Practical Reverse Engineering on soffensive blog

Practical Reverse Engineering Exercise Solutions: Page 79 / Exercise 11

Thu, 07 Dec 2017 10:29:00 -0800

Exercise 11 on page 79 of the book Practical Reverse Engineering specifies the following ARM disassembly of a function called mystery11 - the last exercise of the ARM chapter:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52


01: 010185B0 mystery11
02: 010185B0 2D E9 F8 4F PUSH.W {R3–R11,LR}
03: 010185B4 0D F2 20 0B ADDW R11, SP, #0x20
04: 010185B8 B0 F9 5A 30 LDRSH.W R3, [R0,#0x5A]
05: 010185BC 07 46 MOV R7, R0
06: 010185BE 90 46 MOV R8, R2
07: 010185C0 00 EB 83 03 ADD.W R3, R0, R3,LSL#2
08: 010185C4 D3 F8 84 A0 LDR.W R10, [R3,#0x84]
09: 010185C8 7B 8F LDRH R3, [R7,#0x3A]
10: 010185CA 89 46 MOV R9, R1
11: 010185CC CB B9 CBNZ R3, loc_1018602
12: 010185CE B0 F9 5A 40 LDRSH.W R4, [R0,#0x5A]
13: 010185D2 17 F1 20 02 ADDS.W R2, R7, #0x20
14: 010185D6 00 EB 44 03 ADD.W R3, R0, R4,LSL#1
15: 010185DA B3 F8 5C 50 LDRH.W R5, [R3,#0x5C]
16: 010185DE 00 EB 84 03 ADD.W R3, R0, R4,LSL#2
17: 010185E2 D3 F8 84 00 LDR.W R0, [R3,#0x84]
18: 010185E6 83 89 LDRH R3, [R0,#0xC]
19: 010185E8 06 6C LDR R6, [R0,#0x40]
20: 010185EA 03 EB 45 03 ADD.W R3, R3, R5,LSL#1
21: 010185EE 9B 19 ADDS R3, R3, R6
22: 010185F0 1C 78 LDRB R4, [R3]
23: 010185F2 5B 78 LDRB R3, [R3,#1]
24: 010185F4 43 EA 04 24 ORR.W R4, R3, R4,LSL#8
25: 010185F8 43 8A LDRH R3, [R0,#0x12]
26: 010185FA 23 40 ANDS R3, R4
27: 010185FC 99 19 ADDS R1, R3, R6
28: 010185FE FD F7 8D FF BL sub_101651C

29: 01018602 loc_1018602
30: 01018602 BA 8E LDRH R2, [R7,#0x34]
31: 01018604 BB 6A LDR R3, [R7,#0x28]
32: 01018606 D0 18 ADDS R0, R2, R3
33: 01018608 9A F8 02 30 LDRB.W R3, [R10,#2]
34: 0101860C 0B B1 CBZ R3, loc_1018612
35: 0101860E 00 22 MOVS R2, #0
36: 01018610 00 E0 B loc_1018614

37: 01018612 loc_1018612
38: 01018612 3A 6A LDR R2, [R7,#0x20]

39: 01018614 loc_1018614
40: 01018614 FB 8E LDRH R3, [R7,#0x36]
41: 01018616 B8 F1 00 0F CMP.W R8, #0
42: 0101861A 01 D0 BEQ loc_1018620
43: 0101861C 80 18 ADDS R0, R0, R2
44: 0101861E 9B 1A SUBS R3, R3, R2

45: 01018620 loc_1018620
46: 01018620 C9 F8 00 30 STR.W R3, [R9]
47: 01018624 BD E8 F8 8F POP.W {R3–R11,PC}
48: 01018624 ; End of function mystery11

According to the exercise description, the called subroutine sub_101651C in line 28 takes three arguments and does not return anything. Thus, we know the registers R0, R1 and R2 are prepared and passed to the function.

