vous devez chausser du 48 ou bien mettre des scholls

last post here ?
As I now prefer to write and update technical documents in my wiki, and notify people via my announcement-only twitter account, rather than write on this blog, it will be unlikely updated in the future.

So, to keep yourself updated, I suggest to check @corkami.
If you want to use an RSS reader, you can point it to this address, which doesn't require your own twitter account . For some reasons, Google Reader doesn't like it: to solve the problem, you can use a service such as Freemyfeed (no need of login/password). It gives you an url like this one, which works fine with Google Reader.

too scared to go to prison, we're unable to make decisions

I still don't have the time to write a decent blog article, but at least, I managed to do a few things since the last post (if you don't follow me on twitter or reddit):

• Trying to improve my screencasting methodology, I created a screencast tutorial on reJava (compare with my previous one and let me know which one is better).
• a summary of PDF tricks page, with various categories (encodings, structures, javascript...), and for each example, a handmade, clean and minimal PoC.
• In order to study a way to document in details a binary, I created a commented IDB of a PE file packed with UPX - released as is, on request but I find it a sub-optimal way to document assembly, especially as it's not really possible to easily move this information to another IDB.
• a small update to my PE infographics, some fixes, and improvments of the resource section.
• a merge from the aPlib part of Kabopan as a single independent aplib.py
• a commented disassembly of Peter Ferrie's new EICAR file
• a commented disassembly of Yosuke Hasegawa's AA86, the symbol assembler.
  Example: "Hello World" code:

@^^^^^-%+)@@^^^!;@@_!,((,.((-$+)@*+@!!@-,!"(+@@,$-,!"($%&,&,&_&,"@"'%_&"',&$&-@*@$"

• a handy python script to rename unicode filenames (and back), very handy for these tools that don't support unicode filenames.
  ex: 日本.txt <=> &'#26085;&'#26412;.txt
• a yED graph of intel AVX2 opcodes descriptions (png): totally useless in itself, yet all these opcodes are scary.

Mireille est une star au fin fond du Tibet

Here are a few things that I released recently but didn't get a regular blog post, just a twitter entry:

• Usermode test(v0.1): a usermode opcode tester, covering most opcodes, including rare, obsolete, recent, undocumented, 64 bits, exception triggers, anti-debugs.... (gathering and extending the result of my previous blog entries and programs)
  

• Following Peter Ferrie's article, I wrote a commented source of JJencode, the funny javascript obfuscator, along with a dumb decryption script.
• I extended y0da's binary corpus, with various compiled files and my own experimental PEs, to build my own binary corpus. It covers a lot of different compilers, sections layout, image directories,...
• I created a simple screencast to introduce tracing with OllyDbg, based on Oleh's tutorial.

I wear my crown of thorns, on my liar's chair

a bit of nostalgia (virii)
my first contact with a computer virus was Ping-Pong, which infected our 10 Mhz 8086. Hopefully, a magazine was giving the solution (for free!): they were giving the hex sequence to search and replace !!!
While it was a working solution, it was not exactly 'user-friendly': Hey Grandma, launch PCTools 4.30, open the hex editor, then.... err, nevermind !

My 2nd interaction with a virus was Tequila: it kept re-infecting our computer. However, because our 20 Mb hard disk was very noisy, I could eventually recognize the sound of the virus infecting the MBR ! Instant detection, but once again, not exactly the most user friendly !

Hopefully, Anti-Virus softwares are now a bit better than 'listen to your hard disk' or 'search and replace yourself' !

Mais je me lâche la main, je m’éloigne de moi...

unpacking drivers in user-mode (2)

Following my previous post on the topic, I came up with a few more tricks:

• since packed drivers typically use ExAllocatePool*, you need a user-mode equivalent to extract the packed driver. So I just made my fake ntoskrnl call VirtualAlloc* for the trick
• they often use RtlImageNtHeader, so I added a redirection for it in the fake ntoskrnl.
  
• some drivers import HAL.DLL and CLASSPNP.SYS, I made fake ones for them too.
• some drivers load ntoskrnl.exe manually. in this case, i'd use (under OllyDbg) multimate-assembler, with a standard snippet.
• it's important to recognize when the driver is trying to locate ntoskrnl, to be able to correct execution. Here are the various ways that I can recall:

1. calling SIDT will give you the IDT, which is present in ntoskrnl.
2. calling RDMSR with ECX=176 gives you Sysenter address, you can then locate ntoskrnl header.
3. standard range checking:

mov eax, 0ffdff12ch

mov eax, [eax]

loop:

and ax, f001

dec eax

cmp [eax], 5a4d

jnz loop

As usual, I included the (minimal) sources - happy unpacking!
Sources and binaries

Ne trouvez-vous donc pas, l'histoire un peu répétitive ?

a simple API jump
If you check Wine's source:

void WINAPI RtlCopyLuid (PLUID LuidDest, const LUID *LuidSrc)
{
*LuidDest = *LuidSrc;
}

you see that this little NtDll API is very strong: no check is done, so it could be used literally for anything. A simple way to use it is just to jump, by setting the right arguments.

