【X03】re的入门之非常规RE&pwn的逆向

Irregular Reverse Engineering

• Any format file with any architecture
  • lua/python/java/lua-jit/haskell/applescript/js/solidity/webassembly/etc..
  • firmware/raw bin/etc…
  • chip8/avr/clemency/risc-v/etc..
• Open IDA -> binary file
• How?

Find Tools

• Binary Parser
• Disassembler
  • disassembler is necessary
• Tracer
  • disassembler + tracer = debugger
  • tracer replay
• Debugger
• Decompiler
  • 得之我幸，失之我命

Preparation

• read docs
• toolchains
• tutorial
• Example:
  • haskell

Find Binary Parser

• Google
• parse the unknown binary format
• firmware
  • rebase the binary
  • recover the symbol table
• other unknow binary formats
  • use strings/binwalk etc.
  • find any clues you can
  • use IDA pro/radare2/binary.ninja interface. e.g. IDA loader

Find Disassembler

• google “xxx disassembler/xxx IDA etc.”
  • AVR IDA
• human disassembler
• IDA Pro/radare2/binary.ninja interface
  • e.g. IDA processor

Find tracer and debugger

• google
• tracer
  • try official tracer?
• debugger
  • gdb-multiarch
  • qemu
  • emulator
  • trace replay
• Example
  • solidity

Start regular reverse engineering

How to audit assemble code

• find code pattern
  • loop, if else, etc.
• read assemble block by block

Challenges

• Plaid CTF 2018 apl
• SECCON CTF 2017 printf_machine
• CodeGate CTF 2017 easy_serials
• *CTF 2018 wasm
• Nuit du hack CTF Quals 2018 AssembllyMe
• QWB CTF qual 2018 re
• N1CTF 2018 patient

 

PWN 题的逆向分析策略

常见漏洞简介

• 熟悉常见漏洞
  • 现在 Wiki 、 题目中熟悉
• bof
• Integer Overflow
  • 无符号转有符号 MMACTF 2016 shadow
  • 整数加减乘除，如 malloc(size * 2) (pwnhub.cn calc)
• fmt str
• UAF
• 逻辑漏洞

逆向技巧

• 还原结构体、接口、类
• 控制流分析
• 数据流分析

分析策略

• 文件较小时，对整个目标文件进行控制流分析，做到接近分析出源码
• 文件较大时，关注数据流和其执行流
• 还原结构体、接口、类

关键数据结构分析

• 还原结构体
• IDA Strcuture 窗口 Insert

控制流分析

代码识别

数据流分析