Book Image

Binary Analysis Cookbook

By : Michael Born
Book Image

Binary Analysis Cookbook

By: Michael Born

Overview of this book

Binary analysis is the process of examining a binary program to determine information security actions. It is a complex, constantly evolving, and challenging topic that crosses over into several domains of information technology and security. This binary analysis book is designed to help you get started with the basics, before gradually advancing to challenging topics. Using a recipe-based approach, this book guides you through building a lab of virtual machines and installing tools to analyze binaries effectively. You'll begin by learning about the IA32 and ELF32 as well as IA64 and ELF64 specifications. The book will then guide you in developing a methodology and exploring a variety of tools for Linux binary analysis. As you advance, you'll learn how to analyze malicious 32-bit and 64-bit binaries and identify vulnerabilities. You'll even examine obfuscation and anti-analysis techniques, analyze polymorphed malicious binaries, and get a high-level overview of dynamic taint analysis and binary instrumentation concepts. By the end of the book, you'll have gained comprehensive insights into binary analysis concepts and have developed the foundational skills to confidently delve into the realm of binary analysis.
Table of Contents (12 chapters)

Installing a 32-bit Ubuntu 16.04 LTS Desktop virtual machine

Congratulations! If you've made it this far, then you're ready to begin installing and configuring our first virtual machine. For this recipe, we'll use the 32-bit Desktop version of Ubuntu 16.04 LTS.

In this recipe, we will work through the steps for configuring a virtual machine based on the Ubuntu 16.04 LTS Desktop 32-bit architecture. Learning about binary analysis on a 32-bit system will help us to transition much more smoothly when we dive into binaries on a 64-bit system.

Getting ready

Download the 32-bit Ubuntu 16.04 LTS Desktop ISO from the following location: http://releases.ubuntu.com/xenial/.

We've chosen Ubuntu 16.04 LTS because it is the last LTS release to contain a 32-bit image, which we will need to work through some of the 32-bit examples in later chapters.

How to do it...

The following instructions will guide you through creating and configuring Ubuntu 16.04 LTS Desktop 32-bit as a virtual machine in the newly installed VirtualBox:

  1. Launch the VirtualBox application if it's not open already.
  2. Once the application has launched, click on the New icon to begin configuring a new virtual machine.
  3. A new window called Name and operating system will appear, asking you to provide a name, virtual machine folder location, type, and version. Name the virtual machine BAC32, choose a Machine Folder: location according to your storage requirements, choose Linux from the Type: drop-down, and choose Ubuntu (32-bit) from the Version: drop-down. Once complete, click on Continue.
  4. In the Memory size window, set the memory size (RAM) options as appropriate for your hardware and click Continue. I used 2,048 MB, but leaving the default 1,024 MB setting should be sufficient for what we need.
  5. In the Hard disk, keep the Create a virtual hard disk now option selected and click Create.
  6. A new window will appear titled Hard disk file type. Since, at some point in the future, we may need to switch to another virtualization platform, such as VMware Workstation, we will select VMDK (Virtual Machine Disk) and click Create.
  7. For the Storage on physical hard disk window, we will select the Dynamically allocated option and click Continue.
  8. In the File location and size window, choose the size of the virtual hard drive according to your storage restrictions and then click Create. I typically use 40 GB for my virtual machines in my lab and usually never fill that space. Since we selected the Dynamically allocated option in the previous step, this setting will allow us up to the amount we configure but will not use it all at once.
  1. Now, we will return to the Oracle VM VirtualBox Manager window, where we will see our newly created virtual machine. Make sure BAC32 is highlighted along the left-hand side, and then click Settings.
  2. The general settings window will be displayed. From here, click on the Storage icon (marked 1. in the following screenshot). Underneath Controller: IDE along the left-hand side, there will be a CD icon with the words Empty (marked 2. in the following screenshot). Click on that and a new subsection of the current window will appear along the right-hand side called Attributes. Next to the Optical Drive drop-down, click the blue CD icon (marked 3.):
  1. In the pop-up menu that appears, select the Choose Virtual Optical Disk File option.
  2. A file selection window will appear. Navigate to the Ubuntu 16.04 Desktop 32-bit ISO file we downloaded previously, select it, and click Open.
  3. In the Storage settings window, click OK to accept the configuration.
  4. In the Oracle VM VirtualBox Manager window, highlight the BAC32 virtual machine along the left-hand side and click Start. The virtual machine will boot into the Ubuntu ISO.
  1. From here, follow the installation prompts within the virtual machine to install Ubuntu Desktop 16.04 LTS 32-bit. During the installation process, you'll see a prompt requesting you to set a hostname. In order to make it easier to see which virtual machine we're using, set the hostname to bac32. At the end of the installation process, Ubuntu will ask you to hit Enter to reboot. Do so. Once rebooted, you'll have a working virtual machine.

How it works...

This recipe installs the necessary files and configurations so that you can run a 32-bit version of Ubuntu 16.04 LTS Desktop as a virtual machine. We will use this virtual machine to work through the 32-bit recipes that are presented throughout this book.

There's more...

When you first launch into this virtual machine, you may notice that the display is incredibly small compared to the resolution of your monitor. That's because the VirtualBox Guest Additions haven't been installed. If you plan on altering the resolution of your Ubuntu virtual machines, and you want to enable copy/paste between virtual machines and your host operating system, feel free to install the Guest Additions. In the virtual machine menu bar, select Devices | Insert Guest Additions CD Image... and follow the installation prompts.

See also

If you'd like to install additional virtual machines for general curiosity, all you need is the ISO for whatever operating system you want to run as a virtual machine. Microsoft Windows offers free trials of its server software at https://www.microsoft.com/en-us/cloud-platform/windows-server-trial. Alternatively, you can install additional versions of Ubuntu by downloading the appropriate ISO file from http://releases.ubuntu.com/. CentOS, which is essentially Red Hat Linux and is available at https://wiki.centos.org/Download. All of these operating systems can run as virtual machines in VirtualBox. I recommend experimenting with various Linux operating systems and see which one you gravitate toward the most. If you ever want to work through binary analysis against the Windows PE format, using the various available trial versions of Microsoft Windows is the way to go, especially on a budget for a home lab.