...Weiß noch nicht, dass er tanzen muss

misc update
Just to let you know I updated the Map and Downloads, hoping things will be a little more detailed about my various experiments.

---

petite mise à jour
Simplement pour vous dire que j'ai mis à jour la Carte et les Téléchargements, en espérant que les choses soient un peu plus claires concernant mes bidouillages.

Sans réfléchir, ne me demande pas comment...

a bit of nostalgia
my first game crack was purely accidental (i own the game too!):
both edited by Microprose, F15 Strike eagle II and F19 stealth fighter had the same structure:
a small (F15|F9).COM file calling the main GAME.EXE file
what if you swap one game's .COM with the other game's ?

Wir halten zusammen, keiner kämpft allein

Finished PE/Packers/Opcodes graphics

As I added Data Directories to the PE infographics, my 3 infographics projects are now finished:

Before you judge me, take a look at you

Packers' algorithms

I created one last diagram, showing Packers' most common algorithms.

Si tu cherches un peu de gaîté, viens donc faire un tour à...

Typical behavior of the various kinds of packers

I made an infographic showing 3 different kinds of packer, their usual steps and the caracteristics of each of these steps.

I time every journey to bump into you

PE file and memory layouts
I created a graph (diagram?) for the PE format, showing 'standard' layouts of a PE file, on disk and in memory.

Lutte contre les mots faciles, lutte contre la haine des ...

user-mode opcodes cheat sheets
I mostly work on user-mode code, or kernel-mode code that actually uses a very limited amount of privileged opcodes, just to access CR0 and IF. Besides, FPU/MMX/SSE are usually used as junk or pure calculation that I can ignore.

So, from that limited perspective, the amount of opcodes is much reduced.

A Perspective of two-byte opcodes
After my overview of one-byte opcodes, I made a graph of two-byte opcodes according to that perspective.
It makes it much more readable than expected!

Opcodes' reminders
Also, I checked every user-mode opcode, and wrote a one-liner to describe them, as well as a small example. I put together an executable with all the examples, just to see them in action - and test your favorite emulator ;)

It makes them small opcodes' reminders, in printable text and executable code formats.

If you wanna make the world a better place, take a look at ...

typical packer entry-points
It can be useful to have a reminder of the most usual packers' entry point - especially the light ones, which are likely to be hacked or used as an inner layer.

Quand mes 'elles' se froissent et mes 'ils' se noient

pages on anti-debuggers and PE oddities

I created 2 new pages: one is about anti-debuggers (nothing new, just a compact and a printable form), and the other about PE oddities.

Life's a piece of sh.t, when you look at it

Overview of one-byte opcodes

I made a simple one-page overview of one-byte opcodes:

Aurais-je été meilleur ou pire que ces gens, si j'avais été...

packers' categories and features
Following my graph of the packers' landscape, I made a graph showing the different categories of packers, and what kind of features they have.
Then, to go deeper in details, I made a more detailed list of the various features for each of these kinds.

You can't hide nowhere, with the torchlight on

a emptier TinyPE
TinyPE is an impressive project, that explains step-by-step how to make an incredible 97 bytes functional PE. It also shows that a PE can't be any smaller, otherwise IMAGE_OPTIONAL_HEADER32.Subsystem, which is a critical field, wouldn't be defined - it's even already shortened from a word to a byte.

However, the original TinyPE still defines a section and SizeOfOptionalHeader, which are not necessary.
Removing them makes such a PE not only Tiny, but also very small in amount of information - yet it works, naturally, and there's quite some room for code (relatively).
In the end, here are the only defined fields, across all PE headers fields:

Si c'est ton corps qui bouge, c'est ton coeur qui fait tout

Getting the current EIP
While standard code starts at a fixed address, there are several cases when your code needs to know its current IP:

• after a vulnerability has been triggered, shellcodes can't know in advance where they are executing exactly
• packers often allocates a buffer and decompress their next layer of code, which will likely need to locate itself at some point
• relocating code is a good way to avoid breakpoints: same code, somewhere else

Thus, I'll enumerate ways to get your current EIP, in a file, on which you can test your emulator or debugger.

no, I'm your father

misc news
Opcodes 'complete'

my file listing all known 32 bits opcodes is almost done: everything documented should be in (including AVX, XOP, Padlock, LWP), and 99% of undocumented stuff I can think of is in (to be blogged later)
Source

Packers graph now printable