Muutke küpsiste eelistusi

Practical Binary Analysis: Build Your Own Linux Tools for Binary Instrumentation, Analysis, and Disassembly [Pehme köide]

4.51/5 (125 hinnangut Goodreads-ist)
  • Formaat: Paperback / softback, 456 pages, kõrgus x laius: 234x178 mm, kaal: 908 g
  • Ilmumisaeg: 11-Dec-2018
  • Kirjastus: No Starch Press,US
  • ISBN-10: 1593279124
  • ISBN-13: 9781593279127
Teised raamatud teemal:
Practical Binary Analysis: Build Your Own Linux Tools for Binary Instrumentation, Analysis, and DisassemblySuurem pilt
  • Formaat: Paperback / softback, 456 pages, kõrgus x laius: 234x178 mm, kaal: 908 g
  • Ilmumisaeg: 11-Dec-2018
  • Kirjastus: No Starch Press,US
  • ISBN-10: 1593279124
  • ISBN-13: 9781593279127
Teised raamatud teemal:
Püsilink: https://www.kriso.ee/db/9781593279127.html
Märksõnad:
"Begins with an introduction covering the basics of binary formats, disassembly, and code injection, then moves on to more advanced topics such as binary instrumentation, dynamic taint analysis, and symbolic execution"--

Stop manually analyzing binary! Practical Binary Analysis is the first book of its kind to present advanced binary analysis topics, such as binary instrumentation, dynamic taint analysis, and symbolic execution, in an accessible way.

After an introduction on the basics of binary formats, disassembly, and code injection, you'll dive into more complex subjects, and by the end of the book, you'll be able to build your own binary analysis tools on Linux. Practical Binary Analysis will help interested people become well-rounded binary analysts, who are capable of developing and exploring new ideas on their own.

Arvustused

"Dennis Andriesse has put together a book that combines the necessary knowledge and tools enabling the reader to grasp not only the fundamentals of binary analysis, but also to put the newfound knowledge to the test in practical and illustrative examples of binary analysis." Sven Dietrich, Cipher: the newsletter of the IEEE Computer Society's Technical Committee on Security and Privacy

"This book is...one that deserves the title of deep dive. There is no waste anywherejust lean, mean, information." Full Circle Magazine

"If you want to reverse engineer some code, learn to be a white hat hacker or a black hat hacker then it's well worth reading." I Programmer

"Explains the subject in a straightforward and concise way! The author is a very knowledgeable security researcher and his work is state of the art!" Nucu Labs

This book reads like a workshop that teaches readers what tools exist for both Linux and Windows and how to string them together to write tools for reverse engineering binaries . . . if you are well versed in programming, this book will still teach you a good approach at tackling many problems with binary analysis. John Skandalakis, Software Engineer, Tripwire

