RoP Hooks.
|
|
|
- Alisha Reynolds
- 5 years ago
- Views:
Transcription
1 RoP Hooks
2 Introduction K2 / ktwo@ktwo.ca
3 Intro/Outline Hooking/Tracing What is a binary doing? Can we modify/detour Frustrations/Hurdles Friendly inputs Symbol support
4 TOOLS / Open / Github / CODE Github.com/K2 invtero.net Evolution from CSW14 (process detection) Cross platform (Windows, *BSD, Linux) memory analysis Cross micro-architechture (sandy bridge, sky lake, ) Cross hypervisor (based on auto-magic VMCS / EPTP extraction) Includes nested support EhTrace (pronounced A Trace ) What were going to cover this J Let me know if I missed any code in the check-in!!
5 EhTrace Aboot time for a trace eh? Uses VEH under the covers Need to be a little careful Don t want to alter or change behavior of what were looking at
6 Hooking execution Detours Requires an instruction length decoder Rewrites function prolog into a specialized function which performs logging, analysis etc Usually static, can be dynamic/jitter, may jmp to a leaf like detour which can work without knowing the function prototype/ stack requirements Most of the time you will need symbols or really good logic in the hooker to not break execution
7 What s the problem again? Debuggers are slow Second process context switching is fairly expensive Logic for conditional breakpoints is exponentially more expensive Checksums Malicious binaries often checksum their code to validate they are not being analyzed Highly secure environments may checksum their binaries to make sure they are not tampered with
8 Ret2 code Original libc work, Solar designer Handy since most overflows contain a pointer to useful addresses Your input System libraries Still used to this day (RoP)
9 Stack Hooking Attempted to use as alternative to what we wound up using From a second manager thread Load from a RoP chain pool (memory area with RoP gagets) Borrow memory from the executing stack from above the stack top Usually some spare memory there Not very great Only post condition hooking Have to find a way to get notification on new calls Do some sort of shadow stack/memory protection trickery Tends to be fairly fragile RET RET
10 EhTrace how it works LONG WINAPI vehtracer(pexception_pointers ExceptionInfo) { // single step ExceptionInfo->ContextRecord->EFlags = 0x100; // setup branch tracing ExceptionInfo->ContextRecord->Dr7 = 0x300; Remarkably easy to trigger branch stepping of a binary In the VEH handler set 3 bits and return. THAT S IT TRAP FLAG OTHER FLAGS :D
11 EhTrace RoP Hooks Register a VEH handler CreateRemoteThread( &VeH_RoP,..); VeH_RoP use a RoP gadget finder (there are many) Handler only needs to set the 3 bits then exit with continue status Using the exception dispatcher were able to now get the preconditions we missed with the stack/shadow model Debugger functionality w/o a debugger i.e. passes all checks from May introduce a plugin to allow windbg to use our engine as a side loaded inproc debugger
12 What else is it good for? Branch stepping is pretty sweet! A lot more than detours on functions Basic block analysis Code coverages Can we put this into a DBI (Dynamic Binary Instrumentation) framework? Do we need to emulate? Isn t that slow? If were dealing with a malicious binary we have several things to consider. Of course we need to also watch out for an otherwise non-mal binary doing something that might disrupt our trace
13 Maintaining control Maybe use page protection to force an exception on execution (don t want to place an int3 obviously) When page is attempted to be executed we check to see what emulation is needed If somebody tries to take over VEH What about intra-block stuff? Can t they just write over our VEH handler in memory? Sure, maybe register 2! Also setup the VEH continue handler
14 Blockfighting with a hooker BlockFighter has to be smart, fast and in total control! Much like a StreetFighterII champ!
15 BlockFighting
16 BlockFighting Simplified analysis Using capstone we & the branch step At the point of any jmp/ret/call control transfer we can stop our fight until the next round Round 2 FIGHT! Actually were so good we always give second round! That means really that if there s a conditional we need to follow through a conditional Jne we follow the non-jump to ensure we complete the context until a ret/jmp/call
17 BlockFighting Watch the eflags & DR any manipulation will cause problems for us DEBUG_MSR? Lots of things probably Overall however we have a platform to build primitives on that can eventually do battle in a structured way Maybe combine blockfighter with stack injection to ensure we have additional postcondition checks on our flag/branch-step/veh state
18 Coverage Can you hear me now? Flame graph Current minimal state includes RIP, LAST_RIP, TID, FLAGS and ESP This is sufficient to build any code graph! Intra-procedural, call graph or full trace FLAMING BlockFighter!
