ttern - Free Web Hosting with PHP, MySQL and cPanel

34
Table 1. Checking if the �les have been packed
answer is: with Python of course. Indeed miasm is
shipped with disassembling/assembling capabilities that
we’ll use. Sadly there is no way of doing this with pefile
so if you really don’t want to use miasm you’ll have to
consider using a different standalone program (such
as fasm) or another python module with assembling
capabilities (such as MOSDEF). Let’s get the binary
blob corresponding to this ASM text: Listing 11.
With those few lines of python we have the binary
code corresponding to the ASM deciphering stub we
wrote earlier. A quick check let us know that this binary
will fit without any problem within the trash-padded
space we spotted earlier.
>>> len(deciphering_stub)
25
Executable Original MD5 Packed MD5
We now only have to add this small piece of binary
code at the end of the .text section and modify the PE
file header to enlarge the size of this section that has
to be mapped in memory. Using pefile :
>>> pe.set_bytes_at_rva(tsection.VirtualAddress+
tsection.Misc_VirtualSize, stub)
>>> tsection.Misc_VirtualSize+=len(stub)
Now that everything’s ready we still have to change the
AddressOfEntryPoint in order to start the program with
our decoding stub; to update some checksums stored
in the headers, and to save the resulting PE file on disk
(we use only pefile for this point because some kind of
bug currently seems to corrupt the PE files written
from miasm; although this may be corrected once the
article’s published): Listing 12.
Testing and conclusion
Using those few lines of code we packed some usual
Windows binaries, confirmed that they still worked
exactly the way they are supposed to, and compared
their md5 signatures: Table 1.
The signatures are definitely different which proves that
the files are different. Using this packer we may be able to
REVERSE ENGINEERING
Calc.Exe 5911f4ae105c7469636f7adcea35349f 5f8a5cc3e415ae17dc3f3295138172fb
Notepad.exe 2dcc5c800f51d487178814ca9eada181 571299065675826205d78b56d2dd2adf
Winmine.exe ea682c022f7204cc8e8c9ef5dce29356 efa6921d3f123c62735d850b3e087cfd
Table 2. Efficiency measurement of our tiny packer
Executable Percent modi�ed
Calc.Exe 4.7%
Winmine.exe 6.3%
Notepad.exe 1.1%
bypass a couple of AV if we pack our pentest tools! In order
to estimate our chances of bypassing AV we measured
the amount of the file that was changed: Table 2.
These percentages are quite low and you may feel
like ciphering more sections would be a good idea. After
all there is no reason to cipher only the .data section,
you could cipher almost every section this way and
reach percentages around 90%...but there is a trap.
Indeed when Windows loads a PE file it does some
magic BEFORE jumping to the AddressOfEntryPoint. This
magic includes things such as loading some DLL the
program needs to run; and the glitch is that the list of
DLLs can be stored in any section. If you cipher this
list Windows will fail to understand it and will refuse to
launch your program (i.e. your packed version will not
work). There are a couple of traps like those and if you
want to improve your packer you’ll especially have to
worry about the IAT (the Import Address Table, i.e. the
list of DLL needed) and the .rsrc section (the sections
that holds resources …such as the program’s icon).
Once you’ve managed to spot the parts of the program
you don’t want to encipher (such as the IAT) you can
modify the packer to support ciphering of sections that
holds sensitive data that shall be left in the clear (this
is left as an exercise to the reader). And if this is not
sufficient for you, it may be possible to find really nice
ways of finally modifying those parts without ciphering.
As an example the IAT contains, for every DLL-imported
function needed by the program, the offset of the starting
point of the function in the DLL binary. The trick is that if
this offset happened to be wrong Windows will gracefully
search the whole DLL for the good offset and the program
will still work! So a nice and quick way of modifying the
IAT is to fill every offset with random values.
As far as I’ve gone (~200 lines of Python) I usually
modify around 80% of my PE files, which is sufficient
to have gsecdump/cachedump/NameYourFavoritePentestToo
lHere bypass around 60% of AVs! If you still want to
do better you may consider ciphering the whole file,
dynamically decipher it in RAM, and emulate everything
that Windows does when launching a real PE from disk,
but that’s a lot more work!
ALAIN SCHNEIDER
Alain has been a professional pentester for years but also
published a few papers. Those papers focused both on basic
tricks and on-the-edge technics. His favorites subjects are
password cracking and cryptography
03/2011