Login | Register For Free | Help
Search for: (Advanced)

Mailing List Archive: Full Disclosure: Full-Disclosure

Hyperion - Paper about Windows PE run-time encryption

 

 

Full Disclosure full-disclosure RSS feed   Index | Next | Previous | View Threaded


levonkayan at gmx

May 8, 2012, 4:15 PM

Post #1 of 3 (505 views)
Permalink
Hyperion - Paper about Windows PE run-time encryption

Hello,

few minutes ago, we released a paper about windows PE runtime crypters.

A short description:

Hyperion: Implementation of a PE crypter - This paper reveals the
theoretic aspects behind run-time crypters and describes a reference
implementation for Portable Executables.

You can find the paper, here: http://nullsecurity.net/papers.html

We will release the source code (hyperion) during our berlinsides talk
(http://berlinsides.org/ - Thank you aluc). Also, our talk is based on
this paper.

Enjoy reading it.


ch33rs,
noptrix
--
Name: Levon 'noptrix' Kayan
E-Mail: noptrix [at] nullsecurity
GPG key: 0x014652c0
Key fingerprint: ABEF 4B4B 5D93 32B8 D423 A623 823D 4162 0146 52C0
Homepage: http://www.nullsecurity.net/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/


dimitris at census-labs

May 9, 2012, 1:18 AM

Post #2 of 3 (478 views)
Permalink
Re: Hyperion - Paper about Windows PE run-time encryption [In reply to]

On 05/09/2012 02:15 AM, Levent Kayan wrote:
> Hello,
>
> few minutes ago, we released a paper about windows PE runtime crypters.
>
> A short description:
>
> Hyperion: Implementation of a PE crypter - This paper reveals the
> theoretic aspects behind run-time crypters and describes a reference
> implementation for Portable Executables.
>
> You can find the paper, here: http://nullsecurity.net/papers.html
>
> We will release the source code (hyperion) during our berlinsides talk
> (http://berlinsides.org/ - Thank you aluc). Also, our talk is based on
> this paper.

On a related note, you might want to check this out:

http://census-labs.com/news/2012/05/07/athcon-2012-update/

In our AthCon 2012 presentation, entitled "Packing Heat" we've presented
the design of a fully metamorphic packer. It's quite elegant, in the
sense that the packer:
- is a cross-platform ruby script
- it fully controls the assembly and linking process of the
resulting binary thru METASM
- it comes with its own library of metamorphic instructions
(no fixed code for memory allocator, decryptor and loader)

Our goal was to achieve AV evasion during pentests. So there's no
anti-RE / anti-debugging code there.

I see that Hyperion uses AES128 encryption and the output is placed
in a byte array in the executable (please correct me if I'm wrong).
There's a problem with this (if you are interested in AV evasion).
Appart from the fixed decryption code (which is signature friendly), you
have section data of increased entropy. We've found that increased
entropy "raises alerts" in the AV world; the file will be flagged
as suspicious and more thorough checks will be performed. If you're
still interested in AES encryption you might want to generate
instructions that load these bytes (rather than just place them in the
executable). This will considerably decrease information entropy.

We will not be releasing the source code to our packer, but we've put
a step by step guide in our slides, so you can build one from scratch.
Our prototype implementation is only 1700 lines of code :-)

Best regards,

Dimitris

http://census-labs.com -- IT security research, development and services

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/


c.ammann at hs-osnabrueck

May 9, 2012, 2:25 AM

Post #3 of 3 (474 views)
Permalink
Re: Hyperion - Paper about Windows PE run-time encryption [In reply to]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi Dimitris,

thanks for your reply. I just checked your slides and your approach
looks really good :)

Of course we are interested in AV evasion ;) We also observed that the
increased AES-128 encryption entropy is a problem and marked as
suspicious by AV heuristics. My idea was to experiment with different
encodings (e.g. convert the bytes to a string representation to make
the AV heuristic think its just a collection of strings used by the
execuatble for user interaction). The idea to use instructions which
load the encrypted binary into memory looks very promising to me, so
thanks for your advice.

Yes, you are right, the current implementation of Hyperion is very
signature friendly. Our idea was to encrypt the complete binary (also
the decrypter and pe loader) and generate a decrypter stub using
polymorphism. Again, the idea to use metamorphism instead is also a
good apprroach. So, there will be definitely an enhanced version of
Hyperion using the discussed concepts to avoid AV detection.

The motivation our paper was to present a detailled description and
implementation of a basic PE encrypter/packer to the public.
Therefore, people can modify the reference implementation (which will
be released soon under a BSD license) or just use the concepts to
build their own PE crypter/packer.

Best regards,

Christian
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iQEcBAEBAgAGBQJPqjf/AAoJENerUt+Ej3tqR3oH/is2KGDPqzaomzP10jD+fHCT
OhNxYT0gDZNnIwSPPldYAB2uGqymSatGntMFUCzfHFbckloul/vbNg7ajZHPRgh2
V4XpAskjwQE11/rSTSeg9uGXvTskWx3VcKIzkytOaJJ2cMIs358YNDJwblkY4uMI
NQfbRgk5mYod/K3iYx9uZvb9fqpB5EXbdxPATWTwbCrXdmx1/EN/TnHdDBwh7rkA
26JqfTfcYVfEN2Z19uEANs6wFiZefXi/veJR3U/dWyerEFDdgjytUekRJkx/NvUG
521dLitXcx6+1gcLKerEZfkDihKaGmbaX/Vp+3xHXdfD68oGuRHYh0Nmu5Oi6wM=
=1k20
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Full Disclosure full-disclosure RSS feed   Index | Next | Previous | View Threaded
 
 


Interested in having your list archived? Contact Gossamer Threads
 
  Web Applications & Managed Hosting Powered by Gossamer Threads Inc.