Practical Reverse Engineering Exercise Solutions: Page 79 / Exercise 10

Wed, 06 Dec 2017 06:19:00 -0800

Exercise 10 on page 79 of the book Practical Reverse Engineering specifies the following ARM disassembly of a function called mystery10:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65


01: mystery10
02: 2D E9 70 48 PUSH.W {R4–R6,R11,LR}
03: 0D F2 0C 0B ADDW R11, SP, #0xC
04: 37 F0 CC F9 BL __security_push_cookie
05: 84 B0 SUB SP, SP, #0x10
06: 0D 46 MOV R5, R1
07: 00 24 MOVS R4, #0
08: 10 2D CMP R5, #0x10
09: 16 46 MOV R6, R2
10: 0C D3 BCC loc_1010786
11: 1A 4B LDR R3, =__imp_GetSystemTime
12: 68 46 MOV R0, SP
13: 1B 68 LDR R3, [R3]
14: 98 47 BLX R3
15: 00 9B LDR R3, [SP,#0x1C+var_1C]
16: 10 24 MOVS R4, #0x10
17: 33 60 STR R3, [R6]
18: 01 9B LDR R3, [SP,#0x1C+var_18]
19: 73 60 STR R3, [R6,#4]
20: 02 9B LDR R3, [SP,#0x1C+var_14]
21: B3 60 STR R3, [R6,#8]
22: 03 9B LDR R3, [SP,#0x1C+var_10]
23: F3 60 STR R3, [R6,#0xC]

24: loc_1010786
25: 2B 1B SUBS R3, R5, R4
26: 04 2B CMP R3, #4
27: 04 D3 BCC loc_1010796
28: 11 4B LDR R3, =__imp_GetCurrentProcessId
29: 1B 68 LDR R3, [R3]
30: 98 47 BLX R3
31: 30 51 STR R0, [R6,R4]
32: 04 34 ADDS R4, #4

33: loc_1010796
34: 2B 1B SUBS R3, R5, R4
35: 04 2B CMP R3, #4
36: 04 D3 BCC loc_10107A6
37: 0C 4B LDR R3, =__imp_GetTickCount
38: 1B 68 LDR R3, [R3]
39: 98 47 BLX R3
40: 30 51 STR R0, [R6,R4]
41: 04 34 ADDS R4, #4

42: loc_10107A6
43: 2B 1B SUBS R3, R5, R4
44: 08 2B CMP R3, #8
45: 09 D3 BCC loc_10107C0
46: 07 4B LDR R3, =__imp_QueryPerformanceCounter
47: 68 46 MOV R0, SP
48: 1B 68 LDR R3, [R3]
49: 98 47 BLX R3
50: 00 9B LDR R3, [SP,#0x1C+var_1C]
51: 32 19 ADDS R2, R6, R4
52: 33 51 STR R3, [R6,R4]
53: 01 9B LDR R3, [SP,#0x1C+var_18]
54: 08 34 ADDS R4, #8
55: 53 60 STR R3, [R2,#4]

56: loc_10107C0
57: 20 46 MOV R0, R4
58: 04 B0 ADD SP, SP, #0x10
59: 37 F0 A4 F9 BL __security_pop_cookie
60: BD E8 70 88 POP.W {R4–R6,R11,PC}
61: ; End of function mystery10

Although the function looks complicated at first, we notice it does not contain any kind of loops and only executes sequentially with a couple of conditionals.

