It is about a minor project that i recently completed. That is writing a virtual machine to slow down the process of reverse engineering. This is not a tutorial to do the same however I have included the presentation that i used during the final presentation, the PDFs for System Design and Sample Runs and one step by step sample run.

#Presentation

#Code

#Sample Run

In this sample run I am going to implement the POC expansion algorithm that was the final program that was written for OIVM.1. Make sure bootrom.txt and OIVM.exe are in the same folder.
2. Open the Bootrom.txt using a Hex Editor (example : Hex Workshop) and write the following hex stream to it.

3F 11 25 00 2F 08 3F 38 3F 38 41 3D 09 1B 3C 4C 21 25 00 2F 14 7C 67 63 55 64 61 38 67 7C 63 38 55 64 61 38 37 41 3D 15 C9 45 3F 11 3F 12 18 68 3C 25 00 2F 08 12 86 C5 38 41 3D 09 00 02 04 06 08

3. Save the file. This is basically in the format of [STUB][Compressed Code]. The stub is 60 Bytes long and extends till the 0x09 in the second line of the hexadecimal stream. The parallel assembly for this code is as follows :

[EXPANSION STUB]
scanf(“%d”,&STACK[SP])
MOV A,STACK[SP]
FLAG=A-ROM[++IP]
JE 8 BYTES
scanf(“%d”,&STACK[SP])
++SP
scanf(“%d”,&STACK[SP])
++SP
–A
JMP -9 BYTES
MOV B,ROM[++IP] //STUB LENGTH
A = fileLen
A=A-B
FLAG=A-ROM[++IP]
JE 14 BYTES
MOV C ,ROM[B]
MOV D,SP
MOV SP,C
MOV C,STACK[SP]
MOV SP,D
MOV STACK[SP],C
++SP
MOV D,SP
MOV C,ROM[B]
MOV SP,C
++SP
MOV C,STACK[SP]
MOV SP,D
MOV STACK[SP],C
++SP
++B
–A
JMP -21 BYTES
ROM=(char *)realloc(ROM,ROM[++IP]) //FILE EXPANDED
scanf(“%d”,&STACK[SP])
MOV A,STACK[SP]
scanf(“%d”,&STACK[SP])
MOV B,STACK[SP]
MOV SP,B
MOV C,ROM[++IP]
FLAG=A-ROM[++IP]
JE 8 BYTES
MOV B,STACK[SP]
MOV ROM[C],B
++C
++SP
–A
JMP -9 BYTES
[COMPRESSED FORM]
00 02 04 06 08

4. Now run the program.If however you dont speak assembly that doesnt matter here is the algorithm for it :

1. Enter the Number of elements in the dictionary.
2. Enter the dictionary.
(Dictionary is stored on the stack)
(The dictionary is looked up for values corresponding to compressed code)
(The new Values are updated over the stack)
3. Enter the New Size.
4. Enter the SP (which could have been hardcoded as well)
(The code expands)
(The execution is now passed on to the expanded program)
5. Enter the first element. Hit Enter.
6. Enter the second element. Hit Enter.
7. The sum is Displayed.
8. OIVM halts.

Results/Output

#Thanks

Special thanks to Mr. Atul Alex Cherian, Ms. Nishtha Jatana and Ms. Kritika Sobti.

Hi, non technical reader.

Introduction

So basically this is the small program I wrote, which we are going to play with. In this program there are two functions : func1() and func2(). func1() is called from main, but func2() is never called.

So our aim is to execute func2 at run time.Here is the first run :

As you can see we do not go inside func2.

Reverse Engineering solution The first and the lot easier approach to this is, a RE solution. In this solution i just change some return addresses on the stack and we are done. Lets go step by step.

Step1 : Loading the program in OllyDbg

As can be seen there are three functions main, func1 and func2. These are indicated by the square brackets. The order of these functions is func1, func2 and lastly main.

Step2 : Now I am going to put a breakpoint on func1 and then observe the stack.

