The Witchcraft Compiler Collection : Towards Self Aware Computer Programs - Archive ouverte HAL
Communication Dans Un Congrès Année : 2016

The Witchcraft Compiler Collection : Towards Self Aware Computer Programs

Jonathan Brossard

Résumé

With this presentation, we take a new approach to reverse engineering. Instead of attempting to decompile code, we seek to undo the work of the linker and produce relocatable files, the typical output of a compiler. The main benefit of the later technique over the former being that it does work. Once achieved universal code 'reuse' by relinking those relocatable objects as arbitrary shared libraries, we'll create a form of binary reflection, add scripting capabilities and in memory debugging using a JIT compiler, to attain automated API prototyping and annotation, which, we will argue, constitutes a primary form of binary code self awareness. Finally, we'll see how abusing the dynamic linker internals shall elegantly solve a number of complex tasks for us, such as calling a given function within a binary without having to craft a valid input to reach it. The applications in terms of vulnerability exploitation, functional testing, static analysis validation and more generally computer wizardry being tremendous, we'll have fun demoing some new exploits in real life applications, and commit public program profanity, such as turning PEs into ELFs, functional scripting of sshd in memory, stealing crypto routines without even disassembling them, among other things that were never supposed to work. All the above techniques have been implemented into the Wichcraft Compiler Collection, to be released as proper open source software (MIT/BSD-2 licenses).
Fichier principal
Vignette du fichier
Jonathan_Brossard_Blackhat_2016_Witchcraft-Compiler-Collection_User_Manual.pdf (1.18 Mo) Télécharger le fichier
Origine Fichiers produits par l'(les) auteur(s)
Licence

Dates et versions

hal-04676821 , version 1 (24-08-2024)

Licence

Identifiants

  • HAL Id : hal-04676821 , version 1

Citer

Jonathan Brossard. The Witchcraft Compiler Collection : Towards Self Aware Computer Programs. Blackhat Briefings (UK) 2016, Blackhat, Nov 2016, London, United Kingdom. ⟨hal-04676821⟩
17 Consultations
10 Téléchargements

Partager

More