Debugger Debugging Madness2005-11-02

Make / View Comments

Recently, I was setting up a new installation of IDA and decided to document all of my customizations for ease of portability. I am curious to hear about what other customizations people use / have come across. Should make for an interesting dialog. Here are the customizations I use: 

---------- ida.idc ----------
#include 
#include 
#include 
#include 

static main(void) {

//
// This function is executed when IDA is started.
//
// Add statements to fine-tune your IDA here.
//

    AddHotkey("Ctrl-Shift-X",     "export_disassembly");
    AddHotkey("Ctrl-Shift-J",     "jump_to_func_top");
    AddHotkey("Ctrl-Shift-Enter", "track_follow");
    AddHotkey("Ctrl-Shift-N",     "track_name");
...

---------- ida.cfg ----------
Some of these customizations were gleaned from Nicolas Brulez

// This prefix is used when a new
// name is generated
// changed this from 'a' to 'str->'
ASCII_PREFIX = "str->"

// Maximal length of new names
// (you may specify values up to 511)
// increased this to 128
MAX_NAMES_LENGTH = 128

// asm specific character, added '-' and '>'
NameChars = "$?@->"

SHOW_XREFS        = 4
SHOW_BASIC_BLOCKS = YES
SHOW_SP           = YES

---------- idagui.cfg ----------
HELPFILE = "c:\\OPCODES.HLP"

// Display the Edit,Patch submenu
DISPLAY_PATCH_SUBMENU = YES

// Display the expressions/IDC command line
DISPLAY_COMMAND_LINE  = YES

// display referenced items
"ChartXrefsTo"   = "Ctrl-Shift-T"

// display referencing items
"ChartXrefsFrom" = "Ctrl-Shift-F"

// lock the current highlighted text
"LockHighlight"  = "Ctrl-H"

All of the above referenced files are available from my file respository on OpenRCE.

Make / View Comments

IDA Disassembly and Graph Coloring2005-09-20

Make / View Comments

ToorCon was awesome. This was my first time out to that con (as well as San Diego for that matter) and it more then lived up to expectations. The venue was good, the weather was great and the party was successful, thanks in no small part due to a financial contribution from Microsoft I'm sure.

There were a number of good talks there. Among the more unique/interesting was Skape's presentation on "temporal return addresses" and Christopher Abad's talk where he cracked basic crypto with Photoshop and demo-ed a multi-color ASCII "video" streamer he wrote. Some of Christopher's work can be found at http://the-mathclub.net.

Make / View Comments

IDA Customizations2005-08-01

Make / View Comments

Still recovering from a week in Vegas. I have a new founded respect for teachers/professors. The two day intermediate malware analysis course I gave put my voice out of commission. I don't know how it's possible to maintain that for months on end. Talking over loud music definetely didn't help the situation. Vegas was a blast. Caught some good talks at Blackhat, put a lot of faces to names at the various parties- the most amazing of which was the 3Com/TippingPoint party held on Wednesday night at the Hard Rock. There must have been almost a thousand people there and the place was out of control. Who would have guessed that the dance floor of a security conference party would ever fill up. In my (currently unbiased) opinion this party was the best of the week.

Speaking of currently unbiased. I will be transitioning to TippingPoint over the balance of this month and am excited about the career change. Once I get settled in I will start tackling the long list of feature requests for OpenRCE. Including: adding an events section, the ability to edit posts, a new (and very cool) reference library feature that Greg Hoglund may potentially contribute, blog comments etc...

The re-architecting and development of IDA Sync will follow shortly after the updates to OpenRCE. Once the ground work is laid out I will poll the users via the forums for comments, criticisms and suggestions.

Make / View Comments

Process Stalker Tool Release2005-07-06

I released Process Stalker publicly today, open source and available for download from http://labs.idefense.com. Process Stalking is a term coined to describe the combined process of run-time profiling, state mapping and tracing. Consisting of a series of tools and scripts the goal of a successful stalk is to provide the reverse engineer with an intuitive visual interface to filtered, meaningful, run-time block-level trace data.

A step-by-step example walkthrough of Process Stalker vs the Microsoft MS05-030 security bulletin is available at http://www.openrce.org. Binaries, source code and in-depth documentation are available in the bundled archive. Relevant slideshows from Process Stalker presentations are available on the past speaking engagements page.

The IDA Function Analyzer component was used and extended in the development of Process Stalker. The biggest change is the addition of the gml_export() routine for generating GML graphs.

MS05-025 PNG Image Rendering Vulnerability2005-06-21

Spent some time with spoonm over the weekend at RECON tinkering with the MS05-025 PNG vulnerability. Using my own not-as-cool-as-halvar's bindiff tool I came across the following significant change:

ms05025_diff.gif


The left column is pre-patch and the right column is post-patch. Further tracing reveals the actual vulnerable loop that leads to heap corruption, a jump table for which case 0x9 is required to reach the vulnerable function and some other interesting tidbits. All in all the vulnerability wasn't difficult to pin point, the biggest hurdle is overcoming the lazyness required to generate a valid PNG image as the CRC checks are done prior to reaching the vulnerable code.