October 22-23, 2016 Who we are 1 2 3 4 5 6 7 8 9 10 11 12 Alex Hude o Melbourne, Australia o BlackmagicDesign o Hardware, XNU o Fried Apple team Max Bazaliy o Kyiv, Ukraine o Lookout o XNU, Linux, LLVM o Fried Apple team
October 22-23, 2016 Modern Reverse Engineering 1 2 3 4 5 6 7 8 9 10 11 12 Static approach o Disassemblers o Code analyzers o Decompilers o IDA as a choice Dynamic approach o Debuggers o Dynamic analyzers o Code instrumentation o Frida as a choice
October 22-23, 2016 Static analysis challenges 1 2 3 4 5 6 7 8 9 10 11 12 o Missed context (CPU registers, stack, memory) o Hard to follow code execution flow (obfuscation) o Hard to follow data flow (encryption) o Hard to follow indirect function calls
October 22-23, 2016 Debugging challenges 1 2 3 4 5 6 7 8 9 10 11 12 o Anti debugging tricks o Data loss during restarts o Execution flow may be changed under debugging o No way to hook/replace existing code easily
October 22-23, 2016 Dynamic instrumentation challenges 1 2 3 4 5 6 7 8 9 10 11 12 o Code disassembly still missed o High learning curve o Usually requires to write a lot of code o Hard to maintain multiple things at a time
October 22-23, 2016 FridaLink 1 2 3 4 5 6 7 8 9 10 11 12 o IDA plugin that implements UI controls to Frida o Socket protocol between IDA & Frida Client (JSON) o RPC protocol for between Frida Client & Server (JSON) o FridaLink.js(Frida script)
October 22-23, 2016 FridaLinkgoals 13 14 15 16 17 18 19 20 21 22 23 o Bring static analysis info from IDA to Frida o Use dynamic info from Frida for IDA analysis o Monitor runtime state directly from IDA o Control Frida agent directly from IDA
October 22-23, 2016 FridaLinkfeatures 13 14 15 16 17 18 19 20 21 22 23 o Function/instruction hooks made easy o Function replacement made easy o Module loading made easy o Custom scripts support
October 22-23, 2016 FridaLinkfeatures 13 14 15 16 17 18 19 20 21 22 23 o CPU context monitoring o Memory monitoring o SQLite database support o Helpers and project save/restore
October 22-23, 2016 FridaLink–Hooks 13 14 15 16 17 18 19 20 21 22 23 o Instruction hooks o Instruction breakpoints (hook with wait) o IDB (local) function hooks o Import function hooks
October 22-23, 2016 Getting Started 24 25 26 27 28 29 30 31 32 33 34 1. Load FridaLink.pyinto IDA 2. Create project using create_project.sh 3. Run client with node