DmitriyEvdokimov. Light and Dark Side of Code Instrumentation

Light and Dark side of Code Instrumentation
Dmitriy D1g1 Evdokimov DSecRG, Security Researcher
#whoami
Security Researcher in DSecRG
RE Fuzzing Mobile security
Organizer: DCG #7812 Editor in XAKEP
www.dsecrg.com
CONFidence Krakow 2012
Agenda
1. 2. 3. 4. 5. 6. 7. Instrumentation . Instrumentation .. Instrumentation Instrumentation . Instrumentation .. Instrumentation Instrumentation .
CONFidence Krakow 2012 3
www.dsecrg.com
Intro
It has been proved by scientists that a new point of evolution, any technical progress appears when a Man makes up a new type of tool, but not a product.
www.dsecrg.com
Instrumentation
Instrumentation is a technique adding extra code to an program/environment for monitoring/change some program behavior.
Environment Program Own extra code Program
Own extra code
www.dsecrg.com
Why is it necessary?
Parallel optimization Simulation Virtualization Emulation Performance analysis Automated debugging Error detection Binary translation Optimization Memory leak detection Software profiling Testing Correctness checking Collecting code metrics Memory debugging
www.dsecrg.com
Instrumentation in information security

Control flow analysis Unpack Virtual patching Privacy monitoring Sandboxing Data flow analysis Deobfuscation Reverse engineering Behavior based security Transparent debugging Data Structure Restoring Security enforcement Forensic Security test case generation Code coverage Vulnerability detection Antivirus technology
Malware analysis
Taint analysis Program shepherding
Shellcode detection
Fuzzing
www.dsecrg.com
Analysis
Criterion Code vs. data Code coverage Information about values Self-modifying code Interaction with the environment Unused code JIT code Static analysis Problem Big (but not all) No information Problem No Analysis Problem Dynamic analysis No problem One way All information No problem Yes No analysis No problem
www.dsecrg.com
Code Discovery
Memory After static analysis 0101010110101001010010 Instr 1 0101010101101010101010 Instr 2 Instr 3 1111010101110101000111 jump reg InstrDATA 4 Instr 1011100111001010101011 5 Instr 4 6 Instr Instr 7 5 jmp 0x0ABCD PADDING 0111010110100111100110 Instr 7 cont. Instr 8 1010101101110001001011 Instr 9 Instr 6 10 Instr After dynamic analysis
www.dsecrg.com
The general scheme of code instrumentation

1. 2. 3. 4. 5. 6. 7. Find points of instrumentation; Insert instrumentation; Take control from program; Save context of the program; Execute own code; Restore context of the program; Return control to program.
www.dsecrg.com
Source Data
Source data
Source code
Byte code
Binary code
www.dsecrg.com
11
Classification of target instrumentation

Instrumentation With source code Source code Linker/Compiler Byte code Byte code Interpreter/VM Without source code Binary code Executable file Process Environment Hardware
12
Environment Dynamic binary instrumentation Static binary modification Byte code instrumentation Link-time/Compilation-time Source code instrumentation - Static instrumentation - Load-time - Dynamic www.dsecrg.com CONFidence Krakow 2012
Source code instrumentation

Source code*
Source code instrumentation
Manual skills Plugins for IDE
Link-time/Compilation-time instrumentation
Options of linker/compiler
Tools: Visual Studio Profiler, gcc, TAU, OPARI, Diablo, Phoenix, LLVM, Rational Purify, Valgrind
*Unreal condition for security specialist =)
www.dsecrg.com CONFidence Krakow 2012 13
Unmoral programming
www.dsecrg.com
14
Byte code instrumentation

Byte code intermediate representation between source code and machine code.
Java VM Dalvik VM AVM/AVM2 CLR
www.dsecrg.com
15
Instrumentation byte-code (I)

Source code Compilation Byte-code Load Loader Lib
Virtual machine
JIT Execute
Lib
Lib
Machine code
Instrumentation byte code (II)

Byte-code
Static instrumentation
Static byte code instrumentation
Load-time instrumentation
Custom byte code loader
Dynamic instrumentation
Dynamic byte-code instrumentation
www.dsecrg.com
17
Instrumentation Java (I)

Mechanisms:
java.lang.instrument package; Java Platform Debugger Architecture (JPDA) .
www.dsecrg.com
18
Instrumentation Java (II)

ClassFileLoadHook Custom ClassLoader
Load-time instrumentation Dynamic instrumentation
Modification *.class files
ClassFileLoadHook -> RetransformClasses
Tools: Javassist, ObjectWeb ASM, BCEL, JOIE, reJ JavaSnoop, Serp, JMangler
Instrumentation .NET
Modification DLL files
Load-time instrumentation
AppDomain.Load()/Assembly.Load() Joint redirection Via event handler
Tools: ReFrameworker, MBEL, RAIL, Cecil

Instrumentation ActionScript (I)