Practical Reverse Engineering Exercise Solutions: Page 79 / Exercise 9

Tue, 05 Dec 2017 06:47:00 -0800

Exercise 9 on page 79 of the book Practical Reverse Engineering specifies the following ARM disassembly of a function called mystery9:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28


01: mystery9
02: 2D E9 30 48 PUSH.W {R4,R5,R11,LR}
03: 0D F2 08 0B ADDW R11, SP, #8
04: 09 4D LDR R5, =byteArray
05: 06 E0 B loc_100E312

06: loc_100E304
07: 0B 78 LDRB R3, [R1]
08: 5A 5D LDRB R2, [R3,R5]
09: 63 5D LDRB R3, [R4,R5]
10: 93 42 CMP R3, R2
11: 04 D1 BNE loc_100E318
12: 01 30 ADDS R0, #1
13: 01 31 ADDS R1, #1

14: loc_100E312
15: 04 78 LDRB R4, [R0]
16: 00 2C CMP R4, #0
17: F5 D1 BNE loc_100E304

18: loc_100E318
19: 0B 78 LDRB R3, [R1]
20: 5A 5D LDRB R2, [R3,R5]
21: 03 78 LDRB R3, [R0]
22: 5B 5D LDRB R3, [R3,R5]
23: 98 1A SUBS R0, R3, R2
24: BD E8 30 88 POP.W {R4,R5,R11,PC}
25: ; End of function mystery9

First of all, mystery9 has a striking similarity to the previously decompiled function mystery8. Its disassembly uses Thumb mode, as we can see for instance from the 16 bit instruction width.

Practical Reverse Engineering Exercise Solutions: Page 79 / Exercise 8

Tue, 05 Dec 2017 02:30:00 -0800

Exercise 8 on page 79 of the book Practical Reverse Engineering specifies the following ARM disassembly of a function called mystery8:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39


01: mystery8
02: 2D E9 78 48 PUSH.W {R3–R6,R11,LR}
03: 0D F2 10 0B ADDW R11, SP, #0x10
04: 0C 4E LDR R6, =byteArray
05: 09 E0 B loc_100E34C

06: loc_100E338
07: 05 78 LDRB R5, [R0]
08: 01 3A SUBS R2, #1
09: 4D B1 CBZ R5, loc_100E352
10: 0B 78 LDRB R3, [R1]
11: 9C 5D LDRB R4, [R3,R6]
12: AB 5D LDRB R3, [R5,R6]
13: A3 42 CMP R3, R4
14: 04 D1 BNE loc_100E352 
15: 01 30 ADDS R0, #1
16: 01 31 ADDS R1, #1

17: loc_100E34C
18: 00 2A CMP R2, #0
19: F3 DC BGT loc_100E338
20: 01 3A SUBS R2, #1

21: loc_100E352
22: 00 2A CMP R2, #0
23: 01 DA BGE loc_100E35A
24: 00 20 MOVS R0, #0
25: 04 E0 B locret_100E364

26: loc_100E35A
27: 0B 78 LDRB R3, [R1]
28: 9A 5D LDRB R2, [R3,R6]
29: 03 78 LDRB R3, [R0]
30: 9B 5D LDRB R3, [R3,R6]
31: 98 1A SUBS R0, R3, R2

32: locret_100E364
33: BD E8 78 88 POP.W {R3–R6,R11,PC}
34: ; End of function mystery8

The function was compiled in Thumb mode, as we can see from the presence of 16 bit instructions, PUSH and POP instructions and Thumb-specific instructions, e.g. CBZ and instructions with the .W suffix.

Practical Reverse Engineering Exercise Solutions: Page 79 / Exercise 7

Mon, 04 Dec 2017 06:14:00 -0800

Exercise 7 on page 79 of the book Practical Reverse Engineering specifies the following ARM disassembly of a function called mystery7:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21


01: mystery7
02: 02 46 MOV R2, R0
03: 08 B9 CBNZ R0, loc_100E1D8
04: 00 20 MOVS R0, #0
05: 70 47 BX LR 

06: loc_100E1D8
07: 90 F9 00 30 LDRSB.W R3, [R0]
08: 02 E0 B loc_100E1E4

09: loc_100E1DE
10: 01 32 ADDS R2, #1
11: 92 F9 00 30 LDRSB.W R3, [R2]

12: loc_100E1E4
13: 00 2B CMP R3, #0
14: FA D1 BNE loc_100E1DE
15: 10 1A SUBS R0, R2, R0
16: 6F F3 9F 70 BFC.W R0, #0x1E, #2
17: 70 47 BX LR
18: ; End of function mystery7

Again, the function provided is executed in Thumb mode, due to several 16 bit instructions and instructions specific to Thumb mode such as CBNZ and the .W suffix such as in line 7, 11 and 16.