19 CPU FLAME GRAPH CLICK HERE Orig from here -> (PowerPoint doesn t do SVG z) We have all the data required for generating these, however it s a TODO
20 Upcoming stuff MSAGL graphmaps fun/interactive mesh graph, sort of looks like an expandable spiderweb! SVG builder (without the.pl scripts from Brendan) Tighter Symbols (graphs and images not as fun without English eh?) Strace/ltrace/*trace for Windows (auto inject & log to console)
21 Upcoming stuff: Blockfighters A Flagfighter Rflags checks A PageFighter Page protection monitor E.g. protect the entrypoint CreateRemoteThread call s before it calls the specified &func argument to detect remote threads before the DLL thread notification run s Use tricks like this to ensure your not being tricked yourself Emu Fighter Emulate an operation that would otherwise detect us
22 Private implementations differ! Your fighters will be various i.e. if your not using any system/runtime API you don t need to worry about locking as much (obviously)
23 Notepad.exe Basic Blocks execution
24 With disassembly
25 Flame Graph no symbols yet
26 Questions? Feedback, bugs & Feature requests please Keep watching for updates
27 Thank you
Lecture Notes for 04/04/06: UNTRUSTED CODE Fatima Zarinni.
Lecture Notes for 04/04/06 UNTRUSTED CODE Fatima Zarinni. Last class we started to talk about the different System Solutions for Stack Overflow. We are going to continue the subject. Stages of Stack Overflow
Applications. Cloud. See voting example (DC Internet voting pilot) Select * from userinfo WHERE id = %%% (variable)
Software Security Requirements General Methodologies Hardware Firmware Software Protocols Procedure s Applications OS Cloud Attack Trees is one of the inside requirement 1. Attacks 2. Evaluation 3. Mitigation
Malware
reloaded Malware Research Team @ @xabiugarte Motivation Design principles / architecture Features Use cases Future work Dynamic Binary Instrumentation Techniques to trace the execution of a binary (or
Reverse Engineering Malware Dynamic Analysis of Binary Malware II
Reverse Engineering Malware Dynamic Analysis of Binary Malware II Jarkko Turkulainen F-Secure Corporation Protecting the irreplaceable f-secure.com Advanced dynamic analysis Debugger scripting Hooking
The code for all of this is relatively straightforward. The full listing using SEH is shown below: #include <Windows.h>
Some good references to read prior to this post. In short, to use hardware breakpoints there are eight debug registers (DR0 to DR7) that can be utilized. Eight, however, is a bit of an overstatement DR4
T Using debuggers to analyze malware. Antti Tikkanen, F-Secure Corporation
T-110.6220 Using debuggers to analyze malware Antti Tikkanen, F-Secure Corporation Agenda Debugger basics Introduction Scenarios and tools How do debuggers work? Debug API The debugging loop Underlying
CS 161 Computer Security
Paxson Spring 2017 CS 161 Computer Security Discussion 2 Question 1 Software Vulnerabilities (15 min) For the following code, assume an attacker can control the value of basket passed into eval basket.
