So far, we have looked at some pretty straightforward analysis examples. In this chapter, we will attempt to uncover some of the techniques that are used to try and hide the intent of the binary, or to attempt to confuse analysis tools. This chapter is going to ramp up the difficulty even more, but it will prepare us for the next chapter, where we will look at a polymorphic version of a binary we analyzed in Chapter 7, Analyzing a Simple Reverse Shell. All of these recipes will use the 64-bit Ubuntu virtual machine.
What we cover in this chapter is by no means an exhaustive list but merely some techniques I either use as a penetration tester or have encountered before. Here is a breakdown of the recipes we will work through in this chapter:
- Understanding signature detection
- Changing a binary's signature
- Confusing static analysis tools...