Practical Reverse Engineering Exercise Solutions: Page 79 / Exercise 6

Mon, 04 Dec 2017 03:17:00 -0800

Exercise 6 on page 79 of the book Practical Reverse Engineering specifies the following ARM disassembly of a function called mystery6:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31


01: mystery6
02: 2D E9 18 48 PUSH.W {R3,R4,R11,LR}
03: 0D F2 08 0B ADDW R11, SP, #8
04: 04 68 LDR R4, [R0]
05: 00 22 MOVS R2, #0
06: 00 2C CMP R4, #0
07: 06 DD BLE loc_103B3B6

08: loc_103B3A8
09: 50 F8 04 3F LDR.W R3, [R0,#4]!
10: 8B 42 CMP R3, R1
11: 06 D0 BEQ loc_103B3BE
12: 01 32 ADDS R2, #1
13: A2 42 CMP R2, R4
14: F8 DB BLT loc_103B3A8

15: loc_103B3B6
16: 00 20 MOVS R0, #0
17: 00 21 MOVS R1, #0

18: locret_103B3BA
19: BD E8 18 88 POP.W {R3,R4,R11,PC}

20: loc_103B3BE
21: B2 F1 20 03 SUBS.W R3, R2, #0X20
22: 01 21 MOVS R1, #1
23: 99 40 LSLS R1, R3
24: 01 23 MOVS R3, #1
25: 13 FA 02 F0 LSLS.W R0, R3, R2
26: F5 E7 B locret_103B3BA
27: ; End of function mystery6

Due to the presence of 16 bit instructions, instructions having the .W suffix and function prologue and epilogue with PUSH and POP respectively, we are dealing with code in Thumb state.

Practical Reverse Engineering Exercise Solutions: Page 79 / Exercise 5

Sun, 03 Dec 2017 00:01:00 -0800

Exercise 5 on page 79 of the book Practical Reverse Engineering specifies the following ARM disassembly of a function called mystery5:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29


01: mystery5
02: 03 46 MOV R3, R0
03: 06 2B CMP R3, #6
04: 0D D0 BEQ loc_1032596
05: 07 2B CMP R3, #7
06: 09 D0 BEQ loc_1032592
07: 08 2B CMP R3, #8
08: 05 D0 BEQ loc_103258E
09: 09 2B CMP R3, #9
10: 01 D0 BEQ loc_103258A
11: 09 48 LDR R0, =aA ; "A"
12: 70 47 BX LR

13: loc_103258A
14: 07 48 LDR R0, =aB ; "B"
15: 70 47 BX LR

16: loc_103258E
17: 05 48 LDR R0, =ac ; "C"
18: 70 47 BX LR

19: loc_1032592
20: 03 48 LDR R0, =aD ; "D"
21: 70 47 BX LR 

22: loc_1032596
23: 01 48 LDR R0, =aE ; "E"
24: 70 47 BX LR
25: ; End of function mystery5

All instructions have a width of 16 bits, so we are dealing with code in Thumb state.

Practical Reverse Engineering Exercise Solutions: Page 79 / Exercise 4

Sat, 02 Dec 2017 05:21:00 -0800

Exercise 4 on page 79 of the book Practical Reverse Engineering specifies the following ARM disassembly of a function mystery4:

1
2
3
4
5
6
7
8


01: mystery4
02: 08 B9 CBNZ R0, loc_100C3DA
03: 00 20 MOVS R0, #0
04: 70 47 BX LR
05: loc_100C3DA
06: 50 F8 08 0C LDR.W R0, [R0,#–8] 
07: 70 47 BX LR
08: ; End of function mystery4

The disassembly is in Thumb mode, as there are instructions having a width of 16 bits and some instructions specific to this mode (e.g. CBNZ and the .W suffix).

