Malware Analysis with OllyDbg: A Practical Approach
Malware Incident Response
Malware Incident Response
Dynamic Analysis - 2
Dynamic Analysis - 2
CIS 6395, Incident Response Technologies
Fall 2021, Dr. Cliff Zou
czou@cs.ucf.edu
Acknowledgement
Javier Nieto Hacking Blog:
◦
http://www.behindthefirewalls.com/2013/11/hacklu-
capturing-flag-v10.html
Slides from book:
◦
https://samsclass.info/126/ppt/ch8.ppt
Windows Malware Dynamic
Analysis using OllyDbg
Debugger: OllyDbg
http://ollydbg.de/
Purpose
◦
OllyDbg is a general purpose win32 user-mode
debugger. The great thing about it is the
intuitive UI and powerful disassembler
Licensing
◦
OllyDbg is free (shareware), however it is not
open source and the source code is not
available
We will use OllyDbg 1.10 version
Disassemblers v. Debuggers
A disassembler like ‘IDA Pro’ or
‘PEBrowse Professional’ shows the state
of the program just before execution
begins
Debuggers show
◦
Every memory location
◦
Register
◦
Argument to every function
At any point during processing
◦
And let you change them
Two Debuggers
Ollydbg
◦
Most popular for malware analysis
◦
User-mode debugging only
◦
IDA Pro has a built-in debugger, but it's not as
easy to use or powerful as Ollydbg
Windbg
◦
Supports kernel-mode debugging
Case Study:
Hack.lu - Capturing the flag V.1.0
Using Ollydbg to solve half of the puzzle:
◦
http://www.behindthefirewalls.com/2013/11/hacklu-capturing-flag-
v10.html
The competitors need to get two hard-coded passwords
of a program called RoboAuth.exe which can be
downloaded here:
◦
http://shell-storm.org/repo/CTF/Hacklu-2013/Reversing/RoboAuth-
150/RoboAuth.exe
In the above posting by Javier Nieto, he provided how to
find the first password using Ollydbg
Ollydbg Interface
D
i
s
a
s
s
e
m
b
l
e
r
Highlight: next instruction
to be executed
R
e
g
i
s
t
e
r
s
S
t
a
c
k
M
e
m
o
r
y
d
u
m
p
Run A Program Under OllyDbg
Load the .exe file, and click
“Debug”
“Run”
◦
The first “run” will start the
program to the first instruction,
but not actually run the program
On second click of “Run”, the
RoboAuth.exe executes and
asks us to input the first
password. Wrong input will
cause the program to
terminate.
Analyze A Binary Code Under
OllyDbg
A program may have many text outputs, they will give us
hint
Check ASCII strings in the assembly code
◦
look at "All referenced test strings" in order to find something
which draws attention.
◦
Right-click assembly
code window…
After you run the code
Find ASCII Output Interested
we can see the string "You passed level1!". We can
suppose that just before that, the assemble code will
compare our password with the real one.
Find Code for Password Testing
To go to this string in the assemble code, we right-click on
this line and select "Follow in Disassembler".
Two lines before that, we can see the function "TEST EAX, EAX"
◦
Test EAX, EAX
set ZF flag (zero flag) to 1 if EAX == 0
◦
JNZ addr
if ZF ==0, then jump to address of addr
One line above, “CALL…” must be the call to the subroutine
“strcmp()” to set EAX by comparing our password with the hard-
code password!
Check Memory in Runtime for Real
Password
Set a breaking point at this point in order to stop the
program just when the program is comparing the
passwords in order to see the good one in the Stack.
◦
Right click on the line which contains “CALL…", select Breakpoint
and select "Memory, on access“
Then click “Run” again to let program run and pause at
that breakpoint
14
Knowledge:
A Stack Frame Structure
Parameters
Return Address
Old Base Pointer
Local Variables
00000000
Addresses
SP
SP: stack pointer BP: base/frame
pointer
BP
All function calls use Stack memory for
operation
Thus, in strcmp() function call, the hard-code password and the guessed password we
typed must be the two string inputs
Sample
Stack
18
Addressof instruction (y=3)
saved stack pointer
buf
y
x
-- Main()--
x=2;
foo(18);
y=3;
void foo(int j) {int x,y;
char buf[100];
x=j;
…
}
Function: int strcmp(const char *str1, const char *str2)
Check Memory in Runtime for Real
Password
Write a password (distinct) and
wait until the program stops in the
breakpoint.
See the Stack window (bottom
right) in OllyDbg
◦
Shows the state of the stack in
memory for the thread being debugged.
◦
Below our password “######"
followed by other string "r0b0RUlez!".
