IJARCCE. International Journal of Advanced Research in Computer and Communication Engineering ISO 3297:2007 Certified Vol. 7, Issue 1, January 2018

Transcription

1 Internatinal Jurnal f Advanced Research in Cmputer and Cmmunicatin Engineering Vl. 7, Issue 1, January 2018 An Anatmy f Windws Executable File (EXE) and Linux Executable and Linkable Frmat File (ELF) Frmats fr Digital Frensic Analysis and Anti-Virus Design Purpses Mhammed A. Saleh Cmputer Science Department, Cllege f Sciences and Arts in Ar Rass, Qassim University, Kingdm f Saudi Arabia Abstract: The era f frensic analysis and anti-virus design requires a clear anatmy f Windws Executable File (EXE) and Linux Executable Linkable Frmat File (ELF) Frmats, especially fr beginners t these fields; thus, this research cmes ut. First, this research identifies data structures fr bth files frmats, namely EXE and ELF files frmats. After that, it classifies them accrding t headers, sectins, and resurces based n specific features and functinalities. Finally, this research prpses analysis guidelines fr EXE and ELF files frmats frensic analysis and anti-virus design purpses. Keywrds: Anatmy f EXE frmat file, anatmy f ELF frmat file, anti-virus design, digital frensic analysis. I. INTRODUCTION Windws Executable File (EXE) and Linux Executable and Linkable Frmat File (ELF) files frmats dminate executable files in cmputer era. Windws Executable File (EXE) in an executable file fr Windws perating system, while Linux Executable and Linkable Frmat File (ELF) is an executable file fr Unix-Like perating systems, such as Linux and BSD. Since Windws and Linux perating systems are the mst widely used perating systems n the glbe, EXE and ELF are cmmnly spread, t [1][2]. Hwever, digital frensic analyst and anti-virus designer seek t be familiar with EXE and ELF file frmats in rder t analyse them prperly, and adpt their slutins accrdingly. Digital frensic analyst needs t identify file frmat and architecture, and then investigate it. After that, in case the malicius executable file is detected, an anti-virus needs t update its database, s it be able t detect it later n. The fllwing sectins analyse and discuss an anatmy f Windws Executable File (EXE) and Linux Executable and Linkable Frmat File (ELF) frmats fr digital frensic analysis and anti-virus design purpses in granular details [2][3][4][5][6]. II. LITERATURE REVIEW In reality, Windws Executable File (EXE), and Linux Executable and Linkable Frmat File (ELF) structures have many identical features and functinalities, and n the ther hand, they have nt. Bth f EXE and ELF frmat s files are frmed and cnstructed thrughut data structures. In general, ELF frmat s file cmprises f three main successive structures, namely Elfxx_Ehdr structure, Elfxx_Phdr structure, and Elfxx_Shdr structure, where xx is 32 fr 32-bits structure, r 64 fr 64-bits structure. On the ther hand, EXE frmat s file encmpasses f five main cnsecutive structures, such as IMAGE_DOS_HEADER structure, IMAGE_NT_HEADERS structure, IMAGE_FILE_HEADER structure, IMAGE_OPTIONAL_HEADER structure, and IMAGE_SECTION_HEADER structure. In additin, IMAGE_OPTIONAL_HEADER structure cntains sub structure called DataDirectry used t include further sub structures like IMAGE_EXPORT_DIRECTORY structure, IMAGE_IMPORT_DESCRIPTOR structure, and IMAGE_RESOURCE_DATA_ENTRY structure. The fllwing Table 1 summarizes structures f EXE and ELF frmat s files [7][8][4][9][10][11][12][13][14]. Cpyright t IJARCCE DOI /IJARCCE

