Book Image

Binary Analysis Cookbook

By : Michael Born
Book Image

Binary Analysis Cookbook

By: Michael Born

Overview of this book

Binary analysis is the process of examining a binary program to determine information security actions. It is a complex, constantly evolving, and challenging topic that crosses over into several domains of information technology and security. This binary analysis book is designed to help you get started with the basics, before gradually advancing to challenging topics. Using a recipe-based approach, this book guides you through building a lab of virtual machines and installing tools to analyze binaries effectively. You'll begin by learning about the IA32 and ELF32 as well as IA64 and ELF64 specifications. The book will then guide you in developing a methodology and exploring a variety of tools for Linux binary analysis. As you advance, you'll learn how to analyze malicious 32-bit and 64-bit binaries and identify vulnerabilities. You'll even examine obfuscation and anti-analysis techniques, analyze polymorphed malicious binaries, and get a high-level overview of dynamic taint analysis and binary instrumentation concepts. By the end of the book, you'll have gained comprehensive insights into binary analysis concepts and have developed the foundational skills to confidently delve into the realm of binary analysis.
Table of Contents (12 chapters)

Installing the dependencies and the tools

Whenever we need to perform a task, our success largely depends on having the right tools. Whether it's woodworking, cleaning a house, cooking a meal, or binary analysis, making sure we have what we need will help us to work toward a completed task. The following instructions will need to be performed on both the 32-bit and 64-bit Ubuntu virtual machines. If you decided to use CentOS instead of Ubuntu, the instructions for installing the necessary tools so that you can work through the examples in this book will differ.

This recipe will walk us through installing the command-line tools we'll use in later chapters, as well as the dependencies we'll need before compiling another tool from the source in a later recipe.

Getting ready

To work through this recipe, we need to have our newly created virtual machines powered on. If your Ubuntu 32-bit and 64-bit virtual machines are powered off, power them on, wait until they both finish booting, log in, and start a Terminal program in each. Once that's complete, you are ready to follow this recipe on both virtual machines.

How to do it...

The majority of the tools we will use are installed via the command line, while others we will have to install manually by compiling the source code. With that said, however, we will need to install the dependencies before we can compile the source code. Please make sure to run these instructions on both of the virtual machines we created earlier:

  1. Once the Terminal application is running, we'll run the following commands on both virtual machines to make sure the operating systems on each are up to date:
$ sudo apt update && sudo apt full-upgrade -y
If you're following these instructions for the 64-bit version of Ubuntu, you may see a prompt requesting you to upgrade to Ubuntu 18.04 LTS. You can ignore this for now as we want to make sure we keep Ubuntu 16.04 LTS instead.
  1. Once the upgrade process finishes, in the same Terminal, we will run the following one-liner, which will install the tools and the dependencies that are needed for the EDB Debugger tool we will compile from the source later. Make sure this command is typed on one line, without pressing Enter until after the -y:
$ sudo apt install build-essential libemu-dev graphviz gdb python libgraphviz-dev cmake libboost-dev libqt5xmlpatterns5-dev qtbase5-dev qt5-default libqt5svg5-dev libcapstone-dev pkg-config hexedit nasm git libtool autoconf -y

As long as there were no errors, we're ready to install the code examples and EDB Debugger, which happens to be one of my favorite open source debuggers on Linux.

How it works...

By issuing these commands within the Terminal, we instructed Ubuntu to download updates and upgrade the system with fresh installations for each item that needed updating. Then, once that was finished, we instructed Ubuntu to install the various dependencies and missing tools. The -y argument instructed Ubuntu that yes, we wanted to go ahead and proceed with the upgrade, and acknowledged how much disk space the upgrade would require.

There's more...

The Terminal application is a widely used application that, by default in Ubuntu, is configured to use the Bourne again shell (Bash). Other shell programs exist and if you're a fan of dash (sh) or Z Shell (zsh), you can configure the Terminal application to use one of those by default. For the purposes of this book, though, we'll use Bash to run command-line tools.

See also

If you're interested in seeing all of that Bash is capable of, you can view the man page by issuing the following command in a Terminal session:

$ man bash

To view the capabilities of sh, run the following command in a Terminal session:

$ man sh

By default, zsh isn't installed on Ubuntu 16.04 LTS. To install it, run the following command in a Terminal session:

$ sudo apt install zsh -y

Then, if you want to see common arguments or functionality, you can run the following command in a Terminal session to view the man page for zsh:

$ man zsh

Finally, we can see what additional command-line arguments are available to the aptitude package manager by running the following command within an active Terminal session:

$ man apt