Table of Contents
Foreword Dave Aitel xiii
Acknowledgments xvii
Introduction xix
1 Setting up Your Development Environment 1
1.1 Operating System Requirements 2
1.2 Obtaining and Installing Python 2.5 2
1.2.1 Installing Python on Windows 2
1.2.2 Installing Python for Linux 3
1.3 Setting Up Eclipse and PyDev 4
1.3.1 The Hacker's Best Friend: ctypes 5
1.3.2 Using Dynamic Libraries 6
1.3.3 Constructing C Datatypes 8
1.3.4 Passing Parameters by Reference 9
1.3.5 Defining Structures and Unions 9
2 Debuggers and Debugger Design 13
2.1 General-Purpose CPU Registers 14
2.2 The Stack 16
2.3 Debug Events 18
2.4 Breakpoints 18
2.4.1 Soft Breakpoints 19
2.4.2 Hardware Breakpoints 21
2.4.3 Memory Breakpoints 23
3 Building A Windows Debugger 25
3.1 Debuggee, Where Art Thou? 25
3.2 Obtaining CPU Register State 33
3.2.1 Thread Enumeration 33
3.2.2 Putting It All Together 35
3.3 Implementing Debug Event Handlers 39
3.4 The Almighty Breakpoint 43
3.4.1 Soft Breakpoints 43
3.4.2 Hardware Breakpoints 47
3.4.3 Memory Breakpoints 52
3.5 Conclusion 55
4 Pydbg-A Pure Python Windows Debugger 57
4.1 Extending Breakpoint Handlers 58
4.2 Access Violation Handlers 60
4.3 Process Snapshots 63
4.3.1 Obtaining Process Snapshots 63
4.3.2 Putting It All Together 65
5 Immunity Debugger-The Best Of Both Worlds 69
5.1 Installing Immunity Debugger 70
5.2 Immunity Debugger 101 70
5.2.1 PyCommands 71
5.2.2 PyHooks 71
5.3 Exploit Development 73
5.3.1 Finding Exploit-Friendly Instructions 73
5.3.2 Bad-Character Filtering 75
5.3.3 Bypassing DEP on Windows 77
5.4 Defeating Anti-Debugging Routines in Malware 81
5.4.1 IsDebuggerPresent 81
5.4.2Defeating Process Iteration 82
6 Hooking 85
6.1 Soft Hooking with PyDbg 86
6.2 Hard Hooking with Immunity Debugger 90
7 DLL and Code Injection 97
7.1 Remote Thread Creation 98
7.1.1 DLL Injection 99
7.1.2 Code Injection 101
7.2 Getting Evil 104
7.2.1 File Hiding 104
7.2.2 Coding the Backdoor 105
7.2.3 Compiling with py2exe 108
8 Fuzzing 111
8.1 Bug Classes 112
8.1.1 Buffer Overflows 112
8.1.2 Integer Overflows 113
8.1.3 Format String Attacks 114
8.2 File Fuzzer 115
8.3 Future Considerations 122
8.3.1 Code Coverage 122
8.3.2 Automated Static Analysis 122
9 Sulley 123
9.1 Sulley Installation 124
9.2 Sulley Primitives 125
9.2.1 Strings 125
9.2.2 Delimiters 125
9.2.3 Static and Random Primitives 126
9.2.4 Binary Data 126
9.2.5 Integers 126
9.2.6 Blocks and Groups 127
9.3 Slaying WarFTPD with Sulley 129
9.3.1 FTP 101 129
9.3.2 Creating the FTP Protocol Skeleton 130
9.3.3 Sulley Sessions 131
9.3.4 Network and Process Monitoring 132
9.3.5 Fuzzing and the Sulley Web Interface 133
10 Fuzzing Windows Drivers 137
10.1 Driver Communication 138
10.2 Driver Fuzzing with Immunity Debugger 139
10.3 Driverlib-The Static Analysis Tool for Drivers 142
10.3.1 Discovering Device Names 143
10.3.2 Finding the IOCTL Dispatch Routine 144
10.3.3 Determining Supported IOCTL Codes 145
10.4 Building a Driver Fuzzer 147
11 Idapython-Scripting Ida Pro 153
11.1 IDAPython Installation 154
11.2 IDAPython Functions 155
11.2.1 Utility Functions 155
11.2.2 Segments 155
11.2.3 Functions 156
11.2.4 Cross-References 156
11.2.5 Debugger Hooks 157
11.3 Example Scripts 158
11.3.1 Finding Dangerous Function Cross-References 158
11.3.2 Function Code Coverage 160
11.3.3 Calculating Stack Size 161
12 Pyemu-The Scriptable Emulator 163
12.1 Installing PyEmu 164
12.2 PyEmu Overview 164
12.2.1 PyCPU 164
12.2.2 PyMemory 165
12.2.3 PyEmu 165
12.2.4 Execution 165
12.2.5 Memory and Register Modifiers 165
12.2.6 Handlers 166
12.3 IDAPyEmu 171
12.3.1 Function Emulation 172
12.3.2 PEPyEmu 175
12.3.3 Executable Packers 176
12.3.4 UPX Packer 176
12.3.5 Unpacking UPX with PEPyEmu 177
Index 183