2 Internatinal Jurnal f Advanced Research in Cmputer and Cmmunicatin Engineering Vl. 7, Issue 1, January 2018 TABLE 1: A Summary f Windws Executable File (EXE) Data Structures, and Linux Executable and Linkable Frmat File (ELF) Data Structures ELF File Frmat Elf32_Ehdr e_ident (0x7f ELF) e_type (relc, exe, ) e_machine (Arch.) e_entry (virtaddr f.text) e_phff (ph table s ffset) e_shff (sh table s ffset) e_ehsize e_phentsize e_phnum e_shentsize e_shnum Elf32_Phdr p_type (LOAD, DYNAMIC, INTERP) p_ffset (beginning f file) p_vaddr p_paddr p_filesz p_memsz p_flags (X, W, R) p_align Elf32_Shdr sh_name (.data,.text,.bss) sh_type (PROGBITS, SYMTAB, NOBITS, REL) sh_flags (Data_w, Cde_X) sh_addr sh_size sh_ffset (beginning f file) sh_addralign sh_entsize EXE File Frmat IMAGE_DOS_HEADER e_magic (MZ) e_ss e_sp e_ip e_cs e_lfanew (PE file header Offset) MS-DOS 2.0 Stub Prgram IMAGE_NT_HEADERS Signature (PE00) FileHeader OptinalHeader IMAGE_FILE_HEADER Machine (Arch.) NumberOfSectins TimeDateStamp SizeOfOptinalHeader acteristics (exe, dll, system files,...) IMAGE_OPTIONAL_HEADER Magic (0x10b=PE32, 0x20b=PE32+) SizeOfCde (Size f executable cde) SizeOfInitializedData (Size f Initialized Data) SizeOfUninitializedData (Size f Uninitialized Data) AddressOfEntryPint (virtaddr f.text) BaseOfCde (Relative ffset f cde) BaseOfData (Relative ffset f Data) ImageBase SectinAlignment FileAlignment SizeOfImage SizeOfHeaders NumberOfRvaAndSizes DataDirectry[NumberOfRvaAndSizes] IMAGE_SECTION_HEADER VirtualAddress SizeOfRawData PinterTRawData acteristics (Cde, Initialized data, Uninitialized data, Resurce, +X, +W, +R, ) 7. DataDirectry[NumberOfRvaAndSizes] IMAGE_EXPORT_DIRECTORY Base NumberOfFunctins NumberOfs AddressOfFunctins AddressOfs AddressOfOrdinals IMAGE_IMPORT_DESCRIPTOR Cpyright t IJARCCE DOI /IJARCCE

3 Internatinal Jurnal f Advanced Research in Cmputer and Cmmunicatin Engineering Vl. 7, Issue 1, January 2018 OriginalFirstThunk TimeDateStamp FrwarderChain FirstThunk IMAGE_IMPORT_BY_NAME Hint [1] IMAGE_RESOURCE_DIRECTORY NumberOfdEntries NumberOfIdEntries IMAGE_RESOURCE_DIRECTORY_ENTR Y Id Data IMAGE_RESOURCE_DATA_ENTRY Data Size CdePage Reserved III. CLASSIFYING WINDOWS EXECUTABLE FILE (EXE) AND LINUX EXECUTABLE AND LINKABLE FORMAT FILE (ELF) DATA STRUCTURES The fllwing Table 2 presents a classificatin f identical headers fr Windws Executable File (EXE) and Linux Executable and Linkable Frmat File (ELF) data structures based n a feature/functinality. It shws a Feature/Functinality in the first clumn, ELF Frmat File in the secnd clumn, and EXE Frmat File in the third clumn. These data structures are used t identify file frmat, type, and architecture. In additin, they are used t calculate ffsets t sectins, determine prgram entry pint, and set sectins permissins [4][7][8][4][9][10][11][12][13][14]. TABLE 2: A Classificatin f Identical headers fr Windws Executable File (EXE) and Linux Executable and Linkable Frmat File (ELF) Data Structures based n a Feature/Functinality Feature/Functinality ELF Frmat File EXE Frmat File Magic Value Elf32_Ehdr e_ident (0x7f ELF) Next Structs Offset Elf32_Ehdr e_phff e_shff Machine Architecture Elf32_Ehdr e_machine File Type Elf32_Ehdr Cpyright t IJARCCE DOI /IJARCCE IMAGE_DOS_HEADER e_magic (MZ) IMAGE_DOS_HEADER e_lfanew (Offset t PE) IMAGE_NT_HEADERS Signature (PE00) FileHeader OptinalHeader IMAGE_FILE_HEADER Machine IMAGE_FILE_HEADER acteristics (exe, dll, system files,...)

