64

The title mentions "sandbox" but VMWare or QEMU is usually not called that, so the question seems to be more about "how do I analyze it without a danger of infection?" There are three broad categories of tools and approaches you could take here. 1. User-mode sandboxes A user-mode sandbox basically runs the sample being investigated but intercepts all or ...


22

Bochs if you don't need speed but lots of flexibility. You can use Bochs with GDB. Qemu if you need more speed and less flexibility (it does dynamic translation so you gain bit of speed but lose the acutal sequence of the instructions) possibly a bit less safe than bochs. Its similar to Vmware and virtualbox actually derives from it. You can use GDB with ...


19

You may capture the traffic with packet sniffer to capture all the communications of client\server application, or You may use reverse proxy to intercept and alter data in real time. In simple words, network sniffers allow You to see data flow between client and server, analyse it and reverse the protocol communications Reverse proxy intercept communication ...


15

Gilles provided some great links and I want to discuss the use a virtual machines for malware analysis a bit more. While a VM breakout certainly is a possibility, I have yet to come across such a case or even heard about one and I assume this would make some buzz should someone find one. To be safe, simply run your VM software on an isolated computer and ...


15

Problem description Let's make a couple of assumptions. Software is divided into functional components. Licenses are for functional components within that software package. Licenses can be based on time, on version or on a number of uses, i.e you may use the functionality until a set point in time, you may the functionality of the version you purchased or ...


14

Clearly Peter has addressed the main points of proper implementation. Given that I have - without publishing the results - "cracked" two different dongle systems in the past, I'd like to share my insights as well. user276 already hints, in part, at what the problem is. Many software vendors think that they purchase some kind of security for their licensing ...


11

Some information might be found in Barnaby Jack's BlackHat presentation: Jackpotting Automated Teller Machines (Youtube) The most prevalent attacks on Automated Teller Machines typically involve the use of card skimmers, or the physical theft of the machines themselves. Rarely do we see any targeted attacks on the underlying software. Can't find the ...


7

In the paper Heart of Darkness - exploring the uncharted backwaters of HID iCLASS TM security is a technique described (section III.C) that might work,but it does require a working device which might not be at hand in your situation. In short they use a TTL-232 cable in synchronous bit bang mode to emulate the PIC programmer. They then override the boot ...


7

There are a couple of ways that come to mind. The first would be to use a network packet analyzer on the actual client running the application. Some well known packet analyzers are Wireshark, tcpdump, and even Microsoft Network Monitor. Another alternative would be to intercept the traffic via man-in-the-middle (M. The easiest way to do this (if you control ...


6

As Peter has indicated, looking at how the dongle is used for security is the starting point to identify the attack vectors. In most cases, the software developers implementing the dongle security is the weakest point. In the past when I have tested software with dongles, I have used free tools like ProcessMonitor and RegShot to identify simple ...


6

Literally, for a first look on malware, you won't need anything special locally installed. There are enough online sandboxes you may use: virustotal.com have their sandbox implemented using Cuckoo Sandbox. When you apply new sample, it automatically executed as part of analysis. After about 10-15 mins you can see the result in "Behavioural information" ...


6

On modern systems the most obvious culprit is probably address space layout randomization, but stack frame layout variablity was problematic for exploit development even before ASLR became widely implemented. This was alluded to in AlephOne's venerable "Smashing the Stack for Fun and Profit": The problem we are faced when trying to overflow the buffer of ...


5

All ATMs that I am aware of and have worked on in a past life have a way to get into 'admin' mode either from the front or a rear keypad. Methods vary. Sniffing a network probably won't help as the communication is encrypted. That said, buy one: http://www.atmexperts.com/used_atm_machines.html http://www.bellatm.net/Default.asp Then you'll have all the ...


5

You can't do much without physical access, if not to the specific machine you're attacking then to the same or similar model. That's what Barnaby Jack did - he ordered 3 ATM machines and investigated them at home. I suppose there may be service menus reachable from the normal screen by some key combinations but I wouldn't count on it. Once you know the ...