Muu info

Stop manually analyzing binary! Practical Binary Analysis is the first book of its kind to present advanced binary analysis topics, such as binary instrumentation, dynamic taint analysis, and symbolic execution, in an accessible way.
Foreword xvii
Herbert Bos
Preface xxi
Acknowledgments xxiii
Introduction 1(1)
What Is Binary Analysis, and Why Do You Need It?
2(1)
What Makes Binary Analysis Challenging?
3(1)
Who Should Read This Book?
4(1)
What's in This Book?
4(1)
How to Use This Book
5(1)
Instruction Set Architecture
6(1)
Assembly Syntax
6(1)
Binary Format and Development Platform
6(1)
Code Samples and Virtual Machine
7(1)
Exercises
8(2)
PART I BINARY FORMATS
10(1)
1 Anatomy Of A Binary
11(20)
1.1 The C Compilation Process
12(6)
1.1.1 The Preprocessing Phase
12(2)
1.1.2 The Compilation Phase
14(2)
1.1.3 The Assembly Phase
16(1)
1.1.4 The Linking Phase
17(1)
1.2 Symbols and Stripped Binaries
18(3)
1.2.1 Viewing Symbolic Information
18(2)
1.2.2 Another Binary Turns to the Dark Side: Stripping a Binary
20(1)
1.3 Disassembling a Binary
21(6)
1.3.1 Looking Inside an Object File
21(2)
1.3.2 Examining a Complete Binary Executable
23(4)
1.4 Loading and Executing a Binary
27(2)
1.5 Summary
29(1)
Exercises
29(2)
2 The Elf Format
31(26)
2.1 The Executable Header
33(5)
2.1.1 The e_jdent Array
34(1)
2.1.2 The e_jype, e_machine, and e_version Fields
35(1)
2.1.3 The e_entry Field
36(1)
2.1.4 The e_phoff and e_shoff Fields
36(1)
2.1.5 The e_flags Field
36(1)
2.1.6 The e_ehsize Field
37(1)
2.1.7 The e_*entsize and e_*num Fields
37(1)
2.1.8 The e_shstrndx Field
37(1)
2.2 Section Headers
38(3)
2.2.1 The sh_name Field
39(1)
2.2.2 The sh_ype Field
39(1)
2.2.3 The sh_lags Field
40(1)
2.2.4 The sh_addr, sh_offset, and sh_size Fields
40(1)
2.2.5 The sh_ink Field
40(1)
2.2.6 The sh_info Field
41(1)
2.2.7 The sh_addralign Field
41(1)
2.2.8 The sh_entsize Field
41(1)
2.3 Sections
41(11)
2.3.1 The .init and .fini Sections
43(1)
2.3.2 The .text Section
43(1)
2.3.3 The .bss, data, and .rodata Sections
44(1)
2.3.4 Lazy Binding and the .pit, .got, and .got.plt Sections
45(3)
2.3.5 The .rel.* and .rela.* Sections
48(2)
2.3.6 The dynamic Section
50(1)
2.3.7 The .init_array and .fini_array Sections
51(1)
2.3.8 The .shstrtab, .symtab, .strtab, .dynsym, and .dynstr Sections
52(1)
2.4 Program Headers
52(3)
2.4.1 The p_type Field
54(1)
2.4.2 The p_tlags Field
54(1)
2.4.3 The p_offset, p_vaddr, p_paddr, pjilesz, and p_memsz Fields
54(1)
2.4.4 The p_align Field
55(1)
2.5 Summary
55(1)
Exercises
3(54)
3 The Pe Format: A Brief Introduction
57(10)
3.1 The MS-DOS Header and MS-DOS Stub
58(1)
3.2 The PE Signature, File Header, and Optional Header
58(4)
3.2.1 The PE Signature
61(1)
3.2.2 The PE File Header
61(1)
3.2.3 The PE Optional Header
62(1)
3.3 The Section Header Table
62(1)
3.4 Sections
63(2)
3.4.1 The .edata and .idata Sections
64(1)
3.4.2 Padding in PE Code Sections
64(1)
3.5 Summary
65(1)
Exercises
65(2)
4 Building A Binary Loader Using Libbfd
67(22)
4.1 What Is libbfd?
68(1)
4.2 A Simple Binary-Loading Interface
68(4)
4.2.1 The Binary Class
