diff --git a/static/reversing-workshop.html b/static/reversing-workshop.html new file mode 100644 index 0000000..80f5a4e --- /dev/null +++ b/static/reversing-workshop.html @@ -0,0 +1,944 @@ + + + + + + Intro to Reverse Engineering + + + + + + + + + +
+
+ +
+

Intro to Reverse Engineering

+

A workshop by VikeSec

+
+ +
+
+

What is this?

+ +
+
+

A Workshop!

+

We will be:

+
    +
  • Teaching a concept
    • +
  • Demonstrating an application
    • +
  • Doing exercises
    • +
+
+
+

Agenda

+
    +
  • Define reverse engineering
    • +
  • Explain how binary programs are structured
    • +
  • Teach techniques and tools for reversing binary programs
    • +
  • Practice!
    • +
+
+
+
+

What Is Reverse Engineering?

+ +
+
+

Let’s ask Wikipedia

+
+

“Reverse engineering is a process or method through which one +attempts to understand through deductive reasoning how a previously made +[thing] accomplishes a task with very little insight into exactly how it +does so.”

+
+
+
+

More Succinctly

+

Cracking open something in order to understand it, with very little +outside help.

+
+
+

How does this relate to security?

+
    +
  • Many programs have security throught obscurity
    • +
  • By understanding how programs work, we can more easily break +them
    • +
  • Sometimes source code isn’t available; today we’re studing +binary reversing
    • +
+
+
+
+

Basic Concepts

+ +
+
+

Files

+
    +
  • A blob of bytes with dynamic size
    • +
  • Has additional metadata +
      +
    • Path: location in the filesystem
      • +
    • Permissions: read, write, execute, set UID, etc
      • +
    • Owner: user/group
      • +
    • Type: regular, directory, link, device, etc
      • +
    • Times: birth, access, modify, change,
      • +
    • +
+
+
+

File example

+
$ stat assets/img/vikesec.png
+  File: assets/img/vikesec.png
+  Size: 19753           Blocks: 40         IO Block: 4096   regular file
+Device: 8,32    Inode: 91725       Links: 1
+Access: (0755/-rwxr-xr-x)  Uid: ( 1000/ malcolm)   Gid: ( 1000/ malcolm)
+Access: 2023-10-09 13:27:11.557494189 -0700
+Modify: 2023-10-09 13:27:08.524161649 -0700
+Change: 2023-10-09 13:29:06.726631168 -0700
+ Birth: 2023-10-09 13:27:08.513328318 -0700
+
+
+

File types

+
    +
  • File type is a construct, it’s not intrinsic to the format
    • +
  • File extensions like .png, .exe are just hints +
      +
    • You can open a text file in Photoshop or a photo in Notepad if you +want
      • +
    • +
  • Some programs support multiple types of files, like your image +viewer. How does it tell them apart?
    • +
+
+
+

Magic numbers

+
    +
  • Most file types have a magic number at the start of the +file that uniquely identifies them
    • +
  • For example +
      +
    • JPEG is ff d8 ff
      • +
    • PNG is 89 50 4e 47 0d 0a 1a 0a or +"\x89PNG\r\n\x1a\n"
      • +
    • ELF is 7f 45 4c 46 or "\x7fELF"
      • +
    • EXE is 4d 5a or "MZ"
      • +
    • +
  • This is part of how the file command works!
    • +
+
+
+

Magic number example

+
$ head -c 4 < hello | hexdump -C
+00000000  7f 45 4c 46                                       |.ELF|
+00000004
+
+$ file hello
+hello: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=8f1c454f8491c77bf16b885d6dda8de0db00a19f, for GNU/Linux 4.4.0, not stripped
+
+
+

Programs are just files

+
    +
  • Programs are files, just like everything else stored on your +computer.
    • +
  • They have a magic number, a file format, and programs need to know +how to read it. +
      +
    • For example, your operating system’s loader needs to load +the file to run it.
      • +
    • +
  • With the right tools, we as humans can read it too!
    • +
+ +
+
+
+

Executable crash course

+ +
+
+

Parts of a computer program

+
    +
  • Code (specifically machine code)
    • +
  • Data
    • +
  • Instructions on how to run it
    • +
+
+
+

Memory regions

+
    +
  • Code (of course)
    • +
  • Read-only data (string literals, const variables)
    • +
  • Editable data (global variables) +
      +
    • BSS for uninitialized, Data for initialized
      • +
    • +
  • Stack (local variables, function parameters, return addresses)
    • +
  • Heap (memory dynamically allocated at runtime)
    • +
  • Other (dynamically-linked functions, mmaped files, stuff managed by +the kernel)
    • +
+
+
+

Example C program

+
#include <stdio.h>
+
+const double pi = 3.14;
+double e =  2.71;
+
+int main(int argc, char** argv) {
+        char name[] = "VikeSec";
+        printf("Hello, %s!\n", name);
+        return 0;
+}
+
+
+ +
#include <stdio.h>
+
+const int pi = 3.14; // read only memory (global const)
+double e =  2.71; // global va
+
+int main( // code
+          int argc, char** argv // stack (param)
+        ) {
+        char name[] = "VikeSec"; // stack (local)
+        printf( // other (dynamically linked function)
+                "Hello, %s!", // read only memory (string literal)
+                name // stack (local)
+        );
+        return 0;
+}
+
+
+

ELF File format

+
    +
  • Executable and Linked Format +
      +
    • Linux uses this for programs and libraries
      • +
    • +
  • Header has info about program type, architecture, entry point
    • +
  • Describes code, rodata, data, and bss segments
    • +
  • Two places for included functions to live: +
      +
    • Statically linked (functions are resolved at link-time and included +in the ELF)
      • +
    • Dynamically linked (functions are resolved at run-time and loaded +from the system)
      • +
    • +
+
+
+
+

Ghidra

+ +
+
+

Loading the file

+
    +
  • File -> New Project
    • +
  • File -> Import File +
      +
    • Use the defaults
      • +
    • +
  • Double Click or Enter to open it
    • +
  • Yes, analyze it +
      +
    • Use the defaults
      • +
    • +
+ +
+
+

Tour of UI

+
    +
  • Left +
      +
    • Program tree: open program and memory regions
      • +
    • Symbols
      • +
    • Types
      • +
    • +
  • Middle +
      +
    • The actual program
      • +
    • Code and data
      • +
    • Other info made up by Ghidra (types, references, labels)
      • +
    • +
+
+
+ +
    +
  • Right +
      +
    • Disassembly
      • +
    • A best-effort guess at what the C might look like
      • +
    • Has Ghidra-specific made-up functions, struct fields, etc
      • +
    • +
+
+
+

Solve Example 1

+ +
+
+

Solve Example 2

+ +
+
+

Solve Example 3

+ + +
+
+
+ + + + + + + + + + +