Instructor: Reverse engineering. 2 2
In this lesson, we're going to talk 3 3
about some different reverse engineering tools 4 4
and techniques and why these are important to us. 5 5
Now, as a cybersecurity analyst, 6 6
you may be asked to do some reverse engineering, 7 7
specifically of malware that was collected on your network. 8 8
When you do reverse engineering, 9 9
this is the process of analyzing the structure of hardware 10 10
or software to reveal more about how it functions. 11 11
Now, the challenge 12 12
is that when you're doing reverse engineering, 13 13
you have to start with a binary 14 14
and that binary is an executable file. 15 15
You can't just look at that binary 16 16
and then figure out what it's doing. 17 17
No, you need to actually take the time 18 18
to decompose that executable 19 19
into something that could be readable as code. 20 20
Now, when you decompose the executable, 21 21
you can do it into one of three things. 22 22
You can do it into machine code, assembly code, 23 23
or high-level code. 24 24
Now, when we talk about machine code, 25 25
this is software that has been assembled 26 26
into binary instructions that are expressed 27 27
as hexadecimal digits native to the processor platform. 28 28
So if you're using an Intel-based processor, 29 29
one of the modern ones, they're x86-64, 30 30
that is the native processor that they use. 31 31
And they have a certain instruction set. 32 32
And so if you send this set of ones and zeros, 33 33
it's going to do this function. 34 34
If you set this other set of ones and zeros, 35 35
it does something else. 36 36
Those are the binary instructions. 37 37
Now, to make it a little bit easier to read, 38 38
we take eight bits at a time 39 39
and we represent that by two hexadecimal digits. 40 40
This way, we can use that bite code 41 41
to be able to read what was being told to the processor. 42 42
For example, if I have this, 48, 89, 32, 43 43
that is a three byte instruction 44 44
that is written in machine code. 45 45
Now, can you understand what this thing is doing? 46 46
No? 47 47
Well, neither can I just by looking at, 48 48
but I actually looked it up. 49 49
And if we actually look at this 50 50
and try to reverse engineer the machine level code 51 51
into something that we can read like this binary, 52 52
it can take a lot of time for us to be able to go through it 53 53
because now, we have this series of hexadecimal numbers 54 54
and we'd have to look them up 55 55
and figure out exactly what they mean. 56 56
Now, in this case, 48, 89, 32 is telling the system 57 57
to store the value received into a variable 58 58
that's stored at a particular location of memory. 59 59
Again, not very helpful yet, right? 60 60
Let's go ahead and take this up one more level. 61 61
We can use something called a disassembler. 62 62
Now, a disassembler can take that machine language 63 63
and they can reverse engineer it to be able to convert it 64 64
from machine language code into assembly language code. 65 65
Now, once we get it into assembly code, 66 66
we have assembly code that is a compiled software program 67 67
that's converted to binary machine code 68 68
using the instruction set of that CPU platform. 69 69
And now, it's actually represented in human readable text. 70 70
So instead of using just the hexadecimal characters, 71 71
I can use things that are written more in ASCII, 72 72
something that I can actually read. 73 73
So if I want to look 74 74
at some typical instructions for assembly, 75 75
you might see things like instructions for moving things 76 76
between one register and memory to another. 77 77
That's things like int or push or move. 78 78
We might perform logical bitwise operations, 79 79
like not, and, or, or xor. 80 80
We might perform mathematical operations, 81 81
like adding, subtracting, incrementing or decrementing. 82 82
Or we could perform branching, things like a jump. 83 83
Or we can use test conditions like compare or test. 84 84
All of these are things that we can use inside of assembly. 85 85
And so basically, there are these two or three 86 86
or four letter codes that tell an instruction of what to do. 87 87
Now again, these aren't really easy to read 88 88
but they're a lot easier 89 89
than looking at binary or hexadecimal. 90 90
For instance, if I have something like this, 91 91
movq %rsi, (%rdx), what is this saying? 92 92
Well, this is an example of that three byte instruction 93 93
that I had earlier from machine code. 94 94
So instead of saying 48, 89, 32, 95 95
I can now have it written this way. 96 96
Now, this still isn't really easy to read 97 97
but it's certainly better than that machine code was. 98 98
So even if you don't know assembly language, 99 99
you could probably see this 100 100
and figure out it's doing something with moving 101 101
because we have movq there, and this is going to move data 102 102
from one place to another in memory. 103 103
Now, the reason it says movq instead of move 104 104
is because this is written for a 64-bit processor 105 105
and it supports the movement of quads of memory. 106 106
And so this is a movq or four bytes at a time. 107 107
Now, the next thing we want to talk about is a decompiler. 108 108
So we took something from machine code 109 109
and we brought it up to assembly by using the disassembler. 110 110
Now, if we take that assembly and we want to go higher, 111 111
we would use a decompiler. 112 112
A decompiler is a reverse engineering tool 113 113
that converts that machine code or assembly language code 114 114
to code in a specific higher level language or pseudocode. 115 115
Now, when we talk about higher level code 116 116
we're talking about code that is easier to read for humans. 117 117
They can read it, write it 118 118
and understand it much more natively. 119 119
For example, if I had some code like this, 120 120
which is written in C, C is considered a high-level language 121 121
with code that's fairly easy to read 122 122
