Hitb
•
0 gostou•490 visualizações
The document describes the Reverse Engineering Intermediate Language (REIL), which aims to provide a simple, platform-independent intermediate representation for binary code analysis. REIL uses a small set of instructions that can be easily translated from various processor architectures into a common format. This allows analyses like register tracking to be implemented using the same algorithms regardless of the original platform. REIL is implemented using a technique called MonoREIL that models the program as a graph and solves it using a lattice-based dataflow analysis approach. This enables powerful analyses to be built from the common REIL representation.
Recomendados
Mais conteúdo relacionado
Semelhante a Hitb
Mais de zynamics GmbH
Mais de zynamics GmbH (8)
Hitb
- 1. The Reverse Engineering Language REIL and its applications Sebastian Porst (sebastian.porst@zynamics.com) zynamics GmbH
- 2. I write code for ... sometimes I debug other people‘s code
- 3. We love graphs We love static analysis We want to improve binary code RE
- 4. Reverse Engineering Intermediate Language
- 5. Three Good Reasons for REIL Simple Free of side-effects Platform-Independent
- 6. Fewer Instructions 1000+ 988 17 PowerPC x86 REIL
- 7. X86 Code PowerPC Code ARM Code X86 Translator PowerPC Translator ARM Translator REIL Code MonoREIL Other Analysis Algorithms
- 8. REIL VM Architecture Register-based Virtual Machine Infinite number of registers Infinite amount of memory Close to the original architecture
- 9. add and bisz bsh div jcc ldm mod mul Instructions nop or stm str sub undef unkn xor
- 10. 40131A.07 add (t0, b4), (t1, b4), (t2, b8), [(foo, bar)] 1 REIL Address Native Part REIL Part 1 REIL Mnemonic 1 REIL Operand 3 Operands 2 (really 3) Pieces of Information ∞ Metadata 3 Operand Types 7 Operand Sizes ∞ Operand Values
- 11. add Six Arithmetic Instructions and bisz Addition bsh div Logical Shift jcc Unsigned Division ldm mod Unsigned Modulo mul Unsigned Multiplication nop Subtraction or stm str sub undef unkn xor
- 12. add Three Bitwise Instructions and bisz Bitwise AND bsh div Bitwise OR jcc Bitwise XOR ldm mod mul nop or stm str sub undef unkn xor
- 13. add Three Data Transfer Instructions and bisz Load Memory bsh div Store Memory jcc Transfer Register Content ldm mod mul nop or stm str sub undef unkn xor
- 14. add Two Logical Instructions and bisz Compare to Zero bsh div Jump Conditional jcc ldm mod mul nop or stm str sub undef unkn xor
- 15. add Three Other Instructions and bisz No Operation bsh div Undefine Register jcc Unknown Mnemonic ldm mod mul nop or stm str sub undef unkn xor
- 16. All Instructions are equal ... add t0, t1, t2 and t0, t1, t2 bsh t0, t1, t2 div t0, t1, t2 mod t0, t1, t2 ... but some instructions are mul t0, t1, t2 or t0, t1, t2 more equal than others sub t0, t1, t2 bisz t0, , t2 xor t0, t1, t2 jcc t0, , t2 ldm t0, , t2 nop , , stm t0, , t2 str t0, , t2 undef , , t2 unkn , ,
- 17. What REIL can‘t do FPU Instructions fadd ... System Instructions int ... Weird Instructions setend ...
- 18. More Architectures (x64, MIPS, ...) More Operand Information More Instructions
- 19. So ... ... what is it all good for?
- 20. Register Tracking Follow the effects of a register on the program state
- 22. Negative Array Access MS08-67
- 23. Demo MS08-67
- 24. ... but aren‘t those really difficult to implement? NO!
- 25. MonoREIL
- 26. Create an Instruction Graph Define a Lattice Define Transformations Define a Graph Walker Define a Start Vector
- 27. Create an Instruction Graph 1400: add t0, 15, t1 1401: bisz t1, , t2 1402: jcc t2, , 1405 1403: str 8, , t3 1405: str 16, , t3 1404: jcc t2, , 1406 1406: add t3, t3, t4 int t4 = t0 == -15 ? 32 : 16 1407: jcc 1, , 1420
- 28. Define Lattice Elements T B
- 29. Define Transformations 1400: add t0, 15, t1 1401: bisz t1, , t2 1402: jcc t2, , 1405 1403: str 8, , t3 1405: str 16, , t3 1404: jcc t2, , 1406 1406: add t3, t3, t4 1407: jcc 1, , 1420
- 30. Define a Join function 1400: add t0, 15, t1 1401: bisz t1, , t2 1402: jcc t2, , 1405 1403: str 8, , t3 1405: str 16, , t3 1404: jcc t2, , 1406 1406: add t3, t3, t4 1407: jcc 1, , 1420
- 31. Define a Graph Walker 1400: add t0, 15, t1 1401: bisz t1, , t2 1402: jcc t2, , 1405 1403: str 8, , t3 1405: str 16, , t3 1404: jcc t2, , 1406 1406: add t3, t3, t4 1407: jcc 1, , 1420
- 32. Define a Start Vector node1 → initialState1 node2 → initialState2 node3 → initialState3 node4 → initialState4 node5 → initialState5 ... noden → initialStaten
- 33. Running MonoREIL 1400: add t0, 15, t1 initialState1400 → finalState1400 1401: bisz t1, , t2 initialState1401 → finalState1401 1402: jcc t2, , 1405 initialState1402 → finalState1402 1403: str 8, , t3 1405: str 16, , t3 initialState1403 → finalState1403 1404: jcc t2, , 1406 initialState1405 → finalState1405 initialState1404 → finalState1404 1406: add t3, t3, t4 initialState1406 → finalState1406 1407: jcc 1, , 1420 initialState1407 → finalState1407
- 34. The Result node1 → finalState1 node2 → finalState2 node3 → finalState3 node4 → finalState4 node5 → finalState5 ... noden → finalStaten
- 35. LOC? 14 + n 12 + n 8+n 1+n 1 Walker Graph Transformations Start Vector Lattice
- 36. Register Tracking 120 120 90 1 1 Walker Graph Transformations Start Vector Lattice
- 38. 1700 MS08-67 500 150 1 1 Walker Graph Transformations Start Vector Lattice
- 39. Demo MS08-67
- 40. Deobfuscating Optimizer Type Reconstruction
- 41. Related Work ERESI Vine (BitBlaze) Silvio Cesare Hex-Rays
- 42. Thank You! Questions?