ActionScript2
AVM Tags that (can) contain bytecode:
DefineButton (7), DefineButton2 (34), DefineSprite (39), DoAction (12), DoInitAction (59), PlaceObject2 (26), PlaceObject3 (70).
ActionScript3
AVM2 Tags that (can) contain bytecode:
DoABC (82), RawABC (72).
AVM2 Architecture
AS3 .abc function (x:int):int { return x+10 } .abc parser .abc getlocal 1 Verifier Bytecode pushint 10 add returnvalue Interpreter MIR JIT Compiler @1 arg +8// argv MIR Code Generator @2 load [@1+4] @3 imm 10 @4 add (@2,@3) MD Code Generator @5 ret @4 // @4:eax (x86, PPC, ARM, etc.)
x86 Runtime System (Type System, Object Model) mov eax,(eap+8) mov eax,(eax+4) add eax,10 Memory Manager/Garbage Collector ret
Instrumentation ActionScript (I)

Original SWF file AVM tag
Header
Tags
Instrumenteted SWF file
www.dsecrg.com
23
Instrumentation AVM (II)

Add :
trace() dump() debug() debugfile() debugline()
Modification:
Create own class + change class name = hook!
Instrumentation binary code

The executable file Process
Static code instrumentation Debuggers
IAT
Environment
Static binary instrumentation
Modifying call table
Modifying call table/other structure Dynamic code instrumentation
Debugging API
Modifying OS options
SHIM LD_PRELOAD AppInt_DLLs DLL injection
IDT, CPU MSRs, GDT, SSDT, IRP able
Hardware
Dynamic binary instrumentation
Hardware debug features

Debug registers Hardware debuggers
Reproduction of the environment

Emulation Virtualization
www.dsecrg.com
25
Static Binary Instrumentation (I)

Static binary instrumentation/Physical code integration/Static binary code rewriting Realization:
With reallocation:
Level of segment; Level of function;
Header Segment of code Segment of data Edited Header Segment of code Segment of data Extra segment of code Extra segment of data
26
Without reallocation.
www.dsecrg.com CONFidence Krakow 2012
Static Binary Instrumentation (II)

Reallocation: 1) Function Displacement + Entry Point Linking; 2) Branch Conversion; 3) Instruction Padding; 4) Instrumentation.
Tools: DynInst, EEL, ATOM, PEBIL, ERESI, TAU, Vulcan, BIRD, Aslan(4514N)
Debuggers
Breakpoints:
Software Hardware
App OS Processor Debugger
Debugger + scripting:

WinDBG + pykd OllyDBG + python = Immunity Debuggers GDB + PythonGDB
Python library's*: Buggery, IDAPython, ImmLIB, lldb, PyDBG, PyDbgEng, pygdb , python-ptrace , vtrace, WinAppDbg,
*See Python Arsenal for Reverse Engineering

Dynamic Binary Instrumentation

Dynamic binary instrumentation/Virtual code integration/Dynamic binary rewriting
App1 DBI App2 OS Processor
Tools: PIN, DynamoRIO, DynInst, Valgrind, BAP, KEDR, Fit, ERESI, Detour, Vulcan, SpiderPig
Dynamic Binary Instrumentation

Dynamic Binary Instrumentation (DBI) is a process control and analysis technique that involves injecting instrumentation code into a running process. Dynamic binary analysis (DBA) tools such as profilers and checkers help programmers create better software. Dynamic binary instrumentation (DBI) frameworks make it easy to build new DBA tools. DBA tools consist:
instrumentation routines; analysis routines.
www.dsecrg.com
30
Kinds of DBI
Mode:
user-mode; kernel-mode.
Mode of work:
- Start to finish; - Attach.
Functionality
Modes of execution:
Interpretation-mode; Probe-mode; JIT-mode.
www.dsecrg.com CONFidence Krakow 2012
JIT
Probe Performance
31
DBI Frameworks*
Frameworks PIN OS Linux, Windows, MacOS Linux, Windows Linux, FreeBSD, Windows Linux, MacOS Arch x86, x86-64, Itanium, ARM x86, x86-64 x86, x86-64, ppc32, ARM, ppc64 x86, x86-64, ppc32, ARM, ppc64 Modes JIT, Probe Features Attach mode
DynamoRIO DynInst
JIT, Probe Probe
Runtime optimization Static & Dynamic binary instrumentation IR VEX, Heavyweight DBA tools
Valgrind
JIT
*For more details see DBI:Intro presentation from ZeroNights conference

Start work with DBI
www.dsecrg.com
33
Levels of granularity
Instruction; Basic Block*; Trace/Superblock; Function; Section; Events; Binary image.
www.dsecrg.com
Self-modifying code & DBI