We have two images here the first one represents the assembly view of print2.cpp when i hitthe breakpoint and the second one represents the stack when I hit the breakpoint. In figure 1 it can be seen that the func1 starts at 401334 and it(the address) is in read with black background. Which indicates that we have hit the breakpoint. In figure two we can see that the return address for func1() is 0040139A. If we look up this address in the assembly dump, it is the one just after func1() is called that is 401395. Hence, things are fine here, the function always returns to the immediate expression after a call to it. So we have two deductions from here. First that the return address is 40139A which can be changed to make the func1() jump somewhere else. and secondly that this address is placed on the memory address starting 28FF0C.  

Step3 : Now we are going to edit 40139A to 401359 so that we can jump over to func2().

After the modification even the comment changes to print2.00401359, which suggests that it is call. And as expected we enter the func2().

However this is not enough. In a similar way we have to edit the return address of func2 to 40139A which was the original return address of func1. Now to be able to identify where is the return address of func2, we single step through func2 till we reach RETN.

Step4 : Here the top address on the stack is the return address for the stack. We need to change this address. In order to return and exit normally.

As can be seen on the stack 0028FF10 is the address where the return address 00403050 is stored. We modify this and then run the program.

We are able to do it neatly. :)

Program Solution

Now the RE solution was though easy, it wasn’t automated, and i had no fuckin idea about how do i make a permanent modification. What i mean here is like if you want to completely change an instruction you can do that and simply save changes to the new executable. But the stack is a dynamic memory region, it is not a part of the exe file that you save. So there was something more, some workaround that was needed. And thanks to Atul Alex Cherian, who told me about loader. So a loader is basically a program that lets the entire exe load in memory and then plays around with it. I first thought about using a tool for this, but then why not just code this shit out. So here is the algorithm that i followed for this.

Step1. Use fread to read the bytes of print2.exe to an array.

Step2. In this array modify the byte that represents beginning of func1 to CC (breakpoint).

Step3. Save this array to a new myf.exe

Step4. Detach pointer to myf.exe and open process myf.exe as a DEBUG_PROCESS

Step5. Waitforadebugevent and use a simple condition to check that it orignates from the one that you forced.

Step6. On receiving the EXCEPTION_BREAKPOINT DEBUG_EVENT suspend the thread using process information of myf.exe

Step7, Now change the CC that you placed to the original byte

Step8. Getthreadcontext of this thread and access the context structure to decrement EIP.

Step9. Now change return addresses of func1 and func2. For func1 only one byte is edited and for func2 one has to edit 2 bytes.

Step10. Resume thread. Myf.exe should exit after you press the first enter, then loader.exe should exit after you press the second enter. Here is the code :

Here is the screen shot showing its execution.

And special thanks to Dhanesh sir. :)

H3LL Y34H! :)

#include “stdafx.h”
#include “windows.h”

void antidebug();
void antidebug()
{
HMODULE lib;
FARPROC _ZwSetInformationThread;
lib = LoadLibrary(“ntdll.dll“);
_ZwSetInformationThread = GetProcAddress(lib, “ZwSetInformationThread“);
(_ZwSetInformationThread)(GetCurrentThread(),0x11,0,0);
MessageBox(NULL, “Debugger Detached“, “Debugger Detached“, MB_OK);
}

int _tmain(int argc, _TCHAR* argv[])
{
antidebug();
MessageBox(NULL, “Double Check…“, “Double Check“, MB_OK);
return 0;
}

Before I get into the BUGs lemme just try and explain what is happening here, so we are basically loading a handle to ntdll.dll by calling the LoadLibrary process and then we load the callback to _ZwSetInformationThread which is of datatype FARPROC[more on FARPROC] then we call ZwSetInformationThread routine which has four parameters as per http://msdn.microsoft.com/en-us/library/windows/hardware/ff567101%28v=vs.85%29.aspx .

The firstparameter is the handle to the current thread and since we want to run this function within our program we use the GetCurrentThread() function call which returns a handle to the current thread. Next is a value 11. This is basically the value because of which the debugger would get detached from the process. Now how did i get this value. As per documentation on msdn the second parameter is of the enumeration type _THREADINFOCLASS which is as follows [source] :

typedef enum _THREADINFOCLASS {
ThreadBasicInformation,
ThreadTimes,
ThreadPriority,
ThreadBasePriority,
ThreadAffinityMask,
ThreadImpersonationToken,
ThreadDescriptorTableEntry,
ThreadEnableAlignmentFaultFixup,
ThreadEventPair_Reusable,
ThreadQuerySetWin32StartAddress,
ThreadZeroTlsCell,
ThreadPerformanceCount,
ThreadAmILastThread,
ThreadIdealProcessor,
ThreadPriorityBoost,
ThreadSetTlsArrayAddress,
ThreadIsIoPending,
ThreadHideFromDebugger,
ThreadBreakOnTermination,
MaxThreadInfoClass
} THREADINFOCLASS;

