Book Image

Binary Analysis Cookbook

By : Michael Born
Book Image

Binary Analysis Cookbook

By: Michael Born

Overview of this book

Binary analysis is the process of examining a binary program to determine information security actions. It is a complex, constantly evolving, and challenging topic that crosses over into several domains of information technology and security. This binary analysis book is designed to help you get started with the basics, before gradually advancing to challenging topics. Using a recipe-based approach, this book guides you through building a lab of virtual machines and installing tools to analyze binaries effectively. You'll begin by learning about the IA32 and ELF32 as well as IA64 and ELF64 specifications. The book will then guide you in developing a methodology and exploring a variety of tools for Linux binary analysis. As you advance, you'll learn how to analyze malicious 32-bit and 64-bit binaries and identify vulnerabilities. You'll even examine obfuscation and anti-analysis techniques, analyze polymorphed malicious binaries, and get a high-level overview of dynamic taint analysis and binary instrumentation concepts. By the end of the book, you'll have gained comprehensive insights into binary analysis concepts and have developed the foundational skills to confidently delve into the realm of binary analysis.
Table of Contents (12 chapters)

Installing the code examples

This book wouldn't serve us well if we didn't have code examples to use for the recipes that are presented in later chapters. Thankfully, Packt hosts all of the code on their own GitHub repository, which will make it easier for us to retrieve the examples. This recipe will include instructions on how to retrieve the code we'll use in later recipes.

In this recipe, we'll return to a Terminal session to run some command-line utilities that will clone the code examples from my GitHub repository that I created for the purposes of this book. We will have to perform the instructions in this recipe on both the 32-bit and 64-bit Ubuntu Desktop virtual machines we created earlier in this chapter.

Getting ready

Once again, we'll need to have the Terminal application running in both of our virtual machines if it's not already. Go ahead and open it up so we can work through this recipe. Once it's open on both virtual machines, you can proceed to work through the following instructions. Remember, run these commands on both Ubuntu virtual machines.

How to do it...

Run the following commands in a Terminal as a non-root user on both the 32-bit and 64-bit Ubuntu virtual machines we created earlier in this chapter:

$ cd ~/
$ mkdir ~/bac
$ cd bac
$ git clone https://www.github.com/PacktPublishing/Binary-Analysis-Cookbook

How it works...

In the previous recipe, we installed git as one of our command-line tools so that we could use it in this recipe. We start by using the cd command to change directories to the current user's home directory, we use the mkdir command to make a new directory called bac, change directories into bac using cd, and then issue the git clone command to pull down the code for this book from my repository on GitHub. This particular tool reaches out to a Git server and clones the remote repository to your local hard drive.

There's more...

If you're unfamiliar with Git, there are many ways to use Git beyond just for cloning repositories onto our systems. We can also use Git to create repositories for our code on places such as GitHub or GitLab or, if your organization has a private Git server, for accessing/creating repositories on that server. Personally, I use GitHub for housing code that I use when teaching Python classes at conferences, and for scripts that I develop on the fly for penetration testing that I may need again. There was a time when I used my GitHub account to host a repository that stored a custom tool, I wrote to quickly install all of the custom tools I use across many other repositories when provisioning a new virtual machine for penetration assessments. A purist might poke fun at people who, like me, use GitHub as more of an easily accessible place to house code or scripts and not a full-blown open-source project, but I'm OK with that. It works well for me and I encourage you to use Git the way that works best for you.

If you decide to use GitHub or GitLab sometime in the future, whether for work or for personal use, make sure you understand the security implications of doing so. As a penetration tester, I love nothing more than finding usernames and passwords on publicly available repositories. GitHub and GitLab keep a running record of all of the commits and changes to the code stored in the repository. If a developer accidentally commits a username, password, or other sensitive data to the repository, malicious individuals can and will use that information against whatever organization employs that developer. The same goes for personal use. GitHub allows its users to configure SSH keys for authorized access to their accounts. Be sure to use a public SSH key when configuring SSH authentication and not a private SSH key.

See also

If you're curious about any of the command-line utilities we used in this recipe, you can always refer to their man pages by issuing the following command in a Terminal session:

$ man <utility name>

Replace <utility name> with the name of the utility, such as cd, git, or mkdir.