Dynamic Binary Instrumentation For Deobfuscation and Unpacking

What is DBI
How it works
Demo: Javascript Deobfuscation
Demo: x86 unpacking (and stu)
Conclusion
Dynamic Binary Instrumentation for Deobfuscation

and Unpacking
Jean-Yves Marion, Daniel Reynaud
Nancy University - Loria
{jean-yves.marion|reynaudd}@loria.fr
http://lhs.loria.fr
http://indenitestudies.org
November 18, 2009
Dynamic Binary Instrumentation for Deobfuscation and Un
What is DBI
How it works
Conclusion
Tools and related work

What is DBI
Outline
1
What is DBI
What is DBI
How it works
Full control without emulation
How to achieve full control
Pros and cons
Building a Javascript DBI engine
Adding deobfuscation
Problems
What is DBI
How it works
Conclusion

What is DBI

The most famous (general purpose) DBI tools are currently:
Pin (by Intel, proprietary)
Valgrind (FOSS)
DynamoRIO (by VMware, FOSS)
Some reverse engineering projects are now using DBI:
for vulnerability research (Microsoft's SAGE, Sogeti's
Fuzzgrind)
for exploit development (Sean Heelan)
for unpacking (Piotr Bania, Danny Quist)
What is DBI
How it works
Conclusion

What is DBI
What is DBI
Denition
(informal) Dynamic Binary Instrumentation is
a program transformation
that gives you full control over the execution of a program
with no need for architectural support
Note that:
virtualization does not provide full control
emulation (== interpretation) is not a program transformation
debugging requires architectural support
dynamic binary translation matches this denition, so QEMU
can be seen as a whole-system DBI engine
What is DBI
How it works
Conclusion

What is DBI
Overview
Prog
Prog
Dbg
Emu
Int
Int
Debugging
Emulation
Prog
Int
Soft interpreter
or
virtualization
Prog
Int
DBI
What is DBI
How it works
Conclusion

Pros and cons
Outline
1
What is DBI
What is DBI
How it works
Pros and cons
Problems
What is DBI
How it works
Conclusion

Pros and cons
DBI achieves the same level of control as an emulator (==

interpreter), but
DBI relies on a pre-existing, unmodied interpreter
so there is no need to know / support the full semantics of the
architecture (for x86, this is a massive benet)
and no requirement for debugging support (could be
interesting for GPUs)
What is DBI
How it works
Conclusion

Pros and cons

Dene a static analysis f(code) that returns
instrumented_code:
1 parse code
2
3
4
(modify user-dened program points)

if new_code can potentially be executed, replace it with
f(new_code)
run f(code)
This can be seen as JIT compilation...

... or as virus-like program infection (hijack the entry point and
retain control)
What is DBI
How it works
Conclusion

Pros and cons
Pros and cons
Pros:
it is a program transformation
performance
Cons:
it is a program transformation
performance
...huh?
What is DBI
How it works
Conclusion

Problems
Outline
1
What is DBI
What is DBI
How it works
Pros and cons
Problems
What is DBI
How it works
Conclusion

Problems

instrument = function ( s c r i p t ) {
var r e s u l t = s c r i p t ;
result = result . replace (
/ e v a l \(/ g ,
" i n s t r u m e n t ("
);
// a d d i t i o n a l r e s u l t . r e p l a c e ( ) w i l l
// i n s t r u m e n t t h e i n i t i a l s c r i p t
}
return eval ( result );
What is DBI
How it works
Conclusion

Problems
Malicious scripts often use document.write() to add other scripts

and invisible iframes in hacked pages.
Let's instrument that:
result = result . replace (
/ document . w r i t e \(/ g ,
" l o g ("
);
(note to self: do the demo)
What is DBI
How it works
Conclusion

Problems
Adding more deobfuscation
Other interesting program points in malicious Javascript:

changes to location.href
calls to new Image()
calls to new ActiveXObject()
calls to setTimeout() and setInterval() (sometimes used
instead of eval())
(add your favorite tricks here)
(note to self: do the other demo)
What is DBI
How it works
Conclusion

