Irregular Reverse Engineering
- Any format file with any architecture
- lua/python/java/lua-jit/haskell/applescript/js/solidity/webassembly/etc..
- firmware/raw bin/etc…
- chip8/avr/clemency/risc-v/etc..
- Open IDA -> binary file
- How?
Find Tools
- Binary Parser
- Disassembler
- disassembler is necessary
- Tracer
- disassembler + tracer = debugger
- tracer replay
- Debugger
- Decompiler
- 得之我幸,失之我命
Preparation
- read docs
- toolchains
- tutorial
- Example:
- haskell
Find Binary Parser
- parse the unknown binary format
- firmware
- rebase the binary
- recover the symbol table
- other unknow binary formats
- use strings/binwalk etc.
- find any clues you can
- use IDA pro/radare2/binary.ninja interface. e.g. IDA loader
Find Disassembler
- google “xxx disassembler/xxx IDA etc.”
- AVR IDA
- human disassembler
- IDA Pro/radare2/binary.ninja interface
- e.g. IDA processor
Find tracer and debugger
- tracer
- try official tracer?
- debugger
- gdb-multiarch
- qemu
- emulator
- trace replay
- Example
- solidity
Start regular reverse engineering
How to audit assemble code
- find code pattern
- loop, if else, etc.
- read assemble block by block
Challenges
- Plaid CTF 2018 apl
- SECCON CTF 2017 printf_machine
- CodeGate CTF 2017 easy_serials
- *CTF 2018 wasm
- Nuit du hack CTF Quals 2018 AssembllyMe
- QWB CTF qual 2018 re
- N1CTF 2018 patient
PWN 题的逆向分析策略
常见漏洞简介
- 熟悉常见漏洞
- 现在 Wiki 、 题目中熟悉
- bof
- Integer Overflow
- 无符号转有符号 MMACTF 2016 shadow
- 整数加减乘除,如 malloc(size * 2) (pwnhub.cn calc)
- fmt str
- UAF
- 逻辑漏洞
逆向技巧
- 还原结构体、接口、类
- 控制流分析
- 数据流分析
分析策略
- 文件较小时,对整个目标文件进行控制流分析,做到接近分析出源码
- 文件较大时,关注数据流和其执行流
- 还原结构体、接口、类
关键数据结构分析
- 还原结构体
- IDA Strcuture 窗口 Insert