Finding the appropriate ReadFile

There are applications reading data from numerous files when they're running. If you want to intercept when the certain file is being read, one possibility is to put breakpoint, let's say, on ReadFile() and wait for the debugger to break in. It happens that the debugger constantly breaks in on ReadFile() that you're not interested in. It can be extremely time consuming to ignore the unwanted debugger breaks until the certain file is being read.

This is a Windbg script that I usually use it as a template to intercept when a certain file is being read. It checks for specified value in the buffer of ReadFile(), and if the vaule matches the debugger can break in.

Fuzzing Control Transfer Instructions

Earlier last year, I wrote about my Flash fuzzer for example here and here.

This weekend I just added a little improvement to it. Since I was able to reach the byte codes of DoABC tag and to parse them, there is a lot of possibility to implement fuzzing opportunities by little changes.

What I did is the ability to alter control transfer instructions for ifeq, iffalse, ifge, ifgt, ifle, iflt, ifnge, ifngt, ifnle, ifnlt, ifne, ifstricteq, ifstrictne, iftrue, jump to change the target address of them. These instructions take only one operand that is fixed-length: 24-bit signed integer that is 3 bytes, so it was very straightforward to parse and change them.

One thing I wanted to pay attention that is the target of jumps should be within the region of the method but it was quick to implement this because the method addresses and sizes are already available from the parser info.

Unexpected Thickness of SplitContainer

I haven't really been involved in C# apart from spent the whole 2011 to reverse engineer MSIL code at work but that wasn't about programming; it was about to debug .NET code without using reference to source code, but in fact, none of real programming experience.

My role has been changed at work, and it's unlikely I will continue with .NET anyhow. This is a great opportunity for me to fill my freetime with C# programming - I find .NET interesting, have the (low-level) basics of the virtual machine after all, and people say it's (very) straightforward to get on with it at development point of view.

Here is the first impression involving SplitContainer.

I needed to split the screen into three panels. SplitContainer divides the display area into two panels, but when you use only one instance, you cannot really use it to divide the display area into three panels. I managed to use two SplitContainers to divide the display area into three panels. There is the main SplitContainer, and there is the secondary SplitContainer put on one panel of the main SplitContainer's. I had three panes and I thought that was it.

I set SplitterWidth to 1 on both of SplitContainers to narrow the thickness of the splitter. Launched the program to check if it looked as expected, but in reality, it didn't. Here is how it looked.

As you can see above that the splitter of the secondary SplitContainer was not as thick as the splitter of the main SplitContainer. It's interesting because, on the design view, it looked good.

I set SplitterWidth to 2 and checked the result but the thickness of the splitters have different sizes when started the program.

I set SplitterWidth to 4 and surprisingly the result looked good. The splitters, however, were too wide to use it in a program. You can see ot on the picture below.

The solution is as follows. I don't know the root cause of this but I realized if I set SplitterWidth to 1 in the constructor of the Form, the splitters' wide have the same size, as seen below.

Above experiences are with Microsoft Visual C# 2010 Express.

Software and Visual Thinking

Being said that the design of Graphical User Interface should not introduce new functionality in the application. The GUI and the functionality should be separated, and implemented on different levels which pretty much seems to be logical for me, but I'd add something important to this general claim.

There are people, including me, who are more of visual types. For me, visual things excite the imagination and when representing things visually, I can create new things from them that have some kind of value.

It happened to me numerous times to get new ideas involving awesome functionalities during the design of GUI. These ideas didn't come to my mind when I was focusing exclusively on functionality design.

Freedom inhibits creativity. When you're on the design of GUI, there are many restrictions (that you can see) and this stimulates the brain to create some new ideas.

I've imagined an application consists of multiple functions. Actually, it is a mix and improvement of some tools I wrote earlier. I'd put these small ideas into one application, by doing so, there is the possibility to connect those small functions to work together and would take the advantage of it. Also, I have some ideas about functionalities that I've seen in other applications, albeit that need change according to imagination.

The basic is as follows. The input is the (unknown) binary file. You can browse the file, can discover the structure of it, can display distribution diagrams and others. Also, can apply particular algorithms on data such as decoding compressed stream or display multimedia content.

Analysis of Data Formats by Guessing - Part II

I'm writing about how to find possible TIMESTAMP values in raw binary data.

Here is the first part of data format analysis by guessing but you can read this entry independently anyway.

TIMESTAMP is a DWORD value, represents Unix time, and we assume it's encoded as little-endian somewhere in the binary.

The prototype program reads the binary data into a byte array. It iterates through the array elements by reading four bytes at each position in the array, interprets as DWORD, and compares if the value falls into the date range we are after.

The looser date range you set the more likely to find false positives in your search result.

I've tested the code with a relatively strict date range, i.e. one month, and didn't find any false positives but did find TIMESTAMP. There were cases when multiple TIMESTAMPs found in PE files; for example one in the header and one in the .rdata section.

If you cannot set a loose date range, and there is a likelihood you came across to false positives you can filter out the results by applying some of the below.

• You know more about the date e.g. it cannot be Saturday or Sunday?
• It should be in a high entropy region of the dump, or on the contrary?
• There might be other values stored around, do you know more about those values? Presence of scattered zeroes?
• Should it be aligned to some value?

Analysis of Data Formats by Guessing - Part I

Usually, the most straightforward way to do an analysis of data format is to observe how the data is parsed by the application. However, there might be cases when the application parses the data is not available. In that case, the analysis migh be done by relying on the data itself and on general tools only.

In this post, I discuss three random ideas that might be helpful to explore unknown data formats without using the application parses the data.

• To spot the presence of run-length encoding (RLE) you might look at string chunks in a relatively non-redundant (high entropy) data dump. String chunks might indicate that the original data contains string; also the string chunks in RLE dump might be found in the original data multiple times, likely, as a part of longer strings.
• To spot the presence of IA32 code, you might look at instruction patterns such as CALL or JUMP in a relatively redundant data dump. The above instructions have bytecode of E8 and E9 followed by four bytes relative address that could also be included in the validation for more precise discovery.
• Repetitive bytes could mean padding bytes, for example, to align a structure. Scattered bytes, usually 00s or FFs, could indicate the representation of positive or negative numbers. It could mean either pointer, or offset, or table of numbers, etc.

I call this process abductive reverse engineering. We don't have deductive evidence about the meaning of the structures in the data but we are able to form an explanatory hypothesis about their meaning.