Binary art - Byte-ing the PE that fails you (live version)
66
Binary art Byte-ing the PE that fails you 3 rd November 2012 Lucerne, Switzerland Ange Albertini http://corkami.com
-
Upload
ange-albertini -
Category
Documents
-
view
959 -
download
2
description
this is the live version of an overview of the Portable Executable format and its malformations presented at Hashdays, in Lucerne, on the 3rd November 2012 direct download link: http://corkami.googlecode.com/files/ange_albertini_hashdays_2012.zip
Transcript of Binary art - Byte-ing the PE that fails you (live version)
Binary artByte-ing the PE that fails you
3rd November 2012Lucerne, Switzerland
Ange Albertinihttp://corkami.com
agenda
what's a PE?the problem, and my approach
overview of the PE formatclassic tricksnew tricks
© ID software
PPortable EExecutable
CCommon OObject FFile FFormatbased on
PEuniversal universal Windows binaryWindows binarysince 1993
pe101pe101.corkami.com.corkami.com
the problem...
aka “the gentle guide to standard PEs”
CVE-2012-2273
version_mini
ibke
rnel
normal
...and my approach
block by block
a completecomplete executable
pepe.corkami.com.corkami.com
...call [API]…
Imports
PE
API: … ret
Exports
DLL
65535sects
maxsecXP
nosection*
1 ≤ FileAlignment == SectionAlignment ≤ 800
tiny*
foldedhdr
ctxt*ctxt*
★★NNeeww★★ tricks
mininormal64
dllnomain*
imports_virtdesc
dd OriginalFirstThunkdd TimeDateStampdd ForwarderChain----------------------------dd Namedd FirstThunk
corkamix
seh_change64
ibreloc
fakerelocs
reloccrypt
reloccrypt
reloccrypt
maxvals
hdrcode
traceless
tinynet
PE
...imports
...
...
...
...
...
...
...
...
...
...
...
...
...
...
.NET
...
...
...
...
...relocs
...
...
...
...
...
...
...
...CLR
...
quine
corkamix
Conclusion
Conclusion● the Windows executable format is complex● mostly covered, but many little traps
● new discoveries every day :(
http://pe101.corkami.comhttp://pe.corkami.com
Questions?Thanks to
Fabian Sauter, Peter Ferrie, وليد عصرBernhard Treutwein, Costin Ionescu, Deroko, Ivanlef0u, Kris Kaspersky, Moritz Kroll, Thomas Siebert, Tomislav Peričin, Kris McConkey, Lyr1k, Gunther, Sergey Bratus, frank2, Ero Carrera, Jindřich Kubec, Lord Noteworthy, Mohab Ali, Ashutosh Mehra, Gynvael Coldwind, Nicolas Ruff, Aurélien Lebrun, Daniel Plohmann, Gorka Ramírez, 최진영 , Adam Błaszczyk, 板橋一正 , Gil Dabah, Juriaan Bremer, Bruce Dang, Mateusz Jurczyk, Markus Hinderhofer, Sebastian Biallas, Igor Skochinsky, Ильфак Гильфанов, Alex Ionescu, Alexander Sotirov, Cathal Mullaney
Thank YOU!
@ange4771@ange4771Ange Albertini @gmail.com
http://corkami.com
exe2pe, dosZMXP
aa86drop.com
![X10 Tester - · PDF fileX10_Tester.can Page 3 of 128. 151 BYTE hasToSendWriteColumnConfig = 0; 152 BYTE hasToSendWriteColumnDefault = 0; 153 154 BYTE StartLogicControl[6]; 155 BYTE](https://static.fdocuments.us/doc/165x107/5aa9f1037f8b9a9a188d968e/x10-tester-page-3-of-128-151-byte-hastosendwritecolumnconfig-0-152-byte-hastosendwritecolumndefault.jpg)