Problems
Problems
To make this operational, we need to:

replace tokens, not regexps in strings
prevent other ways to execute dynamic code (new
Function(), top/window/self/parent.eval()...)
manage code introspection
make the instrumenter self-instrumentable
What is DBI
How it works
Conclusion
Outline
1
What is DBI
What is DBI
How it works
Pros and cons
Problems
What is DBI
How it works
Conclusion
x86 unpacking
What happens when you extract a run trace with DBI and import it
in a disassembler?
Packer
Packed
prog.
Dis.
Packer
...
Packer
Packed
prog.
DBI
Trace
...
Dis.
What is DBI
How it works
Conclusion
Malware analysis
Pin has not been made for malware analysis, but...

it can successfully instrument many packers (14/16 tested):
AcProtect, Aspack, Expressor, FSG, Mew, Molebox, Npack,
Packman, Pec2, Pelock, RLPack, UPX, Winupack, Yoda
Protector...
it works on approximately 80% of malware samples (tested on
100k samples)
Full results posted at http://indenitestudies.org
What is DBI
How it works
Conclusion
Conclusion
Instrumentation is a high-level, elegant approach to solve low-level

problems.
it is a mix of static and dynamic analysis
it will work on any language / architecture
it is algorithmically sound (unlike event-based approaches such
as debugging)
Outrageous claim: it is the fastest method for ne-grained
analysis
What is DBI
How it works
Conclusion
Conclusion Bis
I GPL'd the tools for the conference:

Crme Brle (Javascript DBI):
http://code.google.com/p/cremebrulee/
TarteTatinTools (TraceSurfer and other pintools):
http://code.google.com/p/tartetatintools/

Dynamic Binary Instrumentation For Deobfuscation and Unpacking

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Dynamic Binary Instrumentation For Deobfuscation and Unpacking

Uploaded by

Copyright:

Available Formats

What is DBI

Dynamic Binary Instrumentation for Deobfuscation

November 18, 2009

Jean-Yves Marion, Daniel Reynaud

Dynamic Binary Instrumentation for Deobfuscation and Un

Tools and related work

Dynamic Binary Instrumentation for Deobfuscation and Un

Tools and related work

Tools and related work

Jean-Yves Marion, Daniel Reynaud

Dynamic Binary Instrumentation for Deobfuscation and Un

Tools and related work

Dynamic Binary Instrumentation for Deobfuscation and Un

Tools and related work

Jean-Yves Marion, Daniel Reynaud

Dynamic Binary Instrumentation for Deobfuscation and Un

Full control without emulation

Dynamic Binary Instrumentation for Deobfuscation and Un

Full control without emulation

Full control without emulation

DBI achieves the same level of control as an emulator (==

Jean-Yves Marion, Daniel Reynaud

Dynamic Binary Instrumentation for Deobfuscation and Un

Full control without emulation

How to achieve full control

(modify user-dened program points)

This can be seen as JIT compilation...

Dynamic Binary Instrumentation for Deobfuscation and Un

Full control without emulation

Pros and cons

Jean-Yves Marion, Daniel Reynaud

Dynamic Binary Instrumentation for Deobfuscation and Un

Building a Javascript DBI engine

Dynamic Binary Instrumentation for Deobfuscation and Un

Building a Javascript DBI engine

Building a Javascript DBI engine

return eval ( result );

Jean-Yves Marion, Daniel Reynaud

Dynamic Binary Instrumentation for Deobfuscation and Un

Building a Javascript DBI engine

Malicious scripts often use document.write() to add other scripts

Jean-Yves Marion, Daniel Reynaud

Dynamic Binary Instrumentation for Deobfuscation and Un

Building a Javascript DBI engine

Adding more deobfuscation

Other interesting program points in malicious Javascript:

Jean-Yves Marion, Daniel Reynaud

Dynamic Binary Instrumentation for Deobfuscation and Un

Building a Javascript DBI engine

To make this operational, we need to:

Jean-Yves Marion, Daniel Reynaud

Dynamic Binary Instrumentation for Deobfuscation and Un

Dynamic Binary Instrumentation for Deobfuscation and Un

Jean-Yves Marion, Daniel Reynaud

Dynamic Binary Instrumentation for Deobfuscation and Un

Pin has not been made for malware analysis, but...

Jean-Yves Marion, Daniel Reynaud

Dynamic Binary Instrumentation for Deobfuscation and Un

Instrumentation is a high-level, elegant approach to solve low-level

Jean-Yves Marion, Daniel Reynaud

Dynamic Binary Instrumentation for Deobfuscation and Un

I GPL'd the tools for the conference:

Jean-Yves Marion, Daniel Reynaud

(modify user-dened program points)