Practical Reverse Engineering Exercise Solutions: Page 79 / Exercise 3

Sat, 02 Dec 2017 05:20:00 -0800

Exercise 3 on page 79 of the book Practical Reverse Engineering specifies the following ARM disassembly of a function mystery3:

1
2
3
4
5
6
7
8


01: mystery3
02: 83 68 LDR R3, [R0,#8]
03: 0B 60 STR R3, [R1]
04: C3 68 LDR R3, [R0,#0xC]
05: 00 20 MOVS R0, #0
06: 4B 60 STR R3, [R1,#4]
07: 70 47 BX LR
08: ; End of function mystery3

It is provided in Thumb mode, as we can see from the instruction width, which is consistently 16 bits. Furthermore, the decompilation is greatly facilitated thanks to the lack of any conditional statements. Any kind of NULL-checks, for instance, are omitted.

Practical Reverse Engineering Exercise Solutions: Page 78 / Exercise 2

Sat, 02 Dec 2017 04:40:00 -0800

Exercise 2 of the ARM chapter has a rather short disassembly compared to the first exercise. Again, we are tasked with the decompilation of the provided function mystery2.

The disassembly is as follows:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13


01: mystery2
02: 28 B1 CBZ R0, loc_C672

03: 90 F8 63 00 LDRB.W R0, [R0,#0x63]
04: 00 38 SUBS R0, #0
05: 18 BF IT NE
06: 01 20 MOVNE R0, #1
07: 70 47 BX LR

08: loc_C672
09: 01 20 MOVS R0, #1
10: 70 47 BX LR
11: ; End of function mystery2

First of all, we notice that the function has been compiled in Thumb mode, as there are several instructions having a width of 16 bits, which is not possible in ARM mode. Furthermore, the instructions CBZ and IT are specific to Thumb mode and not available in ARM mode.

Practical Reverse Engineering Exercise Solutions: Page 78 / Exercise 1

Fri, 01 Dec 2017 04:59:00 -0800

This is the first blog post to a series of ARM challenges from the book Practical Reverse Engineering. In addition to the official ARM manual, the following web page turned out to be very helpful when solving the exercises, as it describes the different ARM instructions in great detail.

https://www.heyrick.co.uk/armwiki/Main_Page

Without further ado, let us explore the first function. The extract below shows the ARM disassembly of a function named mystery1, which we are supposed to decompile into C code.

Practical Reverse Engineering Exercise Solutions: Page 35 / Exercise 11

Wed, 20 Sep 2017 02:37:00 -0700

Read the Virtual Memory chapter in Intel Software Developer Manual, Volume 3 and AMD64 Architecture Programmer’s Manual, Volume 2: System Programming. Perform a few virtual address to physical address translations yourself and verify the result with a kernel debugger. Explain how data execution prevention (DEP) works.

For this exercise, we first have to set up a remote kernel debugging session. (see https://codemetrix.net/windows-kernel-debugging-setup/, https://securityblog.gr/3253/debug-user-mode-processes-using-a-kernel-debugger/ and http://securityblog.gr/3023/windows-kernel-debugging/ for excellent explanations)

Practical Reverse Engineering Exercise Solutions: Page 35 / Exercise 10

Sun, 17 Sep 2017 05:34:00 -0700

Our task:

If the current privilege level is encoded in CS, which is modifiable by user-mode code, why can’t user-mode code modify CS to change CPL?

For a change, this is now a more theoretical than hands-on challenge. In order to address the exercise appropriately, we have to make sure we understood it correctly.

CS (code segment) is the CPU segment register that contains the current ring level in bits 0 and 1. This encoded level is also commonly referred to as CPL (current privilege level).

Practical Reverse Engineering Exercise Solutions: Page 35 / Exercise 9

Fri, 15 Sep 2017 02:49:00 -0700

Our task:

Sample L. Explain what function sub_1000CEA0 does and then decompile it back to C.