4 Internatinal Jurnal f Advanced Research in Cmputer and Cmmunicatin Engineering Vl. 7, Issue 1, January 2018 ) e_type (relc, exe, Prgram Entry Pint Elf32_Ehdr e_entry (.text) Prgram Sectins Number Elf32_Ehdr e_shnum Permissins Elf32_Phdr p_flags (X, W, R) Elf32_Shdr sh_flags (Data_w, Cde_X) IMAGE_OPTIONAL_HEADER AddressOfEntryPint (.text) IMAGE_FILE_HEADER NumberOfSectins IMAGE_SECTION_HEADER acteristics (Cde, Initialized data, Uninitialized data, Resurce, +X, +W, +R, ) As well, Table 3 belw presents a classificatin f identical sectins fr Windws Executable File (EXE) and Linux Executable and Linkable Frmat File (ELF) data structures based n a feature/functinality. The purpses f these data structures are used t lcate and lad text sectin, namely.text sectin, and execute it accrdingly, which represents executable instructins. Besides that, they lcate and lad an initialized and uninitialized sectins, such as.data,.rdata,.pdata, and.bss sectins that are used fr string glbal and lcal variables, strings names, and cnstants. In additin, they lcate and lad a resurce sectin, namely.rsrc that is used nly fr Windws Executable File (EXE). Table 4 belw prvides granular details f.rsrc sectin [4][7][8][4][9][10][11][12][13][14]. TABLE 3: A Classificatin f Identical Sectins fr Windws Executable File (EXE) and Linux Executable and Linkable Frmat File (ELF) Data Structures based n a Feature/Functinality Feature/Functinality ELF Frmat File EXE Frmat File Text Sectin (.text) Initialized Data Sectin (.data,.rdata,.pdata, idata, edata) Elf32_Shdr sh_name (.text) sh_type (PROGBITS, REL) sh_flags (Cde_X) sh_addr sh_size sh_ffset (beginning f file) Elf32_Shdr sh_name (.data) sh_type (PROGBITS) sh_flags (Data_w) sh_addr sh_size sh_ffset (beginning f file) IMAGE_OPTIONAL_HEADER SizeOfCde (Size f executable cde) BaseOfCde (Relative ffset f cde) IMAGE_SECTION_HEADER VirtualAddress SizeOfRawData PinterTRawData acteristics (Cde, +X, +W, +R, ) IMAGE_OPTIONAL_HEADER SizeOfInitializedData (Size f Initialized Data) BaseOfData (Relative ffset f Data) IMAGE_SECTION_HEADER VirtualAddress SizeOfRawData PinterTRawData Cpyright t IJARCCE DOI /IJARCCE

5 Internatinal Jurnal f Advanced Research in Cmputer and Cmmunicatin Engineering Vl. 7, Issue 1, January 2018 Uninitialized Data Sectin (.bss) Resurce Sectin (.rsrc) Elf32_Shdr sh_name (.bss) sh_type (PROGBITS) sh_flags (Data_w) sh_addr sh_size sh_ffset (beginning f file) acteristics (Initialized data, +X, +W, +R, ) IMAGE_OPTIONAL_HEADER SizeOfUninitializedData (Size f Uninitialized Data) IMAGE_SECTION_HEADER VirtualAddress SizeOfRawData PinterTRawData acteristics (Uninitialized data, Resurce, +X, +W, +R, ) N/A IMAGE_OPTIONAL_HEADER NumberOfRvaAndSize DataDirectry[NumberOfRvaAndSizes] Sectin Packer, Encryptr, and Prtectr Manipulate sectins, and change prgram entry pint. IMAGE_SECTION_HEADER VirtualAddress SizeOfRawData PinterTRawData acteristics (Resurce, +X, +W, +R, ) Manipulate sectins, and change prgram entry pint. Finally, Table 4 belw details a classificatin f a resurce sectin fr Windws Executable File (EXE) and Linux Executable and Linkable Frmat File (ELF) data structures based n a feature/functinality. The data structures identify a resurce type whether is imprted functins, exprted functins, r merely a resurce like buttns, menus, etc. After that, these sectins are laded accrdingly [4][7][8][4][9][10][11][12][13][14]. TABLE 4: A Classificatin f Resurce Sectin fr Windws Executable File (EXE) and Linux Executable and Linkable Frmat File (ELF) Data Structure based n a Feature/Functinality Feature/Functinality ELF Frmat File EXE Frmat File Resurce Sectin (.rsrc) N/A IMAGE_OPTIONAL_HEADER DataDirectry[NumberOfRvaAndSizes] IMAGE_EXPORT_DIRECTORY Base NumberOfFunctins NumberOfs AddressOfFunctins AddressOfs AddressOfOrdinals Cpyright t IJARCCE DOI /IJARCCE