PRESENTED BY: SANTOSH SANGUMANI & SHARAN NARANG
PRESENTED BY: SANTOSH SANGUMANI & SHARAN NARANG Table of contents Introduction Binary Disassembly Return Address Defense Prototype Implementation Experimental Results Conclusion Buffer Over2low Attacks
T Hands-on 2. User-mode debuggers OllyDbg
T-110.6220 Hands-on 2 User-mode debuggers OllyDbg Disassemblers vs debuggers Static analysis / Disassemblers Theoretic approach Give us a static view of the binary Example: IDA Dynamic analysis / Debuggers
Intro to Cracking and Unpacking. Nathan Rittenhouse
Intro to Cracking and Unpacking Nathan Rittenhouse nathan_@mit.edu Keygenning Take this crackme: http://crackmes.de/users/moofy/crackme_2 Write a key generator Process Watch where user data is inputted
Changing the Embedded World TM. Module 3: Getting Started Debugging
Changing the Embedded World TM Module 3: Getting Started Debugging Module Objectives: Section 1: Introduce Debugging Techniques Section 2: PSoC In-Circuit Emulator (ICE) Section 3: Hands on Debugging a
CS 161 Computer Security
Paxson Spring 2011 CS 161 Computer Security Discussion 1 January 26, 2011 Question 1 Buffer Overflow Mitigations Buffer overflow mitigations generally fall into two categories: (i) eliminating the cause
GDB Tutorial. A Walkthrough with Examples. CMSC Spring Last modified March 22, GDB Tutorial
A Walkthrough with Examples CMSC 212 - Spring 2009 Last modified March 22, 2009 What is gdb? GNU Debugger A debugger for several languages, including C and C++ It allows you to inspect what the program
[537] Virtual Machines. Tyler Harter
![[537] Virtual Machines. Tyler Harter](/thumbs/78/76966859.jpg "[537] Virtual Machines. Tyler Harter")
[537] Virtual Machines Tyler Harter Outline Machine Virtualization Overview CPU Virtualization (Trap-and-Emulate) CPU Virtualization (Modern x86) Memory Virtualization Performance Challenges Outline Machine
KERNEL THREAD IMPLEMENTATION DETAILS. CS124 Operating Systems Winter , Lecture 9
KERNEL THREAD IMPLEMENTATION DETAILS CS124 Operating Systems Winter 2015-2016, Lecture 9 2 Last Time: Kernel Threads OS kernel must provide a multitasking implementation Kernel threads are the minimal
OpenACC Course. Office Hour #2 Q&A
OpenACC Course Office Hour #2 Q&A Q1: How many threads does each GPU core have? A: GPU cores execute arithmetic instructions. Each core can execute one single precision floating point instruction per cycle
CS354 gdb Tutorial Written by Chris Feilbach
CS354 gdb Tutorial Written by Chris Feilbach Purpose This tutorial aims to show you the basics of using gdb to debug C programs. gdb is the GNU debugger, and is provided on systems that
Shellzer: a tool for the dynamic analysis of malicious shellcode
Shellzer: a tool for the dynamic analysis of malicious shellcode Yanick Fratantonio 1, Christopher Kruegel 2, and Giovanni Vigna 2 1 Politecnico di Milano, Italy yanick.fratantonio@mail.polimi.it 2 University
4. Jump to *RA 4. StackGuard 5. Execute code 5. Instruction Set Randomization 6. Make system call 6. System call Randomization
04/04/06 Lecture Notes Untrusted Beili Wang Stages of Static Overflow Solution 1. Find bug in 1. Static Analysis 2. Send overflowing input 2. CCured 3. Overwrite return address 3. Address Space Randomization
Program Exploitation Intro
Program Exploitation Intro x86 Assembly 04//2018 Security 1 Univeristà Ca Foscari, Venezia What is Program Exploitation "Making a program do something unexpected and not planned" The right bugs can be
What the CPU Sees Basic Flow Control Conditional Flow Control Structured Flow Control Functions and Scope. C Flow Control.
C Flow Control David Chisnall February 1, 2011 Outline What the CPU Sees Basic Flow Control Conditional Flow Control Structured Flow Control Functions and Scope Disclaimer! These slides contain a lot of
Malware Analysis and Antivirus Technologies: Using Debuggers to Analyze Malware
Malware Analysis and Antivirus Technologies: Using Debuggers to Analyze Malware Protecting the irreplaceable f-secure.com Agenda Debugger basics Introduction Scenarios and tools How debuggers work Debug
! Software ( kernel ) that runs at all times. ! OS performs two unrelated functions: Maria Hybinette, UGA. user! 1! Maria Hybinette, UGA. user! n!