So ThreadHideFromDebugger is 17 which is basically 11 in hex. And the remaining two parameters are obviously not of importance to us. :D

Now coming to the bugs. “|17|error: too many arguments to function|” But MSDN said that it needed four :O and now i started removing one parameter at a time and the function ran when i did not pass any arguments. After having searched a lot! The only solution that i could think of was to use the asm function and pass these arguments manually.

So i made the following changes.

(_ZwSetInformationThread)();
GetCurrentProcess();
asm(“pushl 0“);
asm(“pushl 0“);
asm(“pushl 0x11“);
asm(“pushl %eax“);

Oh and by the way the assembly syntax utilized on GCC is the AT&T asm. So yeah! I had to first read that because i have being doing the intel format. I read [this]

So this was some success because atleast the exe compiled, i had already though that now i would easily debug everything on OllyDbg and get it through. But this is what GCC(or i) had done to the code. :

So this wasnt the best solution.But it was some success since i was atleast able to compile the exe now and look it up in Olly (Somehow i am more comfortable with that.)

I decided that since the value passed as the handle to the process is the only thing that i do not know lemme pass other values by modifying the assembly code manually in Olly and changed the code to the following :

HANDLE hndle = GetCurrentThread();
(_NtSetInformationThread)();

The exe did compile and i was getting the pop up messages too.

Next thing was to immediately load this exe into my dearest OllyDbg and get started. Here is the very first look.

You can see that a call gets made to GetCurrentThread at 00401365 and the value is returned into EAX which is them moved to our variable “handle” (EBP-14). So after a couple of runs i realized that this value was always the same and always returning FFFFFFFE i am not sure if this is a fixed constant for a each system or is it just the local handle to every thread. But this is what it was in the case that I had in front of me. Then later you can see that a different value is moved into EAX and at 00401370 we make a call to that address (call eax) hence this is the handle to the ZwSetInformationThread.

So far so good. Next i had to modify the code so that i could push values to the stack before the call eax is executed. If you at the address 00401362 you would see that MOV EBP-10,EAX instruction is executed just after GetProcAddress so basically this is the place where the handle to ZwGetInformationThread is placed on the stack hence we can only modify the code after this. That is from 401365 to 40136D where the value is pushed back into EAX. (Or we could NOP both of these so that the value remains unchanged)

So here are the modifications that i did, wait and after this modification i clicked analyse code. So you’d see that now Olly recognizes this as a function ^_^

so we have obviously overwritten the call to GetCurrentThread but the code seems to fit just fine! :)

Now do you see a push -2 at 0040136B i had assembled PUSH 0xFFFFFFFE. :) And also since this is windows you would have to push the last argument first… just in case you did not know this.
Now before you run the code remember to save all modifications to exe because if the code is successful you would be detached from the debugger.
And finally we run the program. We Get the pop ups. And next we are detached from the debugger. :) (The code screen goes blank. Try reloading with << button.
The Blank Screen :

The Error :

H3LL Y34H! B)

I am currently working on anti-debugging techniques which will also be my project for this year in college.Though i know for a fact  most basic anti-debug techniques are  API based techniques, but i am still doing this post because firstly i did not find any working code and whatever non-working code was present was also implemented locally… By the way I am really impressed by the work compiled by Tyler Shields in 2009 and he has put up some of the best resources out there!

This post is basically about one of those standard API’s > CheckRemoteDebuggerPresent function. Now there is enough stuff on msdn and other websites that you can find about its implementations and about the working of the function however for some reason they did not work for me! So here is what finally worked. And I have done a remote process example too.