Here we have the function’s disassembly:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28


 push ebp
 mov ebp, esp
 push edi
 mov edi, [ebp+8]
 xor eax, eax
 or ecx, 0FFFFFFFFh
 repne scasb
 add ecx, 1
 neg ecx
 sub edi, 1
 mov al, [ebp+0Ch]
 std
 repne scasb
 add edi, 1
 cmp [edi], al
 jz short loc_1000CEC7
 xor eax, eax
 jmp short loc_1000CEC9

loc_1000CEC7: 
 mov eax, edi

loc_1000CEC9: 
 cld
 pop edi
 leave
 retn
 endp

Firstly, the function takes two arguments, at ebp+0x8 (arg1) and ebp+0x0C (arg2) respectively. It follows the stdcall convention that arguments are pushed from right to left on the stack and the callee cleaning up the stack.

Practical Reverse Engineering Exercise Solutions: Page 35 / Exercise 8

Thu, 14 Sep 2017 05:12:00 -0700

Our task as formulated in exercise 8:

Sample H. Decompile sub_11732 and explain the most likely programming construct used in the original code.

The function’s disassembly:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44


sub_1172E:
push esi
mov esi, [esp+8]
dec esi
jz short loc_1175F
dec esi
jz short loc_11755
dec esi
jz short loc_1174B
sub esi, 9
jnz short loc_1176B
mov esi, [eax+8]
shr esi, 1
add eax, 0Ch
jmp short loc_11767
; ---------------------------------------------------------------------------

loc_1174B: 
mov esi, [eax+3Ch]
shr esi, 1
add eax, 5Eh
jmp short loc_11767
; ---------------------------------------------------------------------------

loc_11755: 
mov esi, [eax+3Ch]
shr esi, 1
add eax, 44h
jmp short loc_11767
; ---------------------------------------------------------------------------

loc_1175F: 
mov esi, [eax+3Ch]
shr esi, 1
add eax, 40h

loc_11767: 
 
mov [ecx], esi
mov [edx], eax

loc_1176B: 
pop esi
retn 4

Obviously, the sought-after programming construct in this case is a switch...case statement.

Practical Reverse Engineering Exercise Solutions: Page 35 / Exercise 7

Sun, 30 Jul 2017 03:55:00 -0700

Exercise 7 on page 35:

Sample H. The function sub_10BB6 has a loop searching for something. First recover the function prototype and then infer the types based on the context. Hint: You should probably have a copy of the PE specification nearby.

Due to alignment issues, our routine is located at 10BB2 and has the following disassembly:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40


sub_10BB2:

 mov eax, [esp+4] 
 push ebx 
 push esi
 mov esi, [eax+3Ch] 
 add esi, eax 
 movzx eax, word ptr [esi+14h]
 xor ebx, ebx
 cmp [esi+6], bx
 push edi
 lea edi, [eax+esi+18h]
 jbe short loc_10BEB

loc_10BCE: 
 push [esp+0Ch+arg_4]
 push edi
 call ds:dword_169A4
 test eax, eax
 pop ecx
 pop ecx
 jz short loc_10BF3
 movzx eax, word ptr [esi+6]
 add edi, 28h
 inc ebx
 cmp ebx, eax
 jb short loc_10BCE

loc_10BEB: 
 xor eax, eax

loc_10BED: 
 pop edi
 pop esi
 pop ebx
 retn 8

loc_10BF3: 
 mov eax, edi
 jmp short loc_10BED

The PE file format and offsets have been described in detail here: http://www.sunshine2k.de/reversing/tuts/tut_pe.htm

Practical Reverse Engineering Exercise Solutions: Page 35 / Exercise 6

Sat, 22 Jul 2017 23:49:00 -0700

Exercise 6 on page 35 of the book Practical Reverse Engineering presents us with a malware samples.