It seems to be the password.
Test the Password Obtained
Run the RoboAuth.exe, test the first
password of "r0b0RUlez!”, It works!
Explore the fundamentals of malware analysis using OllyDbg, a user-mode debugger, for dynamic analysis. Learn how to dissect malicious code, analyze its behavior, and uncover hidden secrets within malware samples. Discover the powerful features of OllyDbg and its role in incident response and cybersecurity investigations.
Download Presentation
Please find below an Image/Link to download the presentation.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author. Download presentation by click this link. If you encounter any issues during the download, it is possible that the publisher has removed the file from their server.
E N D
Presentation Transcript
Malware Incident Response Dynamic Analysis - 2 CIS 6395, Incident Response Technologies Fall 2021, Dr. Cliff Zou czou@cs.ucf.edu
Acknowledgement Javier Nieto Hacking Blog: http://www.behindthefirewalls.com/2013/11/hacklu- capturing-flag-v10.html Slides from book: https://samsclass.info/126/ppt/ch8.ppt
Windows Malware Dynamic Analysis using OllyDbg
Debugger: OllyDbg http://ollydbg.de/ Purpose OllyDbg is a general purpose win32 user-mode debugger. The great thing about it is the intuitive UI and powerful disassembler Licensing OllyDbg is free (shareware), however it is not open source and the source code is not available We will use OllyDbg 1.10 version
Disassemblers v. Debuggers A disassembler like IDA Pro or PEBrowse Professional shows the state of the program just before execution begins Debuggers show Every memory location Register Argument to every function At any point during processing And let you change them
Two Debuggers Ollydbg Most popular for malware analysis User-mode debugging only IDA Pro has a built-in debugger, but it's not as easy to use or powerful as Ollydbg Windbg Supports kernel-mode debugging
Case Study: Hack.lu - Capturing the flag V.1.0 Using Ollydbg to solve half of the puzzle: http://www.behindthefirewalls.com/2013/11/hacklu-capturing-flag- v10.html The competitors need to get two hard-coded passwords of a program called RoboAuth.exe which can be downloaded here: http://shell-storm.org/repo/CTF/Hacklu-2013/Reversing/RoboAuth- 150/RoboAuth.exe In the above posting by Javier Nieto, he provided how to find the first password using Ollydbg
Ollydbg Interface Disassembler Highlight: next instruction to be executed Registers Memory dump Stack
Run A Program Under OllyDbg Load the .exe file, and click Debug Run The first run will start the program to the first instruction, but not actually run the program On second click of Run , the RoboAuth.exe executes and asks us to input the first password. Wrong input will cause the program to terminate.
Analyze A Binary Code Under OllyDbg A program may have many text outputs, they will give us hint Check ASCII strings in the assembly code look at "All referenced test strings" in order to find something which draws attention. Right-click assembly code window After you run the code
Find ASCII Output Interested we can see the string "You passed level1!". We can suppose that just before that, the assemble code will compare our password with the real one.
Find Code for Password Testing To go to this string in the assemble code, we right-click on this line and select "Follow in Disassembler". Two lines before that, we can see the function "TEST EAX, EAX" Test EAX, EAX set ZF flag (zero flag) to 1 if EAX == 0 JNZ addr if ZF ==0, then jump to address of addr One line above, CALL must be the call to the subroutine strcmp() to set EAX by comparing our password with the hard- code password!
Check Memory in Runtime for Real Password Set a breaking point at this point in order to stop the program just when the program is comparing the passwords in order to see the good one in the Stack. Right click on the line which contains CALL ", select Breakpoint and select "Memory, on access Then click Run again to let program run and pause at that breakpoint
Knowledge: A Stack Frame Structure All function calls use Stack memory for operation Parameters Return Address Old Base Pointer Local Variables BP SP Addresses 00000000 SP: stack pointer BP: base/frame pointer 14
18 Addressof instruction (y=3) saved stack pointer buf y x Sample Stack -- Main()-- x=2; foo(18); y=3; void foo(int j) { int x,y; char buf[100]; x=j; } Function: int strcmp(const char *str1, const char *str2) Thus, in strcmp() function call, the hard-code password and the guessed password we typed must be the two string inputs
Check Memory in Runtime for Real Password Write a password (distinct) and wait until the program stops in the breakpoint. See the Stack window (bottom right) in OllyDbg Shows the state of the stack in memory for the thread being debugged. Below our password ######" followed by other string "r0b0RUlez!". It seems to be the password.
Test the Password Obtained Run the RoboAuth.exe, test the first password of "r0b0RUlez! , It works!