Implementation for process locally 

#ifndef _WIN32_WINNT
#define _WIN32_WINNT 0x0601
#endif
#include<windows.h>
#include<stdio.h>
#include<conio.h>

int main()
{
BOOL pblsPresent = FALSE;
HANDLE hndle = NULL;

CheckRemoteDebuggerPresent(GetCurrentProcess(),&pblsPresent);
if(pblsPresent){
printf(“Being Debugged\n“);
}
else{
printf(“Not being debugged\n“);
}
getch();
return 0;
}

Implementation For Remote Process (with PID 2800)

#ifndef _WIN32_WINNT
#define _WIN32_WINNT 0x0601
#endif
#include<windows.h>
#include<stdio.h>
#include<conio.h>

int main()
{
BOOL pblsPresent = FALSE;
HANDLE hndle = NULL;

hndle=OpenProcess(PROCESS_ALL_ACCESS,FALSE,2800);

if(hndle){
printf(“Done getting a handle \n“);
}else {
printf(“Invalid PID \n“);
}
CheckRemoteDebuggerPresent(hndle,&pblsPresent);
if(pblsPresent){
printf(“Being Debugged\n“);
}
else{
printf(“Not being debugged\n“);
}
getch();
return 0;
}

so I reached sector 16A by 4:00pm and was looking was the “Times Internet Limited” however there was no such building… I realised that after having walked for 3 kms around the same building… so I showed the exact address to one of gaurds (you will see a lot of them if you are in this area). He could locate where the plot FC-6 is.. so i had to walk back the entire boundary wall to reach the enterance gate of Times India Limited. (not times internet limited). So finally i confirmed with the gaurds of the building weather tlabs was in the same building or not they said it was and I was finally relaxed! I reached the place, it was huge…looked almost like a 5 star hotel’s reception. So when i entered the first floor they gave me a slip which was required for exit. :O So when I reached the lab the Tlabs the entire room was larger than the auditorium we have at MSIT. I was a bit nervous then getting to question myself …weather my presentation would be good enough.. are they gonna like it… But man awesome building. :D So now I had talk with my friend who motivated me to go there and just do it… so I just went there… and actually there were two events going on simultaneously some hacking event and our meet… that mean have of the crowd was actually going to be my audience…

aah there i saw mr. Aseem…. pulled up a chair.. and sat near the “group”. Now in the large room… there were only around 15 people who had come for the meet…so it more of a drawing room chit chat kind of a thing.. we had been bags sofas and chairs… in the shape of a U facing this LED tv where we were supposed to connect the laptop to give the presentation.. The first part of the presentation was Newsbyte … it was basically the “new stuff” and “update” section. I liked the part… the guy delivered his part nicely. :) Then there was a problem that we did not have much time for two presentations …hence only one of the two speakers me or shubham bhaiya could speak… So mr. aseem asked the duration of our presentations and my presentation was a shorter one so I was told to give it :) So i just got up and connected my laptop and started with my thing… now this presentation was different from any presentation i have ever given… i could see people understanding what i am saying :D that was nice…. plus yes.. i perhaps was the only one who was from college here… other people who came here were already working at different places… But offcourse my presentation was different… off beat… hence deserved the small round of applause :) So i did what i was here to do… then came back to my seat… and we started discussing about “things” and “stuff” :D Was a nice experience all together… Just that the duration was really less… we were actually almost kicked out of the building :D But i liked the whole concept of hackers meeting like this and presenting stuff …talking about security.. developments in the industry and the problems they are facing .. :) was cool really cool. Apart from that I also made good friends… the nice nature hackers.

Though I had in my mind that 2 periods! thats long …am I really gonna be able to make it till then..! Allright so this time the presentation in the seminar hall and all my classmates present there! :) The best part is that I knew they were bored like hell… obviously its not of there interest … but they supported me… they were quite and occasionally tried listening as well.. :) Thanks to them for being awesome. :) Now I started with the presentation (this time only I was doing it) and noticed that even my proctor Saba maam was present there… Then it went on ….things worked fine.. one of examples took time hence was not completed on the spot… like you know when your software does not recognize the version of the DBMS on the server… But apart from that it was nice… it went how i had planned… and also i loved the complements … in fact I got the best compliment from my proctor. She said that it was really practical… and generally seminars are not so practical!!! And that pretty much is the motto of my life… to keep things practical. :) Then my classmates’ comments… which actually gave me the right feedback and scope for improvement… Things like i need to take breaks in between, i have to interact more with the audience, include less of backtrack and I could use the zoom tool’s bar feature rather than zooming the entire screen. I would keep that in mind next time :) … and lastly the shocking part was i fucking took the entire too periods!! sorry classmates. :D
Also my offer of sharing the resources for a total of more than 12 types of sql injections is still open if you buy me a coke. :D

