1 of 59

Angry Hacking

How angr pwned CTFs and the CGC

2 of 59

Zardus

kereoz

rhelmot

nezorg

Fish

salls

3 of 59

Zardus

4 of 59

Fish

5 of 59

Motivation 6 mins

Fundamentals of angr 3 mins

Pure awesomeness

angr modules 7 mins

Symbolic execution

Static analysis

angr applications 25 mins

"Crypto" challenge

Rop gadget finder

Executing arbitrary code

Cyber Grand Challenge

Open source! 3 minutes

http://angr.io

Credits

6 of 59

Why angr?

7 of 59

BAP

BitBlaze

amoco

BARF

Bindead

Triton

CodeReason

radare2

PySysEmu

miasm

paimei

insight

rdis

SemTrax

JARVIS

Jakstab

vivisect

8 of 59

2005 Hex-Rays was founded

2015 ???

2007 Hex-Rays Decompiler 1.0

2009 Hex-Rays IDA 5.5

2013 Hex-Rays IDA 6.4

2011 Hex-Rays IDA 6.1

9 of 59

10 of 59

11 of 59

Fundamentals of angr

12 of 59

  • iPython-accessible
  • powerful analyses
  • versatile
  • well-encapsulated
  • open and expandable
  • architecture "independent"
    • x86, amd64, mips, mips64, arm, aarch64, ppc, ppc64

13 of 59

14 of 59

Static Analysis Routines

Symbolic Execution Engine

Control-Flow Graph

Data-Flow Analysis

Binary Loader

Value-Set Analysis

angr

15 of 59

ARE YOU READY FOR THE ANGRY POWER?

16 of 59

Symbolic execution

17 of 59

"How do I trigger path X or condition Y?"

​

  • Dynamic analysis
    • Input A? No. Input B? No. Input C? …
    • Based on concrete inputs to application.
  • (Concrete) static analysis
    • "You can't"/"You might be able to"
    • Based on various static techniques.

​

We need something slightly different.

18 of 59

"How do I trigger path X or condition Y?"

​

  • Interpret the application.
  • Track "constraints" on variables.
  • When the required condition is triggered, "concretize" to obtain a possible input.

19 of 59

Constraint solving:

​

  • Conversion from set of constraints to set of concrete values that satisfy them.
  • NP-complete, in general.

Constraints

x >= 10

x < 100

x = 42

Concretize

20 of 59

x = int(input())

if x >= 10:

if x < 100:

print "Two!"

else:

print "Lots!"

else:

print "One!"

​

21 of 59

x = int(input())

if x >= 10:

if x < 100:

print "Two!"

else:

print "Lots!"

else:

print "One!"

State A

Variables

​

x = ???

Constraints

​

------

22 of 59

x = int(input())

if x >= 10:

if x < 100:

print "Two!"

else:

print "Lots!"

else:

print "One!"

State A

Variables

​

x = ???

Constraints

​

------

State AA

Variables

​

x = ???

Constraints

​

x < 10

State AB

Variables

​

x = ???

Constraints

​

x >= 10

23 of 59

x = int(input())

if x >= 10:

if x < 100:

print "Two!"

else:

print "Lots!"

else:

print "One!"

State AA

Variables

​

x = ???

Constraints

​

x < 10

State AB

Variables

​

x = ???

Constraints

​

x >= 10

24 of 59

x = int(input())

if x >= 10:

if x < 100:

print "Two!"

else:

print "Lots!"

else:

print "One!"

State AA

Variables

​

x = ???

Constraints

​

x < 10

State AB

Variables

​

x = ???

Constraints

​

x >= 10

State ABA

Variables

​

x = ???

Constraints

​

x >= 10

x < 100

State ABB

Variables

​

x = ???

Constraints

​

x >= 10

x >= 100

25 of 59

x = int(input())

if x >= 10:

if x < 100:

print "Two!"

else:

print "Lots!"

else:

print "One!"

State ABA

Variables

​

x = ???

Constraints

​

x >= 10

x < 100

Concretized ABA

Variables

​

x = 99

26 of 59

27 of 59

Static analysis

28 of 59

29 of 59

angr’s CFG

IDA’s CFG

  • More accurate
  • More options (context sensitivity level, backward slicing, symbolic traversal, etc.)
  • Much slower
  • Less accurate
  • Fewer options
  • Faster

30 of 59

In [1]: import angr

​

In [2]: p = angr.Project("fauxware")

​

In [3]: cfg = p.analyses.CFG()

​

In [4]: print len(cfg.graph.nodes())

78

​

​

31 of 59

I want a faster CFG...

Check out GirlScout!

Umm... what’s BoyScout?