These can be downloaded at the following page:

https://grsecurity.net/malware_research/

In this exercise, we are expected to have a look at the following routine sub_13842:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14


.text:00013842 sub_13842 
.text:00013842 mov eax, [ecx+60h]
.text:00013845 push esi
.text:00013846 mov esi, [edx+8]
.text:00013849 dec byte ptr [ecx+23h]
.text:0001384C sub eax, 24h
.text:0001384F mov [ecx+60h], eax
.text:00013852 mov [eax+14h], edx
.text:00013855 movzx eax, byte ptr [eax]
.text:00013858 push ecx
.text:00013859 push edx
.text:0001385A call dword ptr [esi+eax*4+38h]
.text:0001385E pop esi
.text:0001385F retn

Firstly, we see that the function prototype takes two parameters, which are not saved on the stack but in the two registers ecx and edx. This can be deducted from the fact that these two registers are immediately referenced without prior initialization.

Practical Reverse Engineering Exercise Solutions: RtlValidateUnicodeString

Sun, 16 Jul 2017 12:50:00 -0700

This blog post contains my solution for the decompilation exercise of the RtlValidateUnicodeString function in the Windows Kernel. The following contains the disassembly without annotations:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20


kd> uf rtlvalidateunicodestring
ntdll!RtlValidateUnicodeString:
77686f6c 8bff mov edi,edi
77686f6e 55 push ebp
77686f6f 8bec mov ebp,esp
77686f71 837d0800 cmp dword ptr [ebp+8],0
77686f75 0f85fc380300 jne ntdll!RtlValidateUnicodeString+0xb (776ba877)

ntdll!RtlValidateUnicodeString+0x12:
77686f7b 6800010000 push 100h
77686f80 ff750c push dword ptr [ebp+0Ch]
77686f83 e809000000 call ntdll!RtlUnicodeStringValidateEx (77686f91)

ntdll!RtlValidateUnicodeString+0x1f:
77686f88 5d pop ebp
77686f89 c20800 ret 8

ntdll!RtlValidateUnicodeString+0xb:
776ba877 b80d0000c0 mov eax,0C000000Dh
776ba87c e907c7fcff jmp ntdll!RtlValidateUnicodeString+0x1f (77686f88)

The function prototype is given here:

Practical Reverse Engineering Exercise Solutions: LiveKd / WinDbg Cheat Sheet

Sun, 16 Jul 2017 05:45:00 -0700

Here are a couple of commands I regularly use for reverse engineering:

uf <function>: Unassemble function
dt nt!_ktss: Show the definition of the data structure _ktss
?? sizeof(_ktss): Show the size the data structure _ktss occupies in memory
.hh uf: Show help for the function uf
x nt!*createfile*: Search all functions having the string createfile in its name
!vtop <PDPT-pointer> <virtualAddress>: Compute physical address of given virtual address and the pointer to the page directory pointer table

Practical Reverse Engineering Exercise Solutions: KiInitializeTSS

Sun, 16 Jul 2017 05:33:00 -0700

Another exercise for us is the decompilation of the KiInitializeTSS function:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15


nt!KiInitializeTSS:
82847359 8bff mov edi,edi
8284735b 55 push ebp
8284735c 8bec mov ebp,esp
8284735e 8b4508 mov eax,dword ptr [ebp+8]
82847361 b9ac200000 mov ecx,20ACh
82847366 66894866 mov word ptr [eax+66h],cx
8284736a 33c9 xor ecx,ecx
8284736c 6a10 push 10h
8284736e 66894864 mov word ptr [eax+64h],cx
82847372 66894860 mov word ptr [eax+60h],cx
82847376 59 pop ecx
82847377 66894808 mov word ptr [eax+8],cx
8284737b 5d pop ebp
8284737c c20400 ret 4

We obtain the function prototype: (source)

1
2
3
4
5


VOID
NTAPI
KiInitializeTSS(IN PKTSS Tss)
{
}

Structure of _KTSS:

Practical Reverse Engineering Exercise Solutions: KeReadyThread

Sun, 16 Jul 2017 03:44:00 -0700

Unfortunately I had no time in the past days to continue with the exercises. We continue with the decompilation of the KeReadyThread function in Windows 7.

