Introduction to the Witchcraft Compiler Collection - Archive ouverte HAL
Communication Dans Un Congrès Année : 2016

Introduction to the Witchcraft Compiler Collection

Jonathan Brossard

Résumé

With this presentation, we take a new approach to reverse engineering. Instead of attempting to decompile code, we seek to undo the work of the linker and produce relocatable files, the typical output of a compiler. The main benefit of the later technique over the former being that it does work. Once achieved universal code ‘reuse’ by relinking those relocatable objects as arbitrary shared libraries, we'll create a form of binary reflection, add scripting capabilities and in memory debugging using a JIT compiler, to attain automated API prototyping and annotation, which, we will argue, constitutes a primary form of binary code self-awareness. Finally, we'll see how abusing the dynamic linker internals shall elegantly solve a number of complex tasks for us, such as calling a given function within a binary without having to craft a valid input to reach it. The applications in terms of vulnerability exploitation, functional testing, static analysis validation and more generally computer wizardry being tremendous, we'll have fun demoing some new exploits in real life applications, and commit public program profanity, such as turning PEs into ELFs, functional scripting of sshd in memory, stealing crypto routines without even disassembling them, among other things that were never supposed to work. All the above techniques have been implemented into the Wichcraft Compiler Collection, released as open source software (MIT/BSD-2 licenses).
Jonathan_Brossard_DEFCON_24_Introduction-to-the-Witchcraft-Compiler-Collection.pdf (4.75 Mo) Télécharger le fichier
Origine Fichiers produits par l'(les) auteur(s)

Dates et versions

hal-04672194 , version 1 (17-08-2024)

Identifiants

  • HAL Id : hal-04672194 , version 1

Citer

Jonathan Brossard. Introduction to the Witchcraft Compiler Collection. DEFCON 24, DEFCON, Aug 2016, Las Vegas, United States. ⟨hal-04672194⟩
20 Consultations
5 Téléchargements

Partager

More