Review: What is An Operating System?! Software ( ) that runs at all times CSCI 6730 / 4730 Operating Systems Structures & System Design» Really, the part of the that runs in (or need to).» But note - there
ECS 153 Discussion Section. April 6, 2015
ECS 153 Discussion Section April 6, 2015 1 What We ll Cover Goal: To discuss buffer overflows in detail Stack- based buffer overflows Smashing the stack : execution from the stack ARC (or return- to- libc)
MSRPC Heap Overflow Part II
MSRPC Heap Overflow Part II Dave Aitel So a new approach is needed. As with any heap overflow, you get to chose a where and a what value, subject to certain constraints. If you chose a what value that
Module: Return-oriented Programming. Professor Trent Jaeger. CSE543 - Introduction to Computer and Network Security
CSE543 - Introduction to Computer and Network Security Module: Return-oriented Programming Professor Trent Jaeger 1 1 Anatomy of Control-Flow Exploits Two steps in control-flow exploitation First -- attacker
Yielding, General Switching. November Winter Term 2008/2009 Gerd Liefländer Universität Karlsruhe (TH), System Architecture Group
System Architecture 6 Switching Yielding, General Switching November 10 2008 Winter Term 2008/2009 Gerd Liefländer 1 Agenda Review & Motivation Switching Mechanisms Cooperative PULT Scheduling + Switch
Customizing DAZ Studio
Customizing DAZ Studio This tutorial covers from the beginning customization options such as setting tabs to the more advanced options such as setting hot keys and altering the menu layout. Introduction:
Inline Reference Monitoring Techniques
Inline Reference Monitoring Techniques In the last lecture, we started talking about Inline Reference Monitors. The idea is that the policy enforcement code runs with the same address space as the code
1.1 For Fun and Profit. 1.2 Common Techniques. My Preferred Techniques
1 Bug Hunting Bug hunting is the process of finding bugs in software or hardware. In this book, however, the term bug hunting will be used specifically to describe the process of finding security-critical
unrop: Creating Correct Backtrace from Core Dumps with Stack Pivoting Yuchen Ying (Under the direction of Kang Li) Abstract
unrop: Creating Correct Backtrace from Core Dumps with Stack Pivoting by Yuchen Ying (Under the direction of Kang Li) Abstract Return-oriented Programming (ROP) has become the most common way to exploit
CMSC 414 Computer and Network Security
CMSC 414 Computer and Network Security Buffer Overflows Dr. Michael Marsh August 30, 2017 Trust and Trustworthiness You read: Reflections on Trusting Trust (Ken Thompson), 1984 Smashing the Stack for Fun
Spectre and Meltdown. Clifford Wolf q/talk
Spectre and Meltdown Clifford Wolf q/talk 2018-01-30 Spectre and Meltdown Spectre (CVE-2017-5753 and CVE-2017-5715) Is an architectural security bug that effects most modern processors with speculative
Precept 2: Non-preemptive Scheduler. COS 318: Fall 2018
Precept 2: Non-preemptive Scheduler COS 318: Fall 2018 Project 2 Schedule Precept: Monday 10/01, 7:30pm (You are here) Design Review: Monday 10/08, 3-7pm Due: Sunday 10/14, 11:55pm Project 2 Overview Goal:
How does breakpoints work in debuggers? Vineel Kumar Reddy Kovvuri
How does breakpoints work in debuggers? Vineel Kumar Reddy Kovvuri http://vineelkumarreddy.com Contents 1 Introduction 2 2 Breakpoints Theory 2 3 Breakpoints Practice 4 1 1 Introduction Its been a while,
It was a dark and stormy night. Seriously. There was a rain storm in Wisconsin, and the line noise dialing into the Unix machines was bad enough to
1 2 It was a dark and stormy night. Seriously. There was a rain storm in Wisconsin, and the line noise dialing into the Unix machines was bad enough to keep putting garbage characters into the command
Defeat Exploit Mitigation Heap Attacks. compass-security.com 1
Defeat Exploit Mitigation Heap Attacks compass-security.com 1 ASCII Armor Arbitrary Write Overflow Local Vars Exploit Mitigations Stack Canary ASLR PIE Heap Overflows Brute Force Partial RIP Overwrite
HYPERVISORS IN YOUR TOOLBOX SATOSHI TANDA & TIMO KREUZER,
HYPERVISORS IN YOUR TOOLBOX SATOSHI TANDA & TIMO KREUZER, SOFTWARE ENGINEERS, STRATEGIC RESEARCH INITIATIVES TAKEAWAYS Developing a simple hypervisor is easier than ever Even a simple hypervisor can open
NN. The last part! 1/9. How to build a bean for Servoy A step by step tutorial brought to you by Servoy Stuff PART 8
