This workshop introduces advanced binary analysis concepts that are often required when reverse engineering executables protected by digital rights management (DRM) solutions or malicious software that attempts to hide behavior through code obfuscation and various indirections.
Participants will work on a tailor-made binary that simulates a packed and obfuscated malware dropper and apply the techniques presented to defeat its obfuscation and unpack each stage in order to recover and analyze the final payload. The solution to each stage will be shown and explained in detail. At the end of the workshop, attendees will be able to write emulation scripts using Python and Unicorn engine, use dynamic instrumentation to automate unpacking and perform selective symbolic execution and constraint solving to analyze program behavior.
The workshop will cover the following topics:
- A brief introduction to the tools and frameworks
- Overview of common obfuscation techniques
- Metamorphic Code
- Opaque Predicates
- Virtualization
- In-memory decryption
- In-memory packing
- Analysis Techniques
- Code Emulation
- Symbolic Execution
- Dynamic Instrumentation
- Exercises
- Emulating a shellcode decryption routine and dropper using Unicorn
- Dynamic Instrumentation to retrieve unpacked payload
- Partial symbolic execution to solve metamorphic transformations
Participants should bring:
A laptop running Linux and the following software is recommended for participants who wish to attempt the workshop exercises:
- Ghidra
- Python 3.8
- Unicorn Engine (with Python package)
- Capstone Engine (with Python package)
- Intel PIN
- Z3
- angr
A Virtualbox image containing all the required tools will be provided at the start of the workshop. If planning to use the VM, it is recommended to arrive early to allow time for copying the files and setting up the computer.
Participants must know or have:
Participants should have a basic knowledge of x86-64 assembly and be comfortable reading C code. Experience in reverse engineering is recommended but not necessary and no prior experience with the presented techniques is required.