.NET ReversingThe Framework, the Myth, the Legend
(waffle edition)
What I do have are a very particular set of skills• I do appsec for financial companies • Not a consultant• Not here on behalf of any employer
• Wrote my first app in Qbasic• Microsoft 4 lyfe wut wut
• Curator of securityreactions.tumblr.com• Staring at the sun made me crazy
Why .NET?
Current state of Java security
Pool’s closed
Source: http://www.veracode.com/blog/2013/04/the-history-of-programming-languages-infographic/
.NET – Common Language Infrastructure
Common Language Infrastructure
Thanks, Wikipedia
Common Intermediate Language private void button1_Click(object sender, EventArgs e) { MessageBox.Show("I am in a hell of my own creation"); }
.method private hidebysig instance void button1_Click ( object sender, class [mscorlib]System.EventArgs e ) cil managed { // Method begins at RVA 0x221f // Code size 13 (0xd) .maxstack 8
IL_0000: nop IL_0001: ldstr "I am in a hell of my own creation" IL_0006: call valuetype [System.Windows.Forms]System.Windows.Forms.DialogResult [System.Windows.Forms]System.Windows.Forms.MessageBox::Show(string) IL_000b: pop IL_000c: ret } // end of method Form1::button1_Click
.NET PE File Format
PE Format - Metadata Streams• #~ (metadata stream)
• Predefined content and structure• Contains types, methods, fields, properties and events
• #Strings• Namespace, type, and member names
• #US (user string heap)• All strings embedded in source
• #GUID• Unique identifier
• #Blob (binary data heap)• Method signatures, generic instantiations
The #~ Stream: Metadata Tables• 0×2: TypeDef• 0×4: FieldDef• 0×6: MethodDef• 0×14: EventDef• 0×17: PropertyDef
• Types, fields, methods, events and properties
• 0×1: TypeRef• Referenced types defined in other
assemblies
• 0xa: MemberRef• Referenced members of types defined in
other assemblies.
• 0×9: InterfaceImpl• Defined types and the interfaces that type
implements
• 0xc: CustomAttribute• Info on attributes applied to elements in the
assembly
• 0×18: MethodSemantics• Links properties and events with the methods
that comprise the get/set or add/remove methods of the property or method.
• 0x1b: TypeSpec• 0x2b: MethodSpec
• Instantiations of generic types and methods
Browsing a .NET PE: CFF Explorer
#~: MethodDef tables
#Str
ings
Tabl
es
I Love Belgium This Much
I heard you like mudkips obfuscators
String Encryption X X X XDependency Merging X XMethod Parent Obfuscation XControl Flow Obfuscation X X X XFilthy Tramp XSymbol Renaming X X XTamper Detection X X XResource Encryption X X XAssembly Encryption X
:(
:|
…I’ll just leave this here
Overcoming Obfuscation• Symbol Renaming• Not possible if the original symbols are not in the assembly• Can convert unprintable names to something resembling English
• Decryption• Removal of proxy code / junk classes• Removal of tamper detection• Move methods back to their original classes• “Sometimes, dead is better.”
