Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Unicornを用いたDead Code除去

@tkmru
March 20, 2017
210

Unicornを用いたDead Code除去

セキュリティ・キャンプ フォーラム 2017

@tkmru

March 20, 2017
Tweet

More Decks by @tkmru

Transcript

  1. ؆୯ͳྫ x86 asm • mov eax, 0x100000 • shr eax,

    0x10 • add eax, 0x913 • and eax, 0x1fff • mov ecx, eax • mov eax, 0x1918632 • and ecx, 0x600 • mov ecx, 0x800
  2. ؆୯ͳྫ x86 asm • mov eax, 0x100000 • shr eax,

    0x10 • add eax, 0x913 • and eax, 0x1fff • mov ecx, eax • mov eax, 0x1918632 • and ecx, 0x600 • mov ecx, 0x800 ੺จࣈҎ֎͸Dead Code
  3. ྫ) Themida(Packer) A Generic Approach to Automatic Deobfuscation of Executable

    Code http://www.sysnet.ucsd.edu/~bjohanne/assets/papers/oakland2015.pdf
  4. Nao(No-meaning Assembly Omiter) • Dead CodeআڈΛ͢ΔIDAϓϥάΠϯΛOSSͱͯ͠։ൃ • IDAPython • Unicorn(CPUΤϛϡϨʔλͷํ)

    • https://github.com/tkmru/nao • ࣮ࡍʹΤϛϡϨʔλ্Ͱ࣮ߦ͢ΔͷͰɺߴ͍ਫ਼౓Ͱআ ڈͰ͖Δ • ෳ਺ͷΞʔΩςΫνϟʔʹରԠՄೳ
  5. ؆୯ͳྫ x86 asm • mov eax, 0x100000 • shr eax,

    0x10 • add eax, 0x913 • and eax, 0x1fff • mov ecx, eax • mov eax, 0x1918632 • and ecx, 0x600 • mov ecx, 0x800 ݁Ռ eax: 0x1918632 ecx: 0x800
  6. ؆୯ͳྫ x86 asm • mov eax, 0x100000 → nop •

    shr eax, 0x10 → nop • add eax, 0x913 → nop • and eax, 0x1fff → nop • mov ecx, eax → nop • mov eax, 0x1918632 • and ecx, 0x600 → nop • mov ecx, 0x800 ݁Ռ eax: 0x1918632 ecx: 0x800 ফڈͯ͠΋݁ՌʹӨڹ͕ͳ͍ͷͰDead Codeͱ൑அͰ͖Δ