7

Problem: We want to be able to tell with some certainty that specific versions of internal libraries are being used by a program. For example, if a software uses old, deprecated libraries internally. Also, we would like to be able to tell what shared libraries it is using on the host system.

What we have done so far: we used strings2 to look at UNICODE and ASCII strings in the executable. Manual analysis of these strings may provide library versions being used internally some times. As you can imagine, this is an inefficient method and not very reliable. We also looked at 'Dependency Walker' to build a tree of all dependencies. This doesn't allow us to know if outdated libraries are being used internally though. We also read two research papers around the subject:

Question: Is there a better way or an approach to be able to determine if an executable is using outdated libraries internally? For example, looking at strings is one possible way but is there a way to automate this? Because otherwise, looking at 1000s of lines of ASCII and UNICODE strings can get time consuming.

  • What do you mean by internal libraries? Static libraries? – fpmurphy Jul 2 '18 at 3:55
  • Yes, static libraries that the software brings with itself as opposed to calling a shared library at host. – learnerX Jul 2 '18 at 14:36
1

I can see two paths for moving forward.

First, following your current approach, you can probably detect version information and library automatically in the strings you find. This is not a bulletproof solution but will save you the time of manually reading thousands of strings.

Go through the task of creating FLIRT, or one of the many function level binary diffing tools out there with different versions of various libraries.

  • "...you can probably detect version information and library automatically in the strings you find..." That's what we were thinking as well. Is there a tool that already does something similar or do we need to write ased / awk / grep query instead? – learnerX Jul 2 '18 at 14:37
  • I'm not familiar with anything specifically for versions, but I do think that should be easy enough to do and improve as more input/data arrives. – NirIzr Jul 2 '18 at 15:08
  • IDA FLIRT will not work if a function's 'signature' does not change between library versions. – fpmurphy Jul 3 '18 at 16:22
  • @fpmurphy1 You can manually edit the autogenerated flirt signature to be more precise. – NirIzr Jul 3 '18 at 16:23
  • 1
    @NirIzr. Just checked the FLIRT toolset. You can use the -p## switch with pct, plb, etc., to specify a length other than the default 32 bytes. And, yes, you can manually sppend additional byes to a specific signature. – fpmurphy Jul 3 '18 at 18:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.