{"id":525,"date":"2013-10-03T04:22:20","date_gmt":"2013-10-03T04:22:20","guid":{"rendered":"http:\/\/www.gironsec.com\/blog\/?p=525"},"modified":"2013-10-03T04:22:20","modified_gmt":"2013-10-03T04:22:20","slug":"happy-wednesday","status":"publish","type":"post","link":"https:\/\/www.gironsec.com\/blog\/2013\/10\/happy-wednesday\/","title":{"rendered":"Happy Wednesday!"},"content":{"rendered":"

Hello again!<\/p>\n

It’s been a busy week at work. Lots of unique malware. As you may or may not know, malware uses non-conventional things to stay hidden and throw off heuristic analysis. <\/p>\n

I see weird stuff. Instructions that make no sense in context like the ‘out’ instruction, blocks of code which perform floating point arithmetic for no reason other than to do it. <\/p>\n

I see this on a daily basis. Weird opcodes, memory packing, wacky logic, etc. This week I was unpacking a program that did the usual ‘store everything in the data section then virtualquery \/ run’ trick. But it was wacky confusing. After unpacking, the binary was different – different md5 \/ larger, but it looked the same in IDA and immunity. I unpacked it again several more times only to realize the program was making a copy of itself and storing it in the same location I unpacked it from, except it was setting a breakpoint before calling itself. I determined this had something to do with the OpenProcess call which was skipped at the program’s startup, then I lost interest.<\/p>\n

How do they do it? They have more time on their hands.<\/p>\n

So what did I learn today? I learned how to get the same weird opcodes into my programs even if my compiler throws a shit-fit. <\/p>\n

When I tried with my compiler (Pelles C compiler), it said it couldn’t find the opcode.
\n\"why<\/a>
\nSolution? Hex editor!<\/p>\n

Compile your program, inline a nop sled or something easy to identify, then find \/ replace.
\n\"why<\/a>
\nIn this case, I am doing several int3 interrupts RDTSC instructions in a row (0xCC & 0x0F,0x31).
\nAnd now we look in the hex editor for the op codes CC 0f 31.
\n\"why<\/a>
\nSee it?
\nNow what we do is replace the op codes with the ones the compiler didn’t allow us to add and nop out the rest.
\nI did this to force insert the icebp (int01) break point into my program. Its an undocumented op code which does a breakpoint without setting the trap flag.
\n\"tadaa\"<\/a>
\nSave and we’re good.
\nThere are plenty of instructions out there to mess with. Using this crude method, I can force my instructions into my programs without the compiler giving me shit. <\/p>\n

Bye bye for now!
\n\"mfw\"<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

Hello again! It’s been a busy week at work. Lots of unique malware. As you may or may not know, malware uses non-conventional things to stay hidden and throw off heuristic analysis. I see weird stuff. Instructions that make no sense in context like the ‘out’ instruction, blocks of code which perform floating point arithmetic […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[4,5],"tags":[3],"_links":{"self":[{"href":"https:\/\/www.gironsec.com\/blog\/wp-json\/wp\/v2\/posts\/525"}],"collection":[{"href":"https:\/\/www.gironsec.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.gironsec.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.gironsec.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.gironsec.com\/blog\/wp-json\/wp\/v2\/comments?post=525"}],"version-history":[{"count":3,"href":"https:\/\/www.gironsec.com\/blog\/wp-json\/wp\/v2\/posts\/525\/revisions"}],"predecessor-version":[{"id":533,"href":"https:\/\/www.gironsec.com\/blog\/wp-json\/wp\/v2\/posts\/525\/revisions\/533"}],"wp:attachment":[{"href":"https:\/\/www.gironsec.com\/blog\/wp-json\/wp\/v2\/media?parent=525"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.gironsec.com\/blog\/wp-json\/wp\/v2\/categories?post=525"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.gironsec.com\/blog\/wp-json\/wp\/v2\/tags?post=525"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}