Upgrade to Pro — share decks privately, control downloads, hide ads and more …

自作バイナリエディタを用いたバイナリ解析

20c5ddcad23304aed77ce8c3aa020562?s=47 @tkmru
March 05, 2016
Programming
3
1.9k

 自作バイナリエディタを用いたバイナリ解析

セキュリティ・キャンプ・フォーラム 2016/03/04

20c5ddcad23304aed77ce8c3aa020562?s=128

@tkmru

March 05, 2016
Tweet

More Decks by @tkmru

See All by @tkmru
20c5ddcad23304aed77ce8c3aa020562?s=48 tkmru
2
380
20c5ddcad23304aed77ce8c3aa020562?s=48 tkmru
0
110
20c5ddcad23304aed77ce8c3aa020562?s=48 tkmru
0
2.6k
20c5ddcad23304aed77ce8c3aa020562?s=48 tkmru
18
9.4k
20c5ddcad23304aed77ce8c3aa020562?s=48 tkmru
1
1.2k
20c5ddcad23304aed77ce8c3aa020562?s=48 tkmru
0
150
20c5ddcad23304aed77ce8c3aa020562?s=48 tkmru
1
230
20c5ddcad23304aed77ce8c3aa020562?s=48 tkmru
0
160

Other Decks in Programming

See All in Programming
Dcbf2269af2483cabf43128ad1718c11?s=48 grapecity_dev
0
190
3cfad86677c5966ecfe9b81955fa3489?s=48 inoue2002
2
130
Dc52871050369929247b69f3767e8737?s=48 pirosikick
4
930
E0e036f89c14b3e59640318eedf9670b?s=48 bkuhlmann
4
270
843e2b37af4a84f89438478aa939a324?s=48 heistak
2
120
Ee398a67f5017cc2ad5c02d67d10e516?s=48 doyaaaaaken
0
780
6abf6a7150eac5a7fa70ea02046e41f6?s=48 keiichihirobe
1
110
3c031541ed3d92869414857dfef853de?s=48 koher
8
1.1k
14c9795d267f5b85abb98ca5e8780646?s=48 ntaro
0
160
5ade34f8bdf1b55c4ff82c11cf23cf42?s=48 minamijoyo
3
460
877ac424e59bd3dd183859ef4cc9a08a?s=48 ryosukes
0
1.2k
Dcbf2269af2483cabf43128ad1718c11?s=48 grapecity_dev
0
170

Featured

See All Featured
25c7c18223fb42a4c6ae1c8db6f50f9b?s=48 mojombo
358
62k
1177e050db6bafe62885362edf6e3537?s=48 lauravandoore
437
28k
A60068bce2e73de3a37ca9d2dbe36092?s=48 bryan
31
3.4k
8081b26e05bb4354f7d65ffc34cbbd67?s=48 chriscoyier
684
180k
7edec06b5435e0dac07a353b2cc26253?s=48 geeforr
332
29k
Ded01cdab114abe4ec13511e4c25b9bb?s=48 andyhume
64
3.7k
A0517b08532aec8ab2aae3f65d40ad86?s=48 hannesfritz
28
950
433acaea1012b25d97ae66da9b998dad?s=48 malarkey
119
16k
91cefdf141106fa10674aae74ce05890?s=48 yeseniaperezcruz
302
31k
245cee81a9c424266e5e401d844ea881?s=48 lara
172
9.6k
5f2da528927a2ec9ba4fec2069cbc958?s=48 kneath
219
15k
E14f55d3f939977cecbf51b64ff6f861?s=48 keithpitt
401
20k

Transcript

  1. ࣗ࡞όΠφϦΤσΟλΛ ༻͍ͨόΠφϦղੳ ˏtkmru ͚ͨ·Δ 2016-03-04 Fri Security Camp Forum

  2. ୭ʁ • ໊લ: ͚ͨ·Δ (@tkmru) • ॴଐ: ๭େֶ ৘ใཧ޻ֶ෦ •

    CTFνʔϜ: TomoriNao

  3. ༑རಸॹ(SECCON 2015 Intercollege)