6 Internatinal Jurnal f Advanced Research in Cmputer and Cmmunicatin Engineering Vl. 7, Issue 1, January 2018 IMAGE_IMPORT_DESCRIPTOR OriginalFirstThunk TimeDateStamp FrwarderChain FirstThunk IMAGE_IMPORT_BY_NAME Hint [1] IMAGE_RESOURCE_DIRECTORY NumberOfdEntries NumberOfIdEntries IMAGE_RESOURCE_DIRECTORY_EN TRY Id Data IMAGE_RESOURCE_DATA_ENTRY Data Size CdePage Reserved IV. MALWARE ANALYSIS GUIDELINES FOR WINDOWS EXECUTABLE FILE (EXE) AND LINUX EXECUTABLE AND LINKABLE FORMAT FILE (ELF) FORMATS FORENSIC ANALYSIS AND ANTI-VIRUS DESIGN PURPOSES 1. Firstly, inspect headers values f EXE and ELF frmats file, as explained in Table 2 abve, in rder t determine the right structures values. Hwever, sme malware authrs bfuscate the written malware by appending r padding varius bytes in begin, specific lcatins, r end f malware sample in rder t prevent malware analysis and make it harder t the experts. Hence, a further deeper inspectin is required t carve the crrect structure values frm malware sample. 2. After that, inspect existence f sectins header values as depicted in Table 3 abve. Here there are tw dissimilar ptins: i. The sectins names are identical t names shwn in Table 3 abve, then fllw step 3 belw. ii. The sectins names are different frm names shwn Table 3 abve, and then fllw step 4 belw. 3. Investigate and analyze.text sectin, which has the executable instructins, using static and dynamic analysis. Additinally, analyze.data,.rdata,.pdata, idata, edata, and ther data sectins, which hld variables names and values, strings names and values, cnstants names and values, imprted functins, and exprted functins. Indeed, this step leads t explain malwares harms and negative impacts. 4. In this case, the default sectins names f a malware sample are changed by malware authrs themselves t bfuscate the analysis and make it harder fr the experts. They accmplish this missin by using a Packer, an Encryptr, r a Prtectr t change the riginal value f Prgram Entry Pint t a new ne. During prgram executin, it returns the riginal sectins names and executes them accrdingly. Therefre, the malware sample needs t be decrypted r unpacked first, and then fllw step iii abve. 5. Afterwards, inspect and investigate any extra sectins names ther than whse mentined abve, which created and adpted by sme malware authrs, by fllwing step iii abve. 6. Then, inspect and investigate.rsrc sectin f exe frmat file, which hld an imprtant data t malware sample. Usually, malware authrs hide harmful instructins inside this sectin. Cpyright t IJARCCE DOI /IJARCCE

7 Internatinal Jurnal f Advanced Research in Cmputer and Cmmunicatin Engineering Vl. 7, Issue 1, January Finally, a frensic analyst writes dwn a detailed frensic analysis based n a malware sample investigatin, especially headers data structures, executable instructins and data sectins, and packing and encrypting f sectins data structures. As well, an anti-virus designer cmputes digest hash values, such as sha256 hash functin, fr a malware sample and it s all sectins t update its anti-virus database, hence an anti-virus detects a malware sample later n. V. CONCLUSION Digital frensic analysis and an anti-virus design are imprtant services and tls in cmputer era, which