Understanding Malware Analysis with OllyDbg: A Practical Approach

Slide Note
Embed
Share

Explore the fundamentals of malware analysis using OllyDbg, a user-mode debugger, for dynamic analysis. Learn how to dissect malicious code, analyze its behavior, and uncover hidden secrets within malware samples. Discover the powerful features of OllyDbg and its role in incident response and cybersecurity investigations.

mirren
mirren Follow

Uploaded on Aug 05, 2024 | 0 Views

Download Presentation

Please find below an Image/Link to download the presentation.

The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author. Download presentation by click this link. If you encounter any issues during the download, it is possible that the publisher has removed the file from their server.

E N D

Presentation Transcript

  1. Malware Incident Response Dynamic Analysis - 2 CIS 6395, Incident Response Technologies Fall 2021, Dr. Cliff Zou czou@cs.ucf.edu

  2. Acknowledgement Javier Nieto Hacking Blog: http://www.behindthefirewalls.com/2013/11/hacklu- capturing-flag-v10.html Slides from book: https://samsclass.info/126/ppt/ch8.ppt

  3. Windows Malware Dynamic Analysis using OllyDbg

  4. Debugger: OllyDbg http://ollydbg.de/ Purpose OllyDbg is a general purpose win32 user-mode debugger. The great thing about it is the intuitive UI and powerful disassembler Licensing OllyDbg is free (shareware), however it is not open source and the source code is not available We will use OllyDbg 1.10 version

  5. Disassemblers v. Debuggers A disassembler like IDA Pro or PEBrowse Professional shows the state of the program just before execution begins Debuggers show Every memory location Register Argument to every function At any point during processing And let you change them

  6. Two Debuggers Ollydbg Most popular for malware analysis User-mode debugging only IDA Pro has a built-in debugger, but it's not as easy to use or powerful as Ollydbg Windbg Supports kernel-mode debugging

  7. Case Study: Hack.lu - Capturing the flag V.1.0 Using Ollydbg to solve half of the puzzle: http://www.behindthefirewalls.com/2013/11/hacklu-capturing-flag- v10.html The competitors need to get two hard-coded passwords of a program called RoboAuth.exe which can be downloaded here: http://shell-storm.org/repo/CTF/Hacklu-2013/Reversing/RoboAuth- 150/RoboAuth.exe In the above posting by Javier Nieto, he provided how to find the first password using Ollydbg

  8. Ollydbg Interface Disassembler Highlight: next instruction to be executed Registers Memory dump Stack

  9. Run A Program Under OllyDbg Load the .exe file, and click Debug Run The first run will start the program to the first instruction, but not actually run the program On second click of Run , the RoboAuth.exe executes and asks us to input the first password. Wrong input will cause the program to terminate.

  10. Analyze A Binary Code Under OllyDbg A program may have many text outputs, they will give us hint Check ASCII strings in the assembly code look at "All referenced test strings" in order to find something which draws attention. Right-click assembly code window After you run the code

  11. Find ASCII Output Interested we can see the string "You passed level1!". We can suppose that just before that, the assemble code will compare our password with the real one.

  12. Find Code for Password Testing To go to this string in the assemble code, we right-click on this line and select "Follow in Disassembler". Two lines before that, we can see the function "TEST EAX, EAX" Test EAX, EAX set ZF flag (zero flag) to 1 if EAX == 0 JNZ addr if ZF ==0, then jump to address of addr One line above, CALL must be the call to the subroutine strcmp() to set EAX by comparing our password with the hard- code password!

  13. Check Memory in Runtime for Real Password Set a breaking point at this point in order to stop the program just when the program is comparing the passwords in order to see the good one in the Stack. Right click on the line which contains CALL ", select Breakpoint and select "Memory, on access Then click Run again to let program run and pause at that breakpoint

  14. Knowledge: A Stack Frame Structure All function calls use Stack memory for operation Parameters Return Address Old Base Pointer Local Variables BP SP Addresses 00000000 SP: stack pointer BP: base/frame pointer 14

  15. 18 Addressof instruction (y=3) saved stack pointer buf y x Sample Stack -- Main()-- x=2; foo(18); y=3; void foo(int j) { int x,y; char buf[100]; x=j; } Function: int strcmp(const char *str1, const char *str2) Thus, in strcmp() function call, the hard-code password and the guessed password we typed must be the two string inputs

  16. Check Memory in Runtime for Real Password Write a password (distinct) and wait until the program stops in the breakpoint. See the Stack window (bottom right) in OllyDbg Shows the state of the stack in memory for the thread being debugged. Below our password ######" followed by other string "r0b0RUlez!". It seems to be the password.

  17. Test the Password Obtained Run the RoboAuth.exe, test the first password of "r0b0RUlez! , It works!

Related


Top Malware Protection Services in Dallas - Keep Your Business Safe

Top Malware Protection Services in Dallas - Keep Your Business Safe

Black
Understanding Malware: Types, Risks, and Prevention

Understanding Malware: Types, Risks, and Prevention

andi
Understanding Malware: Types, Usage, and Protection

Understanding Malware: Types, Usage, and Protection

zipporah
Understanding Malware: Definitions and Types

Understanding Malware: Definitions and Types

azel963
Understanding Malicious Software and Its Impact on Computer Systems

Understanding Malicious Software and Its Impact on Computer Systems

bess_wyn
Comprehensive Malware Analysis Techniques

Comprehensive Malware Analysis Techniques

kerschner_l
Understanding Malware and Computer Security

Understanding Malware and Computer Security

cwirk
Malware Dynamic Analysis Part 6 Overview

Malware Dynamic Analysis Part 6 Overview

couillard_n
Understanding Malware: Types, Symptoms, and Countermeasures

Understanding Malware: Types, Symptoms, and Countermeasures

kennade
Understanding Malware Execution and DLLs in IDA

Understanding Malware Execution and DLLs in IDA

pent_vi
Understanding Malicious Software in Computer Security

Understanding Malicious Software in Computer Security

kendallw
Understanding Malware: Types, Risks, and Removal Methods

Understanding Malware: Types, Risks, and Removal Methods

pron
Understanding Malware Analysis Using Cuckoo Sandbox

Understanding Malware Analysis Using Cuckoo Sandbox

ash_g
Context-Aware Malware Detection Using GANs in Signal Systems

Context-Aware Malware Detection Using GANs in Signal Systems

sart_an
Analyzing Android Applications for Malware Detection

Analyzing Android Applications for Malware Detection

mare117
Understanding Malware: Types, Risks, and Prevention

Understanding Malware: Types, Risks, and Prevention

lkmy
MapReduce Method for Malware Detection in Parallel Systems

MapReduce Method for Malware Detection in Parallel Systems

zaer318
Evaluating Android Anti-malware Against Transformation Attacks

Evaluating Android Anti-malware Against Transformation Attacks

nady
Understanding Computer System Security Threats and Malware Types at Eshan College of Engineering

Understanding Computer System Security Threats and Malware Types at Eshan College of Engineering

balbuena_c
Exploring SMT Solvers for Malware Unpacking

Exploring SMT Solvers for Malware Unpacking

ray_904
Analysis of Mixed-Mode Malware and Malware Analysis Tools

Analysis of Mixed-Mode Malware and Malware Analysis Tools

mac_h
Introduction to Malware Reverse Engineering

Introduction to Malware Reverse Engineering

joel_708

More Related Content