Detect:
Written-protecting code pages Checking store address Inserting extra code
www.dsecrg.com
35
Overhead
O=X+Y Y = N*Z Z = K+L O Tool Overhead; X Instrumentation Routines Overhead; Y Analysis Routines Overhead; N Frequency of Calling Analysis Routine; Z Work Performed in the Analysis Routine; K Work Required to Transition to Analysis Routine; L Work Performed Inside the Analysis Routine.
Rewriting instructions
Platforms:
with fixed-length instruction; with variable-length instructions.
www.dsecrg.com
37
Rewriting code (I)

Easy / simple / boring / regular example
Rewriting prolog function
www.dsecrg.com
38
Rewriting code (II)

Hardcore example:
Mobile phone firmware rewriting
Bootloader reboot Flash
SHELLCODE 1
AMSS GSM
Malicious SMS
Baseband processor
Instrumentation in ARM
ARM modes:
ARM
Length(instr) = 4 byte
Thumb
Length(instr) = 2 byte
Thumb2
Length(instr) = 2/4 byte
Jazzle
For more detail see A Dynamic Binary Instrumentation Engine for the ARM Architecture presentation.
Emulation
App1 Emulator OS Processor
OS
www.dsecrg.com
41
Instrumentation & Bochs

Bochs can be called with instrumentation support. C++ callbacks occur when certain events happen:
Poweron/Reset/Shutdown; Branch Taken/Not Taken/Unconditional; Opcode Decode (All relevant fields, lengths); Interrupt /Exception; Cache /TLB Flush/Prefetch; Memory Read/Write.
bochs-python-instrumentation patch by Ero Carrera

Virtualization
App1 App1 VMM Processor Native VMM OS VMM OS Processor Hosted VMM OS
*VMM - Virtual Machine Monitor

Instrumentation & virtualization

Stages: 1. Save the VM-exit reason information in the VMCS; 2. Save guest context information; 3. Load the host-state area; 4. Transfer control to the hypervisor; 5. Run own code.
*VMCS - Virtual Machine Control Structure
www.dsecrg.com
44
Instrumentation in Mobile World
Mobile Platform Android iOS Windows Phone
Language Java Objective-C .NET
Executable file format Dex Mach-O PE
www.dsecrg.com
45
Conclusion
One can implement instrumentation of everything!
www.dsecrg.com
46
Contact
Twitter: @evdokimovds E-mail: d.evdokimov@dsecrg.com
www.dsecrg.com
47
Windows 8
Apps:
C++ & DirectX C# & XAML HTML & JavaScript & CSS
www.dsecrg.com
48

DmitriyEvdokimov. Light and Dark Side of Code Instrumentation

Uploaded by

Document Information

Original Description:

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

DmitriyEvdokimov. Light and Dark Side of Code Instrumentation

Uploaded by

Copyright:

Available Formats

Light and Dark side of Code Instrumentation

Dmitriy D1g1 Evdokimov DSecRG, Security Researcher

Organizer: DCG #7812 Editor in XAKEP

CONFidence Krakow 2012

CONFidence Krakow 2012

Own extra code

CONFidence Krakow 2012

CONFidence Krakow 2012

Instrumentation in information security

Taint analysis Program shepherding

CONFidence Krakow 2012

CONFidence Krakow 2012

CONFidence Krakow 2012

The general scheme of code instrumentation

CONFidence Krakow 2012

Classification of target instrumentation

Source code instrumentation

CONFidence Krakow 2012

Byte code instrumentation

Java VM Dalvik VM AVM/AVM2 CLR

CONFidence Krakow 2012

Instrumentation byte-code (I)

Instrumentation byte code (II)

CONFidence Krakow 2012

Instrumentation Java (I)

CONFidence Krakow 2012

Instrumentation Java (II)

Load-time instrumentation Dynamic instrumentation

Modification *.class files

ClassFileLoadHook -> RetransformClasses

Tools: ReFrameworker, MBEL, RAIL, Cecil

Instrumentation ActionScript (I)

Instrumentation ActionScript (I)

Instrumenteted SWF file

CONFidence Krakow 2012

Instrumentation AVM (II)

Instrumentation binary code

Static binary instrumentation

Modifying call table

Modifying call table/other structure Dynamic code instrumentation

IDT, CPU MSRs, GDT, SSDT, IRP able

Dynamic binary instrumentation

Hardware debug features

Reproduction of the environment

CONFidence Krakow 2012

Static Binary Instrumentation (I)

Static Binary Instrumentation (II)

WinDBG + pykd OllyDBG + python = Immunity Debuggers GDB + PythonGDB

*See Python Arsenal for Reverse Engineering

Dynamic Binary Instrumentation

Dynamic Binary Instrumentation

CONFidence Krakow 2012

JIT, Probe Probe

*For more details see DBI:Intro presentation from ZeroNights conference

Start work with DBI

CONFidence Krakow 2012

Self-modifying code & DBI

CONFidence Krakow 2012

CONFidence Krakow 2012

Rewriting code (I)

CONFidence Krakow 2012

Rewriting code (II)

App1 Emulator OS Processor