The following listing shows the disassembly:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20


nt!KeReadyThread:
828a8125 8bff mov edi,edi
828a8127 56 push esi
828a8128 8bf0 mov esi,eax
828a812a 8b4650 mov eax,dword ptr [esi+50h]
828a812d 8b4874 mov ecx,dword ptr [eax+74h]
828a8130 f6c107 test cl,7
828a8133 7409 je nt!KeReadyThread+0x19 (828a813e)

nt!KeReadyThread+0x10:
828a8135 e8b74af8ff call nt!KiInSwapSingleProcess (8282cbf1)
828a813a 84c0 test al,al
828a813c 7505 jne nt!KeReadyThread+0x1e (828a8143)

nt!KeReadyThread+0x19:
828a813e e892ef0000 call nt!KiFastReadyThread (828b70d5)

nt!KeReadyThread+0x1e:
828a8143 5e pop esi
828a8144 c3 ret

According to this source, it has the following prototype:

Practical Reverse Engineering Exercise Solutions: KeInitializeQueue

Sat, 01 Jul 2017 05:39:00 -0700

We are tasked with decompiling the Windows Kernel routine KeInitializeQueue.

Firstly, we obtain its disassembly:

Secondly, we consult MSDN for its signature:

1
2
3
4


VOID KeInitializeQueue(
 _Out_ PRKQUEUE Queue,
 _In_ ULONG Count
);

The routine itself does not return anything.

We learn it takes two parameters and as the assembly contains the ret 8 instruction, the KeInitializeQueue function cleans up the stack and thus, it uses the stdcall convention.

Practical Reverse Engineering Exercise Solutions: ObFastDereferenceObject

Thu, 29 Jun 2017 09:46:00 -0700

First of all a quick reminder: This series of blog posts relates to exercises from the book Practical Reverse Engineering by Dang et al. Although it is called reverse engineering in general, it actually is mostly relevant to Microsoft Windows operating systems. This is simply due to the fact that Microsoft Windows is closed source in contrast to the Linux/Unix families, which means its source code is publicly available and so no reverse engineering endeavours are necessary.

Practical Reverse Engineering Exercise Solutions: KeInitializeApc Routine

Mon, 19 Jun 2017 02:36:00 -0700

To keep me motivated and document my progress, I will create a series of blog posts with answers to some of the exercises from the book “Practical Reverse Engineering” by Dang, Gazet and Bachaalany.

In the last post, we introduced the Windows Kernel Debugger (KD) and some of the functions. I have learned that rather than using KD directly, we can use WinDbg’s interface which is more user-friendly. When calling livekd, simply append the “-w” parameter and WinDbg will start up:

Practical Reverse Engineering Exercise Solutions: Windows Kernel Routines

Sat, 17 Jun 2017 00:01:00 -0700

I am currently developing my reverse engineering skills and want to keep some important parts of this journey as well in this blog.

The first step of this series relates to disassembling Windows kernel routines, in my case Windows 7.

What are the prerequisites for this exercise?

Ideally, install Windows inside a virtual machine
From Windows Vista onwards, the Kernel debugging mode has to be enabled with: bcdedit /debug on
Install Debugging Tools for Windows (for example, as part of the Windows SDK - https://www.microsoft.com/en-us/download/details.aspx?id=3138 for Windows 7, which contains the Kernel Debugger (KD))
Install LiveKD from the SysInternals Suite
- IMPORTANT: the livekd.exe file should be placed in the system32 folder

Notice that since we use LiveKD, we are essentially debugging the Kernel locally without a second system. With this approach, functions cannot be debugged as LiveKD uses a Kernel read-only memory dump as a basis.