71(1)
4.2.2 The Section Class
71(1)
4.2.3 The Symbol Class
71(1)
4.3 Implementing the Binary Loader
72(11)
4.3.1 Initializing libbfd and Opening a Binary
73(2)
4.3.2 Parsing Basic Binary Properties
75(3)
4.3.3 Loading Symbols
78(3)
4.3.4 Loading Sections
81(2)
4.4 Testing the Binary Loader
83(2)
4.5 Summary
85(1)
Exercises
86(3)
PART II BINARY ANALYSIS FUNDAMENTALS
5 Basic Binary Analysis In Linux
89(26)
5.1 Resolving Identity Crises Using file
90(3)
5.2 Using Idd to Explore Dependencies
93(1)
5.3 Viewing File Contents with xxd
94(2)
5.4 Parsing the Extracted ELF with reade If
96(3)
5.5 Parsing Symbols with nm
99(3)
5.6 Looking for Hints with strings
102(2)
5.7 Tracing System Calls and Library Calls with strace and Itrace
104(5)
5.8 Examining Instruction-Level Behavior Using objdump
109(2)
5.9 Dumping a Dynamic String Buffer Using gdb
111(2)
5.10 Summary
113(1)
Exercise
113(2)
6 Disassembly And Binary Analysis Fundamentals
115(40)
6.1 Static Disassembly
116(6)
6.1.1 Linear Disassembly
117(1)
6.1.2 Recursive Disassembly
118(4)
6.2 Dynamic Disassembly
122(7)
6.2.1 Example: Tracing a Binary Execution with gdb
122(3)
6.2.2 Code Coverage Strategies
125(4)
6.3 Structuring Disassembled Code and Data
129(12)
6.3.1 Structuring Code
129(7)
6.3.2 Structuring Data
136(2)
6.3.3 Decompilation
138(1)
6.3.4 Intermediate Representations
139(2)
6.4 Fundamental Analysis Methods
141(11)
6.4.1 Binary Analysis Properties
142(4)
6.4.2 Control-Flow Analysis
146(2)
6.4.3 Data-Flow Analysis
148(4)
6.5 Effects of Compiler Settings on Disassembly
152(1)
6.6 Summary
153(1)
Exercises
153(2)
7 Simple Code Injection Techniques For Elf
155(36)
7.1 Bare-Metal Binary Modification Using Hex Editing
155(8)
7.1.1 Observing an Off-by-One Bug in Action
156(3)
7.1.2 Fixing the Off-by-One Bug
159(4)
7.2 Modifying Shared Library Behavior Using LD_PRELOAD
163(6)
7.2.1 A Heap Overflow Vulnerability
163(2)
7.2.2 Detecting the Heap Overflow
165(4)
7.3 Injecting a Code Section
169(6)
7.3.1 Injecting an ELF Section: A High-Level Overview
169(2)
7.3.2 Using elfinject to Inject an ELF Section
171(4)
7.4 Calling Injected Code
175(12)
7.4.1 Entry Point Modification
176(3)
7.4.2 Hijacking Constructors and Destructors
179(3)
7.4.3 Hijacking GOT Entries
182(3)
7.4.4 Hijacking PLT Entries
185(1)
7.4.5 Redirecting Direct and Indirect Calls
186(1)
7.5 Summary
187(1)
Exercises
187(4)
PART III ADVANCED BINARY ANALYSIS
8 Customizing Disassembly
191(32)
8.1 Why Write a Custom Disassembly Pass?
192(4)
8.1.1 A Case for Custom Disassembly: Obfuscated Code
192(3)
8.1.2 Other Reasons to Write a Custom Disassembler
195(1)
8.2 Introduction to Capstone
196(17)
8.2.1 Installing Capstone
196(2)
8.2.2 Linear Disassembly with Capstone
198(5)
8.2.3 Exploring the Capstone C API
203(1)
8.2.4 Recursive Disassembly with Capstone
204(9)
8.3 Implementing a ROP Gadget Scanner
213(8)
8.3.1 Introduction to Return-Oriented Programming
213(2)
8.3.2 Finding ROP Gadgets
215(6)
8.4 Summary
221(1)
Exercises
221(2)
9 Binary Instrumentation
223(42)
9.1 What Is Binary Instrumentation?
224(2)
