Upgrade to Pro — share decks privately, control downloads, hide ads and more …

FRAPL - Next Generation Reverse Engineering Framework

Max Bazaliy
November 04, 2016

FRAPL - Next Generation Reverse Engineering Framework

Ruxcon 2016, Melbourne, Australia

Max Bazaliy

November 04, 2016
Tweet

More Decks by Max Bazaliy

Other Decks in Technology

Transcript

  1. October 22-23, 2016
    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    FRAPL
    Max Bazaliy
    Next Generation
    Reverse Engineering Framework
    Alex Hude

    View Slide

  2. October 22-23, 2016
    Who we are 1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    Alex Hude
    o Melbourne, Australia
    o BlackmagicDesign
    o Hardware, XNU
    o Fried Apple team
    Max Bazaliy
    o Kyiv, Ukraine
    o Lookout
    o XNU, Linux, LLVM
    o Fried Apple team

    View Slide

  3. October 22-23, 2016
    Modern Reverse Engineering 1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    Static approach
    o Disassemblers
    o Code analyzers
    o Decompilers
    o IDA as a choice
    Dynamic approach
    o Debuggers
    o Dynamic analyzers
    o Code instrumentation
    o Frida as a choice

    View Slide

  4. October 22-23, 2016
    Static analysis challenges 1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    o Missed context (CPU registers, stack, memory)
    o Hard to follow code execution flow (obfuscation)
    o Hard to follow data flow (encryption)
    o Hard to follow indirect function calls

    View Slide

  5. October 22-23, 2016
    Debugging challenges 1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    o Anti debugging tricks
    o Data loss during restarts
    o Execution flow may be changed under debugging
    o No way to hook/replace existing code easily

    View Slide

  6. October 22-23, 2016
    Dynamic instrumentation challenges 1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    o Code disassembly still missed
    o High learning curve
    o Usually requires to write a lot of code
    o Hard to maintain multiple things at a time

    View Slide

  7. October 22-23, 2016
    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12

    View Slide

  8. October 22-23, 2016
    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12

    View Slide

  9. October 22-23, 2016
    What is FRAPL ? 1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    FRAPL
    =
    Fridascripts + FridaLink

    View Slide

  10. October 22-23, 2016
    Frida Scripts 1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    o Node.jsclient (attach, spawn, RPC, script loading)
    o Node.jsserver script (RPC, GCD, iOS/macOSbindings)
    o Common operations wrappers (objchooks etc)
    o Utility functions (memory dumps, logging)

    View Slide

  11. October 22-23, 2016
    FridaLink 1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    o IDA plugin that implements UI controls to Frida
    o Socket protocol between IDA & Frida Client (JSON)
    o RPC protocol for between Frida Client & Server (JSON)
    o FridaLink.js(Frida script)

    View Slide

  12. October 22-23, 2016
    FridaLinkarchitecture 1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12

    View Slide

  13. October 22-23, 2016
    FridaLinkgoals 13
    14
    15
    16
    17
    18
    19
    20
    21
    22
    23
    o Bring static analysis info from IDA to Frida
    o Use dynamic info from Frida for IDA analysis
    o Monitor runtime state directly from IDA
    o Control Frida agent directly from IDA

    View Slide

  14. October 22-23, 2016
    FridaLinkfeatures 13
    14
    15
    16
    17
    18
    19
    20
    21
    22
    23
    o Function/instruction hooks made easy
    o Function replacement made easy
    o Module loading made easy
    o Custom scripts support

    View Slide

  15. October 22-23, 2016
    FridaLinkfeatures 13
    14
    15
    16
    17
    18
    19
    20
    21
    22
    23
    o CPU context monitoring
    o Memory monitoring
    o SQLite database support
    o Helpers and project save/restore

    View Slide

  16. October 22-23, 2016
    13
    14
    15
    16
    17
    18
    19
    20
    21
    22
    23

    View Slide

  17. October 22-23, 2016
    FridaLink-Overall View 13
    14
    15
    16
    17
    18
    19
    20
    21
    22
    23

    View Slide

  18. October 22-23, 2016
    FridaLink–Hooks 13
    14
    15
    16
    17
    18
    19
    20
    21
    22
    23
    o Instruction hooks
    o Instruction breakpoints (hook with wait)
    o IDB (local) function hooks
    o Import function hooks

    View Slide

  19. October 22-23, 2016
    FridaLink–Function Replacement 13
    14
    15
    16
    17
    18
    19
    20
    21
    22
    23
    Replace Import function
    Replace local function

    View Slide

  20. October 22-23, 2016
    FridaLink–Module Loading 13
    14
    15
    16
    17
    18
    19
    20
    21
    22
    23
    o Automatic (on backtrace)
    o Manual

    View Slide

  21. October 22-23, 2016
    FridaLink–Custom Scripts 13
    14
    15
    16
    17
    18
    19
    20
    21
    22
    23
    Execute custom script dialog

    View Slide

  22. October 22-23, 2016
    FridaLink–CPU Context Monitoring 13
    14
    15
    16
    17
    18
    19
    20
    21
    22
    23
    CPU context
    Stack
    Backtrace

    View Slide

  23. October 22-23, 2016
    FridaLink–Memory Monitoring 13
    14
    15
    16
    17
    18
    19
    20
    21
    22
    23
    Memory content
    Add new memory watchpoint
    Memory manger

    View Slide

  24. October 22-23, 2016
    FridaLink–SQLite Support 24
    25
    26
    27
    28
    29
    30
    31
    32
    33
    34
    Set up DB Query execution
    Load script

    View Slide

  25. October 22-23, 2016
    FridaLink–Helpers and more 24
    25
    26
    27
    28
    29
    30
    31
    32
    33
    34
    Address converter
    FRAPL logs

    View Slide

  26. October 22-23, 2016
    Getting Started 24
    25
    26
    27
    28
    29
    30
    31
    32
    33
    34
    1. Load FridaLink.pyinto IDA
    2. Create project using create_project.sh
    3. Run client with node

    View Slide

  27. October 22-23, 2016
    macOSApplication Demo 24
    25
    26
    27
    28
    29
    30
    31
    32
    33
    34

    View Slide

  28. October 22-23, 2016
    iOS Application Demo 24
    25
    26
    27
    28
    29
    30
    31
    32
    33
    34

    View Slide

  29. October 22-23, 2016
    24
    25
    26
    27
    28
    29
    30
    31
    32
    33
    34

    View Slide

  30. October 22-23, 2016
    24
    25
    26
    27
    28
    29
    30
    31
    32
    33
    34
    eta son
    https://github.com/FriedAppleTeam

    View Slide

  31. October 22-23, 2016
    Future plans 24
    25
    26
    27
    28
    29
    30
    31
    32
    33
    34
    o Kernel support
    o Windows support ?
    o Android support ?
    o Hack the planet!

    View Slide

  32. October 22-23, 2016
    @getorix
    @mbazaliy
    24
    25
    26
    27
    28
    29
    30
    31
    32
    33
    34
    special thanks to
    @in7egral
    Questions

    View Slide