How to build a bean for Servoy A step by step tutorial brought to you by Servoy Stuff PART 8 NN. The last part! In the previous parts of this tutorial we build a Servoy Aware bean based on a Swing JSlider
SYSTEM CALL IMPLEMENTATION. CS124 Operating Systems Fall , Lecture 14
SYSTEM CALL IMPLEMENTATION CS124 Operating Systems Fall 2017-2018, Lecture 14 2 User Processes and System Calls Previously stated that user applications interact with the kernel via system calls Typically
In further discussion, the books make other kinds of distinction between high level languages:
Max and Programming This essay looks at Max from the point of view of someone with a bit of experience in traditional computer programming. There are several questions that come up from time to time on
Is Exploitation Over? Bypassing Memory Protections in Windows 7
Is Exploitation Over? Bypassing Memory Protections in Windows 7 Alexander Sotirov alex@sotirov.net About me Exploit development since 1999 Published research into reliable exploitation techniques: Heap
Last Time. Think carefully about whether you use a heap Look carefully for stack overflow Especially when you have multiple threads
Last Time Cost of nearly full resources RAM is limited Think carefully about whether you use a heap Look carefully for stack overflow Especially when you have multiple threads Embedded C Extensions for
Play with FILE Structure Yet Another Binary Exploitation Technique. Abstract
Play with FILE Structure Yet Another Binary Exploitation Technique An-Jie Yang (Angelboy) angelboy@chroot.org Abstract To fight against prevalent cyber threat, more mechanisms to protect operating systems
Shellbased Wargaming
Shellbased Wargaming Abstract Wargaming is a hands-on way to learn about computer security and common programming mistakes. This document is intended for readers new to the subject and who are interested
CSE 509: Computer Security
CSE 509: Computer Security Date: 2.16.2009 BUFFER OVERFLOWS: input data Server running a daemon Attacker Code The attacker sends data to the daemon process running at the server side and could thus trigger
Inside VMProtect. Introduction. Internal. Analysis. VM Logic. Inside VMProtect. Conclusion. Samuel Chevet. 16 January 2015.
16 January 2015 Agenda Describe what VMProtect is Introduce code virtualization in software protection Methods for circumvention VM logic Warning Some assumptions are made in this presentation Only few
Using kgdb and the kgdb Internals
Using kgdb and the kgdb Internals Jason Wessel jason.wessel@windriver.com Tom Rini trini@kernel.crashing.org Amit S. Kale amitkale@linsyssoft.com Using kgdb and the kgdb Internals by Jason Wessel by Tom
07 - Program Flow Control
September 23, 2014 Schedule change this week The lecture on thursday needs to move Lab computers The current computer lab (Bussen) is pretty nice since it has dual monitors However, the computers does
Multithreading and Interactive Programs
Multithreading and Interactive Programs CS160: User Interfaces John Canny. This time Multithreading for interactivity need and risks Some design patterns for multithreaded programs Debugging multithreaded
Multithreading and Interactive Programs
Multithreading and Interactive Programs CS160: User Interfaces John Canny. Last time Model-View-Controller Break up a component into Model of the data supporting the App View determining the look of the
Advanced Buffer Overflow
Pattern Recognition and Applications Lab Advanced Buffer Overflow Ing. Davide Maiorca, Ph.D. davide.maiorca@diee.unica.it Computer Security A.Y. 2016/2017 Department of Electrical and Electronic Engineering
Max and Programming Is Max a Programming Language?
There are several questions that come up from time to time on the Max discussion list. Is Max a real programming language? if so how do I do [loop, switch, bitmap, recursion] and other programming tricks
Analysis of MS Multiple Excel Vulnerabilities
Analysis of MS-07-036 Multiple Excel Vulnerabilities I. Introduction This research was conducted using the Office 2003 Excel Viewer application and the corresponding security patch for MS-07-036 - Vulnerabilities
.kkapture: Guided tour
Outline Introduction Basic principles The main idea Intercepting API calls kkapture piece by piece Video encoders Video APIs Audio Overview Learn what kkapture can do, how it does it...... and how to teach
24-vm.txt Mon Nov 21 22:13: Notes on Virtual Machines , Fall 2011 Carnegie Mellon University Randal E. Bryant.