I am not sure if you stumbled upon this post from the archive or reached here by a search. But I am going to be verbose anyways :D

Asterisk is an open source PBX. Well i would say its too less to call it as just a PBX. It has immense potential it can do things so easily and so correctly that it is actually an unparalleled solution for PBXs. Ohkay if you are wondering what a PBX is it is those system you see in offices, where the receptionist dials one and the call is transferred to another guy. So why am I playing around with this thing… ? Well there is this one very annoying thing, rather a concept called as the “5th semeseter Project”. Exactly thats why.! :

Now for the project I could have joined some course and could have easily got a project from that institution…. But I did not like that…I did not want that… I had to go for a training in hacking and so I went for ECSA (EC COUNCIL Certified Security Analyst). Well, now I had to make a project that was related to my training and hence hacking… Shit! You give me a server and ask me to do a penetration testing I would do that…but writing a PROJECT… it seemed like the world is ending. :D

But then there was this awesome friend of mine. Mr. Vipul Bhojwani who asked me if i had an IVR solution. I did not know what that was… so I googled. Interactive Voice Respone….no i did not have a solution for that. So I asked him what does he wish to do.. He said he wants to set it up on gmail! Fuck. Wont that be awesome if someone calls you on gmail and you have an IVR set up there… yes it would be!!

I wanted that…. i started this from the scratch… and after 1 hour of googling i realized that this was possible only if i had a google voice number(which turns out to be incorrect)… which obviously i couldnt as I am in India. But every time i searched IVR on google there were results that let me to asterisk.org. I was curious that maybe somehow i can atleast complete it till the point i am not asked for a google voice number. So i downloaded asterisk. :D
And successfully configured it. Now the very next day i had a class on VOIP penetration testing at my training so I should my trainer what i had set up…. That is i should him how i could make free VOIP calls within the subnet. So he told me to intercept the call. WHAT!!!

yes he told me to capture what to guys were talking ….something like phone tapping . So i did that ..infact was a piece of cake …and here was my project born. :)
So I am making a project now on different vulnerabilites of a PBX system and the associated protocols and offcourse the ways to fix those issues. I am writing in the first person…i think that is the correct way… and i am being reaallllyyyy verbose… who so ever gets the project will be able to make such a system. I hope things work fine… I am doing a lot of reading for this… Getting to learn about new protocols day by day…

Ohkay so i somehow managed to log into the phpBB  admin control panel and learn that there are categories at the top level which will have forums and then further sub forums which can further have topics.
so by the time I understood this I had the following hierarchy ready.
Information Security
1.Information Gathering
2.Wireless Hacking
3. System Hacking
4. Metasploit

Hosting
1.Details and Plans

Linux -No Sub-forum
Ohkay after this I was filled with joy for, i had learned a great deal or atleast i thought so.
Then I logged in as a user and tried to post a new topic in the category wireless hacking. Their was just this one little problem. There was no freaking button to do that.
So here came the big problem… [box type=”shadow”] THE FORUM PERMISSIONS[/box]

If you get to know how to do this you are almost going to be as comfortable with phpBB as wordpress
Ohkay so spent a full day to get this working and finally was able to display the new topic on the user’s screen. Now i knew about the permissions in and out. I could let anyone do anything or nothing. Then came another problem… a very good friend of my pujit juneja is awesome at android and i wanted him to contribute something to the forum. I asked him weather he would do it or not…and he readily accepted to do it. But then I did not know how to upgrade a user to a moderator… well that took another hour to figure out.
Ohkay all set i was finally ready to make my first post.
And then i noticed my post could not have a code… i mean an html code… hence i could not post the youtube videos that i make… and the last problem was this adding the BBcode to do it…

If you want to add an html code you cannot add it directly…
for example the code for an embedd of the youtube video… how ever you can create a bbcode such that you provide only the video id and the code gets embedded itself..
Once i was able to do now I was happy… Finally i am expecting a lot from this forum hope I develop a healthy like minded community very soon.