Proof of Concept: Reversing Reflector
Goal: Add new functionality to existing binary• To Do:• Remove strong name singing to permit modification • Identify where toolbar is created and icons defined
• Create new icon • Locate event handler for icon click event
• Create new event handler• Inject DLL containing our new functionality
• Have our new event handler reference this code
Strong Name Signing
Locating toolbar
Adding new toolbar icon: Injecting IL
Toolbar, continued: new IL IL_01ae: ldarg.0 IL_01af: ldarg.1 IL_01b0: call class [System.Drawing]System.Drawing.Image ns36.Class476::get_Nyan() IL_01b5: ldstr "Nyan!" IL_01ba: ldc.i4.0 IL_01bb: ldstr "Application.Nyan" IL_01c0: call instance void ns30.Class269::method_29(class Reflector.ICommandBar, class [System.Drawing]System.Drawing.Image, string, valuetype [System.Windows.Forms]System.Windows.Forms.Keys, string) IL_01c5: ldarg.1 IL_01c6: callvirt instance class Reflector.ICommandBarItemCollection Reflector.ICommandBar::get_Items() IL_01cb: callvirt instance class Reflector.ICommandBarSeparator Reflector.ICommandBarItemCollection::AddSeparator() IL_01d0: pop
Toolbar continued: M
odifying inline resource
Locating event handler
private void method_26(ICommandBar toolBar) { if (toolBar != null) {
Class511 typedService = (Class511) this.GetTypedService<ILanguageManager>(); this.method_29(toolBar, Class476.Back, "&Back", Keys.Alt | Keys.Left, "AssemblyBrowser.GoBack"); toolBar.Items.AddSeparator(); this.method_29(toolBar, Class476.Open, "&Open...", Keys.Control | Keys.O, "Application.OpenFile"); … toolBar.Items.AddSeparator(); this.method_29(toolBar, Class476.Nyan, "Nyan!", Keys.None, "Application.Nyan"); toolBar.Items.AddSeparator(); }
Event handler, continuedpublic void Execute(string commandName) {
string key = commandName; if (key != null) {
int num; if (Class722.dictionary_4 == null) {
Dictionary<string, int> dictionary1 = new Dictionary<string, int>(0x10);
dictionary1.Add("Application.OpenFile", 0); dictionary1.Add("Application.OpenCache", 1); dictionary1.Add("Application.OpenList", 2); dictionary1.Add("Application.CloseFile", 3);
…Class722.dictionary_4 = dictionary1;
} if (Class722.dictionary_4.TryGetValue(key, out num)) {
switch (num) { case 0: this.method_45(); break; case 1: this.method_46(); break; case 2: this.method_47(); break;
…
}
Adding IL to Execute()
IL_00c1: ldc.i4.s 13 IL_00c3: call instance void class [mscorlib]System.Collections.Generic.Dictionary`2<string, int32>::Add(!0, !1) IL_00c8: dup IL_00c9: ldstr "Application.Deactivate" IL_00ce: ldc.i4.s 14 IL_00d0: call instance void class [mscorlib]System.Collections.Generic.Dictionary`2<string, int32>::Add(!0, !1) IL_00d5: dup IL_00d6: ldstr "Application.Nyan" IL_00db: ldc.i4.s 15 IL_00dd: call instance void class [mscorlib]System.Collections.Generic.Dictionary`2<string, int32>::Add(!0, !1)
… IL_01b8: ldarg.0 IL_01b9: call instance void ns30.Class269::method_65() IL_01be: leave.s IL_01c8
IL_01c0: ldarg.0 IL_01c1: call instance void ns30.Class269::nyan() IL_01c6: leave.s IL_01c8
Creating ns30.Class269::nyan()
ns30.Class269::nyan() CIL.method private hidebysig instance void nyan () cil managed {
.maxstack 8
IL_0000: newobj instance void [derp]derp.hurr::.ctor() IL_0005: callvirt instance void [derp]derp.hurr::showForm() IL_000a: ret
private void nyan(){ new hurr().showForm();}
Where are these classes implemented?
Adding new DLL to Reflector
…aaaaaand we’re done
Let’s launch it.
References and Resources• Anatomy of a .NET Assembly
• https://www.simple-talk.com/blogs/2011/03/16/anatomy-of-a-net-assembly-clr-metadata-1/
• CFF Explorer – PE Browser• http://www.ntcore.com/exsuite.php
• ILSpy Decompiler• http://ilspy.net/
• RedGate (SmartAssembly, Reflector, Obfuscation Checker)• http://www.red-gate.com/products/dotnet-development/
• Reflexil – RedGate plugin for CIL injection• http://reflexil.net/
• CodeSearch – RedGate plugin, does what it says• http://reflectoraddins.codeplex.com/wikipage?title=CodeSearch
• De4dot Deobfuscator• https://bitbucket.org/0xd4d/de4dot/
Questions?
• Twitter: @aloria• Email: [email protected]• Blog: http://jukt-micronics.com
Special thanks to: AP, CS, CV, BN, DDZ, EK, RL, SR, ZC, ZL and the fine folks at CompuServe for inventing GIF89a