24-vm.txt Mon Nov 21 22:13:36 2011 1 Notes on Virtual Machines 15-440, Fall 2011 Carnegie Mellon University Randal E. Bryant References: Tannenbaum, 3.2 Barham, et al., "Xen and the art of virtualization,"
Porting Linux to x86-64
Porting Linux to x86-64 Andi Kleen SuSE Labs ak@suse.de Abstract... Some implementation details with changes over the existing i386 port are discussed. 1 Introduction x86-64 is a new architecture developed
0-RING x64. Gustavo Scotti, Immunity, Inc.
0-RING x64 Gustavo Scotti, Immunity, Inc. Agenda: Differences for x86 vs. x64 The techniques PatchGuard Deactivating it 2-stages approach Lessons learnt Photo: Organize the prints with index numbers shown
July 14, EPITA Systems/Security Laboratory (LSE) Code sandboxing. Alpha Abdoulaye - Pierre Marsais. Introduction. Solutions.
EPITA Systems/Security Laboratory (LSE) July 14, 2017 1 / 34 2 / 34 What do we want? Limit usage of some resources such as system calls and shared object functions But not from the whole program (we trust
Function Calls COS 217. Reading: Chapter 4 of Programming From the Ground Up (available online from the course Web site)
Function Calls COS 217 Reading: Chapter 4 of Programming From the Ground Up (available online from the course Web site) 1 Goals of Today s Lecture Finishing introduction to assembly language o EFLAGS register
MASSACHUSETTS INSTITUTE OF TECHNOLOGY Computer Systems Engineering: Spring Quiz I Solutions
Department of Electrical Engineering and Computer Science MASSACHUSETTS INSTITUTE OF TECHNOLOGY 6.033 Computer Systems Engineering: Spring 2011 Quiz I Solutions There are 10 questions and 12 pages in this
Return-Oriented Rootkits
Return-Oriented Rootkits Ralf Hund Troopers March 10, 2010 What is Return-Oriented Programming? New emerging attack technique, pretty hyped topic Gained awareness in 2007 in Hovav Shacham s paper The Geometry
A Design for Comprehensive Kernel Instrumentation
Design for Comprehensive Kernel Instrumentation Peter Feiner ngela Demke Brown shvin Goel peter@cs.toronto.edu demke@cs.toronto.edu ashvin@eecg.toronto.edu University of Toronto 011 / 16 Motivation Transparent
hbps://github.com/k2 (Un) Fucking Forensics Ac#ve/Passive memory hacking/debugging K2 /
hbps://github.com/k2 (Un) Fucking Forensics Ac#ve/Passive memory hacking/debugging K2 / Director @IOACTIVE About me? Hacker for a while invtero.net Memory analysis framework for Windows Super fast/gbps
Practical Malware Analysis
Practical Malware Analysis Ch 4: A Crash Course in x86 Disassembly Revised 1-16-7 Basic Techniques Basic static analysis Looks at malware from the outside Basic dynamic analysis Only shows you how the
LLDB for your hardware: Remote Debugging the Hexagon DSP
LLDB for your hardware: Remote Debugging the Hexagon DSP Colin Riley Games Technology Director 1 Outline Introductions Adapting LLDB for your hardware The Why and How? The 3 steps Summary Q&A 2 Introductions
Dynamic Dispatch and Duck Typing. L25: Modern Compiler Design
Dynamic Dispatch and Duck Typing L25: Modern Compiler Design Late Binding Static dispatch (e.g. C function calls) are jumps to specific addresses Object-oriented languages decouple method name from method
ECE 391 Exam 1 Review Session - Spring Brought to you by HKN
ECE 391 Exam 1 Review Session - Spring 2018 Brought to you by HKN DISCLAIMER There is A LOT (like a LOT) of information that can be tested for on the exam, and by the nature of the course you never really
CSC369 Lecture 2. Larry Zhang
CSC369 Lecture 2 Larry Zhang 1 Announcements Lecture slides Midterm timing issue Assignment 1 will be out soon! Start early, and ask questions. We will have bonus for groups that finish early. 2 Assignment
Fundamental concept in computation Interrupt execution of a program to handle an event
Interrupts Fundamental concept in computation Interrupt execution of a program to handle an event Don t have to rely on program relinquishing control Can code program without worrying about others Issues
