CF2 07 - File Analysis.pdf

(2134 KB) Pobierz
Forensics II
Usage of RCE?
Managed code and obfuscation
Assembly basics
Executable formats [some repetition]
What is Reverse Code Engineering?
• Some people say "Reverse Engineering is an art"
–
It is more an application of standard methods that evolve constantly, actually,
everybody can learn these methods and start to RE executables
• Reverse engineering is like solving a jigsaw puzzle
–
In order to see the whole picture you need to find the corner pieces, then the
frame, and then work your way forward from there
• The corner pieces for reversing are strings, constants and function
names
–
The function names that people normally start with are the one's imported from
shared libraries (e.g. Dlls)
–
Strings contain human readable hints about the functionality
–
Specific constants add more clues to solve the puzzle or can sometimes even be
used to identify certain (types of) algorithms
• The major problem is that a lot of experience is needed to identify
strings, constants and to know what the combination of imported
functions may result in
Usage of Reverse Engineering
• Common uses of reverse engineering include
– Recovery of business data from proprietary file formats
– Creation of hardware documentation from binary drivers, often for
producing Linux drivers from Windows or Apple drivers
– Enhancing consumer electronics devices
– Malware analysis and creation, often involving a search for
security holes when systems inter-operate
– Discovery of undocumented APIs that may be useful
– Military or commercial espionage
– Copyright and patent litigation
– Breaking software copy protection (legally and not), often for
games and expensive engineering software
– Academic/Learning purposes and curiosity
– Etc. ...
Patent troll
• Example Rockstar
– Owned by Apple, Microsoft, BlackBerry, Sony and Ericsson
– Bought Nortel patents (former Canadian telecom company) worth
$4,5 billion in 2012
– “Rockstar produces no products
and practices no patents.
Instead, Rockstar employs
a staff of engineers in
Ontario, Canada, who examine
other companies’ successful
products to find anything that
Rockstar might use to demand
and extract licenses to its
patents under threat of litigation.”
- Google 2013-12
RCE of managed code 1
• Managed code
– .NET family of languages, Java etc.
– CLR (Common Language Runtime), JVM (JRE)
– Java bytecode and the Common Intermediate Language CIL
(previously known as MSIL - Microsoft Intermediate Language)
bytecode
• CLI (Common
Language
Infrastructure)
• Obfuscation
–
Fight
decompilers
and
disassemblers

Plik z chomika:

Inne pliki z tego folderu:

Inne foldery tego chomika:

Zgłoś jeśli naruszono regulamin