need a deep understanding f the mst cmmn executable files, namely Windws Executable File (EXE) and Linux Executable Linkable Frmat File (ELF) files frmats. Thus, this research studied, analysed, and discussed an anatmy f Windws Executable File (EXE) and Linux Executable and Linkable Frmat File (ELF) frmats fr digital frensic analysis and anti-virus design purpses. As well, it prpsed analysis guidelines fr EXE and ELF files frmats frensic analysis and anti-virus design purpses. The prpsed guidelines demnstrate sequential steps t be fllwed by digital frensic analyst and an anti-virus designer in rder t analyse and classify any executable files whether is a malicius r benign file. Overall, these guidelines invlve identify data structures fr bth files frmats, and then classify them accrding t headers, sectins, and resurces based n specific features and functinalities. Finally, a frensic analyst writes dwn a detailed frensic analysis, and an anti-virus designer cmputes digest hash values and update its anti-virus database, therefre it detects a malware sample later n. In future wrk, we plan t deign detectable methds based n different appraches fr detecting malicius EXE and ELF executable files. REFERENCES [1] L. Wu, Autmatic Detectin Mdel f Malware Signature fr Anti-virus Clud Cmputing, 10th IEEE/ACIS Int. Cnf. Cmput. Inf. Sci. Autm., pp. 1 3, [2] N. Miramirkhani, M. P. Appini, N. Nikifrakis, and M. Plychrnakis, Sptless Sandbxes : Evading Malware Analysis Systems using Wearand-Tear Artifacts, IEEE Symp. Secur. Priv. Sptless, pp , [3] C. A. Martínez and G. I. Echeverri, Malware Detectin based n Clud Cmputing integrating Intrusin Ontlgy representatin. [4] M. U. AbdelHameed, M. A. Sbh, and A. M. B. Eldin, Prtable executable autmatic prtectin using dynamic infectin and cde redirectin, in 2009 Internatinal Cnference n Cmputer Engineering Systems, 2009, pp [5] A. Jadhav, D. Vidyarthi, and H. M., Evlutin f Evasive Malwares : A Survey, Int. Cnf. Cmput. Tech. Inf. Cmmun. Technl. Evl., [6] A. Agrawal and K. Wahie, Analyzing and Optimizing clud-based antivirus paradigm, Int. Cnf. Cmput. Tech. Inf. Cmmun. Technl. Evl., n. Iciccs, pp , [7] D. Ai, G. Zeng, Y. Yue, and B. Shen, Research f SftMan Migratin Based n Linux Checkpint, in 2009 Fifth Internatinal Cnference n Natural Cmputatin, 2009, vl. 3, pp [8] S. Trri, W. Britt, and J. A. Hamiltn, A cmpiler classificatin framewrk fr use in reverse engineering, in 2009 IEEE Sympsium n Cmputatinal Intelligence in Cyber Security, 2009, pp [9] L. Lu, L. Qiuju, and X. Tingrng, Research and Implementatin f Cmpressin Shell Unpacking Technlgy fr PE File, in 2009 Internatinal Frum n Infrmatin Technlgy and Applicatins, 2009, vl. 1, pp [10] E. H. Hwang, S. J. Ch, K. J. Kim, Y. J. Kim, S. H. Yn, and J. W. Jen, A recvery algrithm fr PE files in a multi-cre system, in th Internatinal Cnference n Cntrl, Autmatin and Systems, 2012, pp [11] R. Msli, R. Li, B. Yuan, and Y. Pan, Autmated malware detectin using artifacts in frensic memry images, in 2016 IEEE Sympsium n Technlgies fr Hmeland Security (HST), 2016, pp [12] A. K. Marnerides, M. R. Watsn, N. Shirazi, A. Mauthe, and D. Hutchisn, Malware Analysis in Clud Cmputing : Netwrk and System Characteristics, Glbecm 2013 Wrk. - Clud Cmput. Syst. Netwrks, Appl. Malware, pp , [13] Linux Prgrammer s Manual, elf - frmat f Executable and Linking Frmat (ELF) files. [Online]. Available: [Accessed: 20-Jan-2018]. [14] Micrsft MSDN, PE Frmat. [Online]. Available: [Accessed: 20-Jan-2018]. Cpyright t IJARCCE DOI /IJARCCE