How to Sandbox IIS Automatically without 0 False Positive and Negative
How to Sandbox IIS Automatically without 0 False Positive and Negative Professor Tzi-cker Chiueh Computer Science Department Stony Brook University chiueh@cs.sunysb.edu 1/10/06 Blackhat Federal 2006 1
T Jarkko Turkulainen, F-Secure Corporation
T-110.6220 2010 Emulators and disassemblers Jarkko Turkulainen, F-Secure Corporation Agenda Disassemblers What is disassembly? What makes up an instruction? How disassemblers work Use of disassembly In
INFORMATION SECURITY - PRACTICAL ASSESSMENT - BASICS IN BUFFER EXPLOITATION
INFORMATION SECURITY - PRACTICAL ASSESSMENT - BASICS IN BUFFER EXPLOITATION GRENOBLE INP ENSIMAG http://www.ensimag.fr COMPUTER SCIENCE 3RD YEAR IF-MMIS - 1ST SEMESTER, 2011 Lecturers: Fabien Duchene -
Inject malicious code Call any library functions Modify the original code
Inject malicious code Call any library functions Modify the original code 2 Sadeghi, Davi TU Darmstadt 2012 Secure, Trusted, and Trustworthy Computing Chapter 6: Runtime Attacks 2 3 Sadeghi, Davi TU Darmstadt
Important From Last Time
Important From Last Time Embedded C Ø Pros and cons Macros and how to avoid them Intrinsics Interrupt syntax Inline assembly Today Advanced C What C programs mean How to create C programs that mean nothing
CS 550 Operating Systems Spring System Call
CS 550 Operating Systems Spring 2018 System Call 1 Recap: The need for protection When running user processes, the OS needs to protect itself and other system components For reliability: buggy programs
Debugging. ICS312 Machine-Level and Systems Programming. Henri Casanova
Debugging ICS312 Machine-Level and Systems Programming Henri Casanova (henric@hawaii.edu) Debugging Even when written in high-level languages, programs have bugs Recall the thought that when moving away
Introduction to Operating Systems Prof. Chester Rebeiro Department of Computer Science and Engineering Indian Institute of Technology, Madras
Introduction to Operating Systems Prof. Chester Rebeiro Department of Computer Science and Engineering Indian Institute of Technology, Madras Week 08 Lecture 38 Preventing Buffer Overflow Attacks Hello.
Security Workshop HTS. LSE Team. February 3rd, 2016 EPITA / 40
Security Workshop HTS LSE Team EPITA 2018 February 3rd, 2016 1 / 40 Introduction What is this talk about? Presentation of some basic memory corruption bugs Presentation of some simple protections Writing
Module: Return-oriented Programming. Professor Trent Jaeger. CSE543 - Introduction to Computer and Network Security
CSE543 - Introduction to Computer and Network Security Module: Return-oriented Programming Professor Trent Jaeger 1 Anatomy of Control-Flow Exploits 2 Anatomy of Control-Flow Exploits Two steps in control-flow
CS 111. Operating Systems Peter Reiher
Operating System Principles: Processes, Execution, and State Operating Systems Peter Reiher Page 1 Outline What are processes? How does an operating system handle processes? How do we manage the state
Fundamentals of Linux Platform Security
Fundamentals of Linux Platform Security Security Training Course Dr. Charles J. Antonelli The University of Michigan 2012 Linux Platform Security Module 8 Arbitrary Code Execution: Threats & Countermeasures
Interrupts and System Calls
Housekeeping Interrupts and System Calls Don Porter CSE 506 Welcome TA Amit Arya Office Hours posted Next Thursday s class has a reading assignment Lab 1 due Friday All students should have VMs at this
Interrupts and System Calls. Don Porter CSE 506
Interrupts and System Calls Don Porter CSE 506 Housekeeping ò Welcome TA Amit Arya Office Hours posted ò Next Thursday s class has a reading assignment ò Lab 1 due Friday ò All students should have VMs
W4118: interrupt and system call. Junfeng Yang
W4118: interrupt and system call Junfeng Yang Outline Motivation for protection Interrupt System call 2 Need for protection Kernel privileged, cannot trust user processes User processes may be malicious