32 of 59

Memory access checks

Type inference

Variable recovery

Range recovery

Wrapped-interval analysis

Value-Set Analysis

Abstract interpretation

33 of 59

Gogul Balakrishnan

Value-Set Analysis (VSA)

WYSINWYX: WHAT YOU SEE IS NOT WHAT YOU EXECUTE

34 of 59

Example

​

What is rbx in the yellow square?

cmp rbx, 0x1024

ja _OUT

cmp [rax+rbx], 1337

je _OUT

add rbx, 4

rbx?

mov rax, 0x400000

mov rbx, 0

Symbolic execution: state explosion

Naive static analysis: "anything"

Range analysis: "< 0x1024"

Can we do better?

35 of 59

Value Set Analysis - Strided Intervals

​

4[0x100, 0x120],32

Stride

Low

High

Size

0x100

0x10c

0x118

0x104

0x110

0x11c

0x108

0x114

0x120

36 of 59

Example

​

What is rbx in the yellow square?

cmp rbx, 0x1024

ja _OUT

cmp [rax+rbx], 1337

je _OUT

add rbx, 4

rbx?

1.

1[0x0, 0x0],64

2.

4[0x0, 0x4],64

3.

4[0x0, 0x8],64

4.

4[0x0, 0xc],64

5.

4[0x0, ∞],64

6.

4[0x0, 0x1024],64

mov rax, 0x400000

mov rbx, 0

Widen

Narrow

1

2

3

4

5

6

37 of 59

  • Limited variable relation analysis

extended Value-Set Analysis (VSA)

mov rcx, rax

dec rax

cmp rax, 5

je Left

Left

...

Right

...

rax == 5

38 of 59

  • Limited variable relation analysis

extended Value-Set Analysis (VSA)

mov rcx, rax

dec rax

cmp rax, 5

je Left

Left

...

Right

...

rax == 5

rcx == 6

39 of 59

  • Signedness-agnostic

Wrapped-interval analysis

​

​

extended Value-Set Analysis (VSA)

Jorge A. Navas

Peter Schachte

Harald Sondergaard

Peter J. Stuckey

Signedness-Agnostic Program Analysis: Precise Integer Bounds for Low-Level Code

40 of 59

angr applications

41 of 59

ROP gadget finder

42 of 59

"Crypto" Challenge!

43 of 59

Executing arbitrary code

44 of 59

rxc: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.24, stripped

​

We got some suspected ROP chains from the traffic!

45 of 59

rxc: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.24, stripped

​

Calling the tea_encipher() function

tea_encipher(info_block* info, void* data, int size);

46 of 59

Binary diffing

47 of 59

Cyber Grand Challenge

48 of 59

49 of 59

50 of 59

51 of 59

CB�vulnerable program

RB�patched program

POV�exploit

Cyber�Reasoning�System

52 of 59

CB

Proposed�RBs

Proposed�POVs

Autonomous vulnerability scanning

Shellphish CRS

Autonomous service resiliency

PCAP

Test cases

POV

RB

Autonomous processing

Autonomous patching

53 of 59

Program

Symbolic �inputs

Symbolic

execution engine

Security policies

Security

policy checker

POVs

54 of 59

Open Source

55 of 59

Major contributors:

  • Zardus - Yan Shoshitaishvili
  • Fish - Ruoyu Wang
  • kereoz - Christophe Hauser
  • rhelmot - Andrew Dutcher
  • nezorg - John Grosen
  • salls - Chris Salls

Special thanks to:

  • our professors
  • DARPA VET Project
  • DARPA Cyber Grand Challenge

56 of 59

Open angr!

​

​

Pull requests, issues, questions, etc super-welcome! Let's bring on the next generation of binary analysis!

Birthday: September 2013

Total line numbers: 59950

Total commits: ALMOST 9000!! (actually ~6000)

57 of 59

58 of 59

Draft and backups

59 of 59

  • motivation (keep it quick) - 6 mins
    • "In the beginning, there was IDA. However, as the field of binary security advanced, there is now … still IDA?"
    • We need something more!
    • There are a few solutions, but they all suffer from lacking one of: cross-platform, open, active, usable.
  • angr fundamentals - 3 mins
    • power (state-of-the-art)
    • ease of use (abstraction)
    • expandable, cross-platform, blah blah
  • main components - 20 minutes
    • introduce a demo: some combination of a crackme and a pwnable
    • symbolic execution (slides + demo)
      • the demo should get us past the crackme portion using angr's symbolic execution
    • VSA (slides + demo)
      • the demo should allow us to identify an overflow to pwn
    • dynamic execution (slides + demo)
      • we'll demo a shellcode that's used to exploit the overflow
  • angr applications - 10 minutes
    • rop gadget finder (demo)
    • binary diffing
    • Cyber Grand Challenge
  • open source! - 3 minutes
    • http://angr.io
    • Credits