for somebody with some basic training. 123 123
Even if you haven't known C in the past, 124 124
you can probably look at this 125 125
and figure out what it's doing. 126 126
What do you think it's doing? 127 127
It's assigning the value of T into the variable dest, 128 128
or in this case, 129 129
the destination location of a piece of memory. 130 130
And that's all we're doing. 131 131
It's the same code that we were using before. 132 132
I can write it this way 133 133
or I can write it with the move statement, 134 134
or I can write it as 48, 89, 32. 135 135
All three do the exact same thing, 136 136
but this one is by far the easiest to understand. 137 137
Now, another way you can do this is by using pseudocode. 138 138
Pseudocode is not real code. 139 139
The code I just showed you was actually C, 140 140
but pseudocode can just be a made up language 141 141
that your decompiler is going to use. 142 142
Pseudocode makes it easier to identify individual functions 143 143
within the process, track the use of variables, 144 144
and to find branching logic. 145 145
Now, when you're dealing with this, 146 146
you want to use a tool to do this. 147 147
Now, what is the most common tool out there 148 148
when it comes to decompiling and disassembly? 149 149
Well, IDA. 150 150
IDA is a interactive disassembler, also known as IDA, IDA. 151 151
This is a popular cross-platform disassembler and decompiler 152 152
that's often used by reverse engineers. 153 153
If you happen to take a course 154 154
in reverse malware engineering, 155 155
you're going to get really familiar with how to use IDA. 156 156
Now, IDA has an automated functionality as well 157 157
that's able to identify different API calls, 158 158
function parameters constraints 159 159
and other components of the disassembled code. 160 160
In this particular example, IDA has taken the machine code 161 161
from the binary, disassembled back into assembly language, 162 162
and then use this decompiler function 163 163
to make it more human readable 164 164
by giving us this high level pseudocode 165 165
that looks something like a C or a C++ program. 166 166
You can see that on the right, 167 167
all the pseudocode on the right side, 168 168
and this would help us decompile this malware 169 169
and figure out what it's doing. 170 170
Now, programmers, 171 171
if they want to make their code more difficult to analyze, 172 172
they can do this by using an obfuscator. 173 173
An obfuscator is basically a software 174 174
that's going to randomize the names of variables, constants, 175 175
functions, procedures and removes comments, 176 176
and all the white space inside a code. 177 177
This makes it harder for us as malware analysts 178 178
to be able to go through that code 179 179
and figure out what the malware writer is doing, 180 180
which is their goal 181 181
because they want to keep the secret sauce 182 182
of their malware secret so that we can't write signatures 183 183
to block in the future. 184 184
And if we can go through and reverse engineer their code, 185 185
we can understand what it's doing, 186 186
we can block IP addresses, block domain names, 187 187
or whatever else they're using for beaconing, 188 188
callouts and other exfiltration. 189 189
Now, debugging tools are used to decompile executables 190 190
and observe their behavior. 191 191
When we're talking about debugging tools, 192 192
this is things like Immunity Debugger, GDB, 193 193
and SearchSploit. 194 194
First, we have the Immunity Debugger. 195 195
Immunity Debugger is a debugger built specifically 196 196
for penetration testers to write exploits, analyze malware, 197 197
and reverse engineer binary files 198 198
using python scripts and APIs. 199 199
The main difference between the Immunity Debugger 200 200
and OllyDBG is that the Immunity Debugger 201 201
also supports a Python API plugin 202 202
that allows us to execute Python code 203 203
from within this debugger, 204 204
and that allows penetration testers to work quicker. 205 205
If you're a penetration tester 206 206
who does a lot of custom coding, 207 207
you're really going to love using the Immunity Debugger. 208 208
Second, we have GDB or the GNU Debugger. 209 209
This is an open source cross-platform debugger 210 210
for Unix, Windows, and Mac OS. 211 211
Now, GDB or the GNU Debugger supports Ada, C, C++, 212 212
Objective-C, Pascal, Fortran, Go, Java, 213 213
and many other programming languages. 214 214
However, because it is a text-based program 215 215
that works inside the Linux console, 216 216
it's not incredibly user-friendly 217 217
even though it supports so many languages, 218 218
and therefore, most penetration testers 219 219
prefer to use other debuggers 220 220
like the Immunity Debugger instead. 221 221
Our final tool we're going to talk about in debuggers, 222 222
it's SearchSploit, and this is another one 223 223
where it doesn't quite cleanly fit into the category. 224 224
SearchSploit is a tool used to find exploits 225 225
that are available in the exploit database. 226 226
So you may be wondering if this is a research tool, 227 227
why is it showing up under debuggers? 228 228
Well, we're covering SearchSploit in this lesson 229 229
because we often use SearchSploit 230 230
while we're reading different malware in a debugger, 231 231
so that we can understand what a particular piece 232 232
of exploit code might actually be doing 233 233
for that particular piece of malware. 234 234
So I could see it from that perspective 235 235
where we use this hand in hand with debuggers, 236 236
but it itself is not a debugger tool. 237 237
Instead, it is a tool that's used to research exploit code 238 238
in the central database. 239 239
By having SearchSploit installed on your system though, 240 240
you can download a copy of that database locally 241 241
so you can work offline when you're doing your debugging 242 242
and be able to have access to that research database.