9.1.1 Binary Instrumentation APIs
224(1)
9.1.2 Static vs. Dynamic Binary Instrumentation
225(1)
9.2 Static Binary Instrumentation
226(7)
9.2.1 The int 3 Approach
227(1)
9.2.2 The Trampoline Approach
228(5)
9.3 Dynamic Binary Instrumentation
233(4)
9.3.1 Architecture of a DBI System
233(2)
9.3.2 Introduction to Pin
235(2)
9.4 Profiling with Pin
237(14)
9.4.1 The Profiler's Data Structures and Setup Code
237(3)
9.4.2 Parsing Function Symbols
240(1)
9.4.3 Instrumenting Basic Blocks
241(2)
9.4.4 Instrumenting Control Flow Instructions
243(3)
9.4.5 Counting Instructions, Control Transfers, and Syscalls
246(1)
9.4.6 Testing the Profiler
247(4)
9.5 Automatic Binary Unpacking with Pin
251(12)
9.5.1 Introduction to Executable Packers
251(2)
9.5.2 The Unpacker's Data Structures and Setup Code
253(2)
9.5.3 Instrumenting Memory Writes
255(1)
9.5.4 Instrumenting Control-Flow Instructions
256(1)
9.5.5 Tracking Memory Writes
256(2)
9.5.6 Detecting the Original Entry Point and Dumping the Unpacked Binary
258(1)
9.5.7 Testing the Unpacker
259(4)
9.6 Summary
263(1)
Exercises
264(1)
10 Principles Of Dynamic Taint Analysis
265(14)
10.1 What Is DTA?
266(1)
10.2 DTA in Three Steps: Taint Sources, Taint Sinks, and Taint Propagation
266(2)
10.2.1 Defining Taint Sources
266(1)
10.2.2 Defining Taint Sinks
267(1)
10.2.3 Tracking Taint Propagation
267(1)
10.3 Using DTA to Detect the Heartbleed Bug
268(3)
10.3.1 A Brief Overview of the Heartbleed Vulnerability
268(1)
10.3.2 Detecting Heartbleed Through Tainting
269(2)
10.4 DTA Design Factors: Taint Granularity, Taint Colors, and Taint Policies
271(7)
10.4.1 Taint Granularity
271(1)
10.4.2 Taint Colors
272(1)
10.4.3 Taint Propagation Policies
273(1)
10.4.4 Overtainting and Undertainting
274(1)
10.4.5 Control Dependencies
275(1)
10.4.6 Shadow Memory
276(2)
10.5 Summary
278(1)
Exercise
278(1)
11 Practical Dynamic Taint Analysis With LIBDFT
279(30)
11.1 Introducing libdft
279(4)
11.1.1 Internals of libdft
280(2)
11.1.2 Taint Policy
282(1)
11.2 Using DTA to Detect Remote Control-Hijacking
283(13)
11.2.1 Checking Taint Information
286(2)
11.2.2 Taint Sources: Tainting Received Bytes
288(2)
11.2.3 Taint Sinks: Checking execve Arguments
290(1)
11.2.4 Detecting a Control-Flow Hijacking Attempt
291(5)
11.3 Circumventing DTA with Implicit Flows
296(1)
11.4 A DTA-Based Data Exfiltration Detector
297(10)
11.4.1 Taint Sources: Tracking Taint for Open Files
299(4)
11.4.2 Taint Sinks: Monitoring Network Sends for Data Exfiltration
303(1)
11.4.3 Detecting a Data Exfiltration Attempt
304(3)
11.5 Summary
307(1)
Exercise
307(2)
12 Principles Of Symbolic Execution
309(24)
12.1 An Overview of Symbolic Execution
309(12)
12.1.1 Symbolic vs. Concrete Execution
310(3)
12.1.2 Variants and Limitations of Symbolic Execution
313(6)
12.1.3 Increasing the Scalability of Symbolic Execution
319(2)
12.2 Constraint Solving with Z3
321(9)
12.2.1 Proving Reachability of an Instruction
322(3)
12.2.2 Proving Unreachability of an Instruction
325(1)
12.2.3 Proving Validity of a Formula
325(2)
12.2.4 Simplifying Expressions
327(1)