  4. None

  5. ຊ୊͸༑རಸॹͰͳ͘ ʮࣗ࡞όΠφϦΤσΟλΛ ༻͍ͨόΠφϦղੳʯ

  6. όΠφϦΤσΟλͱ͸ • ͲΜͳϑΝΠϧͰ΋16ਐ਺Ͱදࣔ͢Δ • ͋΍͍͠ϑΝΠϧΛ࠷ॳʹͿͪࠐΉιϑτ

  7. BZ http://www.forest.impress.co.jp/library/img/review/10014/html/bz1.jpg.html

  8. Stirling http://1.bp.blogspot.com/-O5txkaVlhRg/US3i8jFWvjI/AAAAAAAAdTA/uaDiY_RHDMc/s1600/02.png

  9. ໨grep • όΠφϦΤσΟλ্ͰΑ͘ߦΘΕΔղੳٕ๏ • ໨ࢹͰॏཁͦ͏ͳσʔλΛݟ͚ͭΔߦҝ • Ή͔͍ͣ͠

  10. ʮҰൠతʹ໨grep͸όΠφϦΤ σΟλʹ౥ࡌ͞Ε͍ͯΔϏοτϚο ϓϏϡʔΛۦ࢖͠ɺ ஁͑ΒΕͨ ؟ྗɺݚ͗੅·͞Εͨ໺ੜͷצ ʹΑͬͯൃش͞ΕΔೳྗͰ͋Γɺ ஁࿅ͷ౓߹͍ʹΑͬͯେ͖͘ݸਓ ͕ࠩੜ͡ΔೳྗͰ͋Δɻʯ https://gist.github.com/yoggy/4116843

  11. ϓϩʹ͔͠Ͱ͖ͳ͍

  12. طଘͷόΠφϦΤσΟλ΁ͷෆຬ • mac޲͚ʹ͸σϑΝΫτελϯμʔυͱ͍͑ Δ΋ͷ͕ͳ͍ • ϓϩͰ͸ͳ͍ਓ͕໨grep͢Δͱݟམͱ͕͠ൃ ੜ͢Δ → ΫϩεϓϥοτϑΥʔϜͰղੳΛࣗಈԽͯ͠ ͘ΕΔόΠφϦΤσΟλ͕΄͍͠

  13. ͦ͜Ͱࣗ࡞όΠφϦΤσΟλ

  14. biwx(ͼ͎ͬ͘͢)

  15. ࡐྉ • Python • wxPython - C++ͷGUIϥΠϒϥϦ ʮwxWidgetsʯͷϥούʔ binary editor

    + wxPython = biwx

  16. ಛ௃ • ΫϩεϓϥοτϑΥʔϜ • Φʔϓϯιʔε • ϑΝΠϧͷγάωΠνϟΛ৭෼͚ • ৄࡉ৘ใΛදࣔ(γάωΠνϟͷ৔ॴɺPDFͷύʔε) •

    ࣗಈղੳػೳ

  17. ࣗಈղੳػೳ • ૊Έࠐ·ΕͨϑΝΠϧͷ੾Γग़͠ • όΠφϦͷ୯७ͳ੾Γग़͠ • PDFͷࣗಈύʔε

  18. σϞ1 SECCON CTF 2015 Steganography 1 MrFusion.gpjb

  19. MrFusion.gpjb • Α͘෼͔Βͳ͍ϑΝΠϧ͕༩͑ΒΕΔ • ͳ͔ʹෳ਺ͷը૾ϑΝΠϧ͕Ӆ͞Ε͍ͯΔ • औΓग़ͯ͠ॱ൪ʹಡΊ͹౴͕͑෼͔Δ

  20. flag SECCON{OCT 21 2015 0728}

  21. σϞ2 malicious PDFͷղੳ

  22. malicious PDFͷղੳ • PDFʹ͸JavaScriptίʔυΛຒΊࠐΊΔ • Adobe ReaderͰ JavaScript ࣮ߦݖݶ͕༗ޮ ʹͳ͍ͬͯΕ͹࣮ߦ͞ΕΔ

  23. ࠓޙͷల๬ • ࣗಈղੳػೳͷ֦ॆ • γΣϧίʔυͷղੳ • ղੳऀ͕Ѫ༻͢Δπʔϧʹҭ͍͖͍ͯͯͨ

  24. ͝ਗ਼ௌ͋Γ͕ͱ͏͍͟͝·ͨ͠