Dynamic String Buffer Using gdb......Page 137
Summary......Page 139
Chapter 6: Disassembly and Binary Analysis Fundamentals......Page 141
Static Disassembly......Page 142
Linear Disassembly......Page 143
Recursive Disassembly......Page 144
Example: Tracing a Binary Execution with gdb......Page 148
Code Coverage Strategies......Page 151
Structuring Code......Page 155
Structuring Data......Page 162
Decompilation......Page 164
Intermediate Representations......Page 165
Fundamental Analysis Methods......Page 167
Binary Analysis Properties......Page 168
Control-Flow Analysis......Page 172
Data-Flow Analysis......Page 174
Effects of Compiler Settings on Disassembly......Page 178
Summary......Page 179
Bare-Metal Binary Modification Using Hex Editing......Page 181
Observing an Off-by-One Bug in Action......Page 182
Fixing the Off-by-One Bug......Page 185
A Heap Overflow Vulnerability......Page 189
Detecting the Heap Overflow......Page 191
Injecting an ELF Section: A High-Level Overview......Page 195
Using elfinject to Inject an ELF Section......Page 197
Calling Injected Code......Page 201
Entry Point Modification......Page 202
Hijacking Constructors and Destructors......Page 205
Hijacking GOT Entries......Page 208
Hijacking PLT Entries......Page 211
Redirecting Direct and Indirect Calls......Page 212
Summary......Page 213
Part III: Advanced Binary Analysis......Page 215
Chapter 8: Customizing Disassembly......Page 217
A Case for Custom Disassembly: Obfuscated Code......Page 218
Other Reasons to Write a Custom Disassembler......Page 221
Installing Capstone......Page 222
Linear Disassembly with Capstone......Page 224
Exploring the Capstone C API......Page 229
Recursive Disassembly with Capstone......Page 230
Introduction to Return-Oriented Programming......Page 239
Finding ROP Gadgets......Page 241
Summary......Page 247
Chapter 9: Binary Instruction......Page 249
Binary Instrumentation APIs......Page 250
Static vs. Dynamic Binary Instrumentation......Page 251
Static Binary Instrumentation......Page 252
The int 3 Approach......Page 253
The Trampoline Approach......Page 254
Architecture of a DBI System......Page 259
Introduction to Pin......Page 261
The Profiler's Data Structures and Setup Code......Page 263
Parsing Function Symbols......Page 266
Instrumenting Basic Blocks......Page 267
Instrumenting Control Flow Instructions......Page 269
Counting Instructions, Control Transfers, and Syscalls......Page 272
Testing the Profiler......Page 273
Introduction to Executable Packers......Page 277
The Unpacker's Data Structures and Setup Code......Page 279
Instrumenting Memory Writes......Page 281
Tracking Memory Writes......Page 282
Detecting the Original Entry Point and Dumping the Unpacked Binary......Page 284
Testing the Unpacker......Page 285
Summary......Page 289
Chapter 10: Principles of Dynamic Taint Analysis......Page 291
Defining Taint Sources......Page 292
Tracking Taint Propagation......Page 293
A Brief Overview of the Heartbleed Vulnerability......Page 294
Detecting Heartbleed Through Tainting......Page 295
Taint Granularity......Page 297
Taint Colors......Page 298
Taint Propagation Policies......Page 299
Overtainting and Undertainting......Page 300
Control Dependencies......Page 301
Shadow Memory......Page 302
Summary......Page 304
Introducing libdft......Page 305
Internals of libdft......Page 306
Taint Policy......Page 308
Using DTA to Detect Remote Control-Hijacking......Page 309
Checking Taint Information......Page 312
Taint Sources: Tainting Recieved Bytes......Page 314
Taint Sinks: Checking execve Arguments......Page 316
Detecting a Control-Flow Hijacking Attempt......Page 317
Circumventing DTA with Implicit Flows......Page 322
A DTA-Based Data Exfiltration Detector......Page 323
Taint Sources: Tracking Taint for Open Files......Page 325
Taint Sinks: Monitoring Network Sends for Data Exfiltration......Page 329
Detecting a Data Exfiltration Attempt......Page 330
Summary......Page 333
An Overview of Symbolic Execution......Page 335
Symbolic vs. Concrete Execution......Page 336
Variants and Limitations of Symbolic Execution......Page 339
Increasing the Scalability of Symbolic Execution......Page 345
Constraint Solving with Z3......Page 347
Proving Reachability of an Instruction......Page 348
Proving Validity of a Formula......Page 351
Modeling Constraints for Machine Code with Bitvectors......Page 353
Solving an Opaque Predicate Over Bitvectors......Page 355
Summary......Page 356
Chapter 13: Practical Symbolic Execution with Triton......Page 359
Introduction to Triton......Page 360
Maintaining Symbolic State with Abstract Syntax Trees......Page 361
Backward Slicing with Triton......Page 363
The Symbolic Configuration File......Page 366
Emulating Instructions......Page 368
Setting Triton's Architecture......Page 369
Computing the Backward Slice......Page 370
Using Triton to Increase Code Coverage......Page 372
Finding a Model for a New Path......Page 374
Testing the Code Coverage Tool......Page 378
Automatically Exploiting a Vulnerability......Page 381
The Vulnerable Program......Page 382
Finding the Address of the Vulnerable Call Site......Page 385
Building the Exploit Generator......Page 387
Getting a Root Shell......Page 393
Summary......Page 396
Part IV: Appendixes......Page 397
Appendix A: A Crash Course on x86 Assembly......Page 399
Assembly Instructions, Directives, Labels, and Comments......Page 400
Separation Between Code and Data......Page 401
Machine-Level Structure of x86 Instructions......Page 402
Register Operands......Page 403
Memory Operands......Page 405
Common x86 Instructions......Page 406
Implementing Conditional Jumps......Page 408
The Stack......Page 409
Function Calls and Function Frames......Page 410
Conditional Branches......Page 414
Loops......Page 415
Appendix B: Implementing PT_NOTE Overwriting Using libelf......Page 417
Data Structures Used in elfinject......Page 418
Initializing libelf......Page 419
Getting the Executable Header......Page 423
Finding the PT_NOTE Segment......Page 424
Injecting the Code Bytes......Page 425
Aligning the Load Addess for the Injected Section......Page 426
Overwriting the .note.ABI-tag Section Header......Page 427
Setting the Name of the Injected Section......Page 432
Overwriting the PT_NOTE Program Header......Page 434
Modifying the Entry Point......Page 436
Appendix D: Further Reading......Page 439
Disassembly Frameworks......Page 441
Binary Analysis Frameworks......Page 442
Standards and References......Page 443
Papers and Articles......Page 444
Books......Page 446
Index......Page 447