12.2.5 Modeling Constraints for Machine Code with Bitvectors
327(2)
12.2.6 Solving an Opaque Predicate Over Bitvectors
329(1)
12.3 Summary
330(1)
Exercises
330(3)
13 Practical Symbolic Execution With Triton
333(40)
13.1 Introduction to Triton
334(1)
13.2 Maintaining Symbolic State with Abstract Syntax Trees
335(2)
13.3 Backward Slicing with Triton
337(9)
13.3.1 Triton Header Files and Configuring Triton
340(1)
13.3.2 The Symbolic Configuration File
340(2)
13.3.3 Emulating Instructions
342(1)
13.3.4 Setting Triton's Architecture
343(1)
13.3.5 Computing the Backward Slice
344(2)
13.4 Using Triton to Increase Code Coverage
346(9)
13.4.1 Creating Symbolic Variables
348(1)
13.4.2 Finding a Model for a New Path
348(4)
13.4.3 Testing the Code Coverage Tool
352(3)
13.5 Automatically Exploiting a Vulnerability
355(15)
13.5.1 The Vulnerable Program
356(3)
13.5.2 Finding the Address of the Vulnerable Call Site
359(2)
13.5.3 Building the Exploit Generator
361(6)
13.5.4 Getting a Root Shell
367(3)
13.6 Summary
370(1)
Exercise
370(3)
PART IV APPENDIXES
A A Crash Course On X86 Assembly
373(18)
A.1 Layout of an Assembly Program
374(2)
A.1.1 Assembly Instructions, Directives, Labels, and Comments
374(1)
A.1.2 Separation Between Code and Data
375(1)
A.1.3 AT&T vs. Intel Syntax
376(1)
A.2 Structure of an x86 Instruction
376(4)
A.2.1 Assembly-Level Representation of x86 Instructions
376(1)
A.2.2 Machine-Level Structure of x86 Instructions
376(1)
A.2.3 Register Operands
377(2)
A.2.4 Memory Operands
379(1)
A.2.5 Immediates
380(1)
A.3 Common x86 Instructions
380(3)
A.3.1 Comparing Operands and Setting Status Flags
382(1)
A.3.2 Implementing System Calls
382(1)
A.3.3 Implementing Conditional Jumps
382(1)
A.3.4 Loading Memory Addresses
383(1)
A.4 Common Code Constructs in Assembly
383(8)
A.4.1 The Stack
383(1)
A.4.2 Function Calls and Function Frames
384(4)
A.4.3 Conditional Branches
388(1)
A.4.4 Loops
389(2)
B Implementing Pt_Note Overwriting Using Libelf
391(22)
B.1 Required Headers
392(1)
B.2 Data Structures Used in elfinject
392(1)
B.3 Initializing libelf
393(4)
B.4 Getting the Executable Header
397(1)
B.5 Finding the PT_NOTE Segment
398(1)
B.6 Injecting the Code Bytes
399(1)
B.7 Aligning the Load Address for the Injected Section
400(1)
B.8 Overwriting the note.ABI-tag Section Header
401(5)
B.9 Setting the Name of the Injected Section
406(2)
B.10 Overwriting the PT_NOTE Program Header
408(2)
B.11 Modifying the Entry Point
410(3)
C List Of Binary Analysis Tools
413(4)
C.1 Disassemblers
413(2)
C.2 Debuggers
415(1)
C.3 Disassembly Frameworks
415(1)
C.4 Binary Analysis Frameworks
416(1)
D Further Reading
417(4)
D.1 Standards and References
417(1)
D.2 Papers and Articles
418(2)
D.3 Books
420(1)
Index 421
Dennis Andriesse has a Ph.D. in system and network security and uses binary analysis daily in his research. He is one of the main contributors to PathArmor, a Control-Flow Integrity system that defends against control-flow hijacking attacks such as ROP. Andriesse was also one of the attack developers involved in the takedown of the GameOver Zeus P2P botnet.