Nytro Posted December 27, 2011 Report Posted December 27, 2011 The Life of Binaries Creator: Xeno Kovah License: Creative Commons Share-Alike (http://creativecommons.org/licenses/by-sa/3.0/) Lab Requirements: Requires a Windows system with Visual C++ Express Edition, Windows DDK or WDK kernel module compilation environment, and WinDbg. Requires a Windows guest OS running in VMWare Player or VMWare Server in order to do kernel debugging with WinDbg from the host OS. Recommended Class Duration: 3 days (class previously taught in 2 days which was too little) Creator Available for Training: Yes Author Comments: Topics include but are not limited to: •Scanning and tokenizing source code. •Parsing a grammar. •Different targets for x86 assembly object files generation. (E.g. relocatable vs. position independent code). •Linking object files together to create a well-formed binary. •Detailed descriptions of the high level similarities and low level differences between the Windows PE and Linux ELF binary formats. (NOTE: we didn't get to this in the class where the video was recorded, but the materials are in the slides) •How an OS loads a binary into memory and links it on the fly before executing it. Along the way we discuss the relevance of security at different stages of a binary’s life, from the tricks that can be played by a malicious compiler, to how viruses really work, to the way which malware “packers” duplicate OS process execution functionality, to the benefit of a security-enhanced OS loader which implements address space layout randomization (ASLR). Lab work includes: •Manipulating compiler options to change the type of assembly which is output •Manipulating linker options to change the structure of binary formats •Reading and understanding PE files with PEView •Reading and understanding ELF files with Readelf (NOTE: we didn't get to this in the class where the video was recorded, but the materials are in the slides) •Using WinDbg and/or GDB to watch the loader dynamically link an executable •Using Thread Local Storage (TLS) to obfuscate control flow and serve as a basic anti-debug mechanism •Creating a simple example virus for PE •Analyze the changes made to the binary format when a file is packed with UPX •Using the rootkit technique of Import Address Table (IAT) hooking to subvert the integrity of a program’s calls to external libraries, allowing files to be hidden. Knowledge of this material is recommended, but not required, for future classes such as Rootkits, but is required for reverse engineering. To submit any suggestions, corrections, or explanations of things I didn’t know the reasons for, please email me at the address included in the slides.All Materials LoBSlidesOnly.zip LoBCodeOnly.zip Videos of the class hosted at archive.org. These are useful for students, but also more useful for potential instructors who would like to teach this material. By watching the video, you will better understand the intent of some slides which do not stand on their own. You are recommended to watch the largest size video so that the most possible text is visible without having to follow along in the slides:Online: Day 1 Part 1Day 1 Part 2Day 1 Part 3Day 1 Part 4Day 1 Part 5Day 1 Part 6Day 2 Part 1Day 2 Part 2Day 2 Part 3Day 2 Part 4Day 2 Part 5Day 2 Part 6 Download videos:http://www.archive.org/download/TheLifeOfBinariesDay1Part1/PR_LifeOfBinariesDay1Part1.mp4http://www.archive.org/download/TheLifeOfBinariesDay1Part2/PR_LifeOfBinariesDay1Part2.mp4http://www.archive.org/download/TheLifeOfBinariesDay1Part3/PR_LifeOfBinariesDay1Part3.mp4http://www.archive.org/download/TheLifeOfBinariesDay1Part4/PR_LifeOfBinariesDay1Part4.mp4http://www.archive.org/download/TheLifeOfBinariesDay1Part5/PR_LifeOfBinariesDay1Part5.mp4http://www.archive.org/download/TheLifeOfBinariesDay1Part6/PR_LifeOfBinariesDay1Part6.mp4http://www.archive.org/download/TheLifeOfBinariesDay2Part1/PR_LifeOfBinariesDay2Part1.mp4http://www.archive.org/download/TheLifeOfBinariesDay2Part2/PR_LifeOfBinariesDay2Part2.mp4http://www.archive.org/download/TheLifeOfBinariesDay2Part3/PR_LifeOfBinariesDay2Part3.mp4http://www.archive.org/download/TheLifeOfBinariesDay2Part4/PR_LifeOfBinariesDay2Part4.mp4http://www.archive.org/download/TheLifeOfBinariesDay2Part5/PR_LifeOfBinariesDay2Part5.mp4http://www.archive.org/download/TheLifeOfBinariesDay2Part6/PR_LifeOfBinariesDay2Part6.mp4 Revision History: 09-06-2011 - Videos uploaded 02-16-2011 - Initial class content upload If you have used and modified this material, we would appreciate it if you submit your modified version for publishing here, so that all versions can benefit from your changes.Sursa: LifeOfBinaries Quote
