Linear Obfuscation to Drive angr Angry

Halvar Flake＆PPPとローレイヤーな話をしよう (https://7bd76f3e7d0cf6c4962c0a8da8.doorkeeper.jp/events/43029) LT

Transcript

1. View Slide

2. •
   •
   •
   •
   •
   

   View Slide

3. void congrats()
   {
   puts("congrats!");
   }
   int main(int argc, char *argv[])
   {
   char username[256];
   char password[256];
   scanf("%s", username);
   scanf("%s", password);
   (strcmp(username, "admin") == 0 && strcmp(password, "l33t") == 0) ? congrats() : exit(1);
   return 0;
   }
   

   View Slide

4. List of functions:
   [(4195592L, ), (4195648L, ), (4195664L, ), (4195680L, ), (4195696L,
   ), (4195712L, ), (4195728L, ), (4195744L, ), (4195760L, _start (0x4005b0)>), (4195808L, ), (4195920L, ), (4195952L, ), (4195997L, congrats (0x40069d)>), (4196013L, ), (4196224L, ), (67108864L, ), (67108880L, ),
   (67108896L, ), (67108912L, ), (67108928L, ), (67108944L, ), (67108976L,
   )]
   Dump stdin at congrats():
   'admin¥x00¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x0
   1¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x0
   1¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01l33t¥x00¥x00¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01
   ¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01
   ¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x00¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01
   ¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x01¥x00¥x01¥x01¥x00'
   import angr
   b = angr.Project('./test')
   cfg = b.analyses.CFG()
   print "List of functions:"
   print [x for x in cfg.functions.iteritems()]
   addr_congrats = b.loader.main_bin.get_symbol("congrats").addr
   e = b.surveyors.Explorer(find = addr_congrats)
   e.run()
   if len(e.found) > 0:
   print "Dump stdin at congrats():"
   print "%r" % e.found[0].state.posix.dumps(0)
   

   View Slide

5. int main(int argc, char *argv[])
   {
   char username[256];
   char password[256];
   srand((unsigned int)time(NULL));
   int y = rand()%1000;
   scanf("%s", username);
   scanf("%s", password);
   while(y > 1)
   {
   if(y % 2 == 1)
   y = 3 * y + 1;
   else
   y = y / 2;
   (y == 1 && strcmp(username, "admin") == 0 && strcmp(password, "l33t") == 0) ? congrats() : exit(1);
   }
   return 0;
   }
   

   View Slide

6. ERROR | 2016-04-27 05:40:51,491 | angr.analyses.cfg | Caught an AngrError during CFG recovery at
   0xffffffffff600400 (No section)
   Traceback (most recent call last):
   File "/home/angr/angr-dev/angr/angr/analyses/cfg_accurate.py", line 2268, in _get_simrun sim_run =
   self.project.factory.sim_run(current_entry.state, jumpkind=jumpkind)
   File "/home/angr/angr-dev/angr/angr/factory.py", line 131, in sim_run r = self.sim_block(state,
   addr=addr, **block_opts)
   File "/home/angr/angr-dev/angr/angr/factory.py", line 71, in sim_block **block_opts) File
   "/home/angr/angr-dev/angr/angr/lifter.py", line 83, in lift raise AngrMemoryError("No bytes in
   memory for block starting at 0x%x." % addr)
   AngrMemoryError: No bytes in memory for block starting at 0xffffffffff600400.
   ERROR | 2016-04-27 05:40:51,674 | angr.analyses.cfg | Caught an AngrError during CFG recovery at
   0xffffffffff600400 (No section)
   Traceback (most recent call last):
   File "/home/angr/angr-dev/angr/angr/analyses/cfg_accurate.py", line 2268, in _get_simrun sim_run =
   self.project.factory.sim_run(current_entry.state, jumpkind=jumpkind)
   File "/home/angr/angr-dev/angr/angr/factory.py", line 131, in sim_run r = self.sim_block(state,
   addr=addr, **block_opts)
   File "/home/angr/angr-dev/angr/angr/factory.py", line 71, in sim_block **block_opts) File
   "/home/angr/angr-dev/angr/angr/lifter.py", line 83, in lift raise AngrMemoryError("No bytes in
   memory for block starting at 0x%x." % addr)
   AngrMemoryError: No bytes in memory for block starting at 0xffffffffff600400.
   List of functions:
   [(4195752L, ), (4195840L, ),
   (4195888L, ), (4195904L, ),
   (4195968L, ), (4196016L, ),
   (4196128L, ), (4196160L, (0x400740)>), (4196221L, ), (4196608L, (0x400900)>), (67108896L, ), (67108976L, SimProcedureContinuation (0x4000070)>), (67109072L, ),
   (18446744073699066880L, )]
   

   View Slide

7. View Slide

8. // srand((unsigned int)time(NULL));
   // int y = rand()%1000;
   int y = 1000;
   

   View Slide