Pokas x86 Emulator for Generic Unpacking
BLUE KAIZEN CENTER OF IT SECURITY Cairo Security Camp 2010 Pokas x86 Emulator for Generic Unpacking Subject : This document gives the user a problem, its solution concept, Previous Solutions, Pokas x86
Lecture 4: Memory Management & The Programming Interface
CS 422/522 Design & Implementation of Operating Systems Lecture 4: Memory Management & The Programming Interface Zhong Shao Dept. of Computer Science Yale University Acknowledgement: some slides are taken
Selected background on ARM registers, stack layout, and calling convention
Selected background on ARM registers, stack layout, and calling convention ARM Overview ARM stands for Advanced RISC Machine Main application area: Mobile phones, smartphones (Apple iphone, Google Android),
Stack overflow exploitation
Stack overflow exploitation In order to illustrate how the stack overflow exploitation goes I m going to use the following c code: #include #include #include static void
Control Flow Integrity
Control Flow Integrity Outline CFI Control Flow Integrity at Source Code Level BinCFI CFI for Binary Executables BinCC Binary Code Continent vfguard CFI Policy for Virtual Function Calls 1 M. Abadi, M.
CS 326: Operating Systems. Process Execution. Lecture 5
CS 326: Operating Systems Process Execution Lecture 5 Today s Schedule Process Creation Threads Limited Direct Execution Basic Scheduling 2/5/18 CS 326: Operating Systems 2 Today s Schedule Process Creation
Fall 2014:: CSE 506:: Section 2 (PhD) Threading. Nima Honarmand (Based on slides by Don Porter and Mike Ferdman)
Threading Nima Honarmand (Based on slides by Don Porter and Mike Ferdman) Threading Review Multiple threads of execution in one address space Why? Exploits multiple processors Separate execution stream
Dealer Reviews Best Practice Guide
Dealer Reviews Best Practice Guide What do I do if I get a negative review? Well, the first thing is, don t panic. Negative reviews aren t the end of the world, they actually help build trust and credibility
DEEP HOOKS MONITORING NATIVE EXECUTION IN WOW64 APPLICATIONS. Yarden Assaf
DEEP HOOKS MONITORING NATIVE EXECUTION IN WOW64 APPLICATIONS Assaf Carlsbad @assaf_carlsbad Yarden Shafir @yarden_shafir Yarden I started dancing at the age of 7 and later competed with a rhythmic gymnastics
Cold, Hard Cache KV? On the implementation and maintenance of caches. who is
1 of 5 TE X T ONLY Cold, Hard Cache On the implementation and maintenance of caches who is KV? click for video Dear KV, Our latest project at work requires a large number of slightly different software
CSCI 6730 / 4730 Operating Systems. Key Questions in System Design. Review: What is An Operating System? Key Points
CSCI 6730 / 4730 Operating Systems Structures & System Design Review: What is An Operating System? Key Points Software ( ) that runs at all times Really, the part of the system that runs in mode (or need
Making Dynamic Instrumentation Great Again
Making Dynamic Instrumentation Great Again Malware Research Team @ @xabiugarte [advertising space ] Deep Packer Inspector https://packerinspector.github.io https://packerinspector.com Many instrumentation
CSCE Operating Systems Interrupts, Exceptions, and Signals. Qiang Zeng, Ph.D. Fall 2018
CSCE 311 - Operating Systems Interrupts, Exceptions, and Signals Qiang Zeng, Ph.D. Fall 2018 Previous Class Process state transition Ready, blocked, running Call Stack Execution Context Process switch
Building Advanced Coverage-guided Fuzzer for Program Binaries
Building Advanced Coverage-guided Fuzzer for Program Binaries NGUYEN Anh Quynh WEI Lei 17/11/2017 Zero Nights, Moscow 2017 Self-introduction NGUYEN Anh Quynh, PhD
Exercise Session 6 Computer Architecture and Systems Programming
Systems Group Department of Computer Science ETH Zürich Exercise Session 6 Computer Architecture and Systems Programming Herbstsemester 2016 Agenda GDB Outlook on assignment 6 GDB The GNU Debugger 3 Debugging..