5

Just before posting this answer I realized he's asking how to do this on windows and my answers is for Mac. I'm posting it regardless because I believe it might be useful for others trying to perform the same thing but then using a Mac If you're using a Mac, then it's really easy by the combination of a Remote Virtual Interface (rvi) and Wireshark. Note ...


5

You should not confuse "code protection" and "code obfuscation". "Code protection" techniques target in recognizing code modifications (you mention a checksum) and take suitable means like crashing or delivering wrong results when tampering with the code has been recognized. Anti-Debug measures also belong into this category. "Code obfuscation" in a binary ...


4

There is no LIF file in the D-Link binary file containing the firmware image. file returns a false positive. Since there is no LIF file present, tools in the lifutils package will fail or produce erroneous results Do not trust tools implicitly. Tools can return false positives if they rely on magic numbers, particular byte sequences and the like. When ...


4

Another option that's pointed out in the comments above by @CallMeV is to use hooking. On Windows you may look at using EasyHook.


4

If the network traffic is in "plain text" (not encrypted) then a network sniffer such as Wireshark is ideal. If the network traffic is encrypted via SSL but you have the private key (or if the client application does not validate the server's public key) then you can use a proxy such as Burp. If the network traffic is encrypted via SSL and you don't have ...


3

You can build your own USB RF receiver fairly cheaply, for example: http://hackaday.com/2012/03/20/software-defined-radio-from-a-usb-tv-capture-card/ This might be a good starting point, run the usb receiver, sniff the RF, press some buttons and see what happens :)


3

Not in the long run. Hashing of certain parts of files is still used to push data updates quickly when a new malicious sample shows up in the wild, to get the clients protected as soon as possible. But malware nowadays is very polymorphic so hashing is easy to defeat. Detailed analysis of samples take a lot of time often weeks or months and after that ...


3

This paper shows why it is not the best choice using MD5 for virus signatures. You should avoid SHA-1 also, because practical collision may be possible within years. So, consider using SHA-256 or SHA-3.


3

The import table can theoretically have as many references to a DLL as there are imports. It is a function of the linker that produces this effect, and in some cases, the linker does not perform any kind of string pooling. Borland products treat units as stand-alone objects, so any imported functions that are used are included without reference to any ...


3

Bachelor's project is supposed to be a showcase of a person's strengths in computer science ... I don't have any first hand experience of [reverse engineering] Given your two statements above, I would posit that you should not do your bachelor's project on reverse engineering :(


2

If the whole purpose of your application is to let the user input some data and then create a file in a specific file format from that data and you want to prevent unauthorized users from doing that, then yes, moving the file creation to a server will prevent that. Though there are still some things to keep in mind: You need to secure your server. If an ...


2

In short, no. If they're going to implement the "crypto" in Javascript in this way there isn't anything you can do beyond more obfuscation. This is 100% applicable to this situation but see MataSano's article here explaining pitfalls of client side authentication using JavaScript. Similar to what's touched on in the article, the issue is that no matter ...


2

Its a base64 that once decoded will give you a HEX string, that if converted to chars will let you find your reversed flag string: Redacted reversed flag: }6b4d**********05b{galf Redacted flag is: flag{b508**********3d4b6}


1

As you mentioned, many things can leave you with a different memory layout than the one you expect: The name of the binary is one. The environment variables the binary gets is another one. If it's being debugged (related to the previous point) Security measures such as stack cookies Etc Using hardcoded addresses pointing to the stack as the address that ...


1

Generally speaking finding vulnerabilities is not only about static reverse engineering, there are also dynamic techniques such as fuzzing. There are some fuzzing frameworks/products that can be used for this, part of them are using dynamic instrumentation and such as AFL, some part gives you an ability to configure generation of the data such as Peach. ...


1

No form of hashing, when used alone, is a good way of developing an AV solution. While hashes can be useful for finding instances of a known sample across a network, heuristic and behavioural AV systems are far more likely to protect the host from infection.


Only top voted, non community-wiki answers of a minimum length are eligible