Live version of my slide deck. Full version http://www.slideshare.net/ange4771/messing-with-binary-formats

1. Messing with
binary formats
Ange Albertini
2013/09/13
London, England

2. reverse engineering
&
visual documentations
http://
corkami
.com

10. MZ
?

26. Structure
1. start
○ PE Signature
■ %PDF + fake obj start
■ HTML comment start
2. next
○ PE (next)
○ HTML
○ PDF (next)
3. bottom
○ ZIP

39. %PDF*****
1 0 obj
<<
/Size 2
/W[[]1/]
/Root 1 0 R
/Pages<<
/Kids[<<
/Contents<<>>
stream
BT{99
Tf{Td(Inlined PDF)'
endstream
>>]
>>
>>
stream
*
endstream
startxref%*******

40. %PDF-1.1
1 0 obj
<<
%
/Type /Catalog
...
>>
endobj
2 0 obj
<<
/Type /Pages
...
>>
endobj
3 0 obj
<<
/Type /Page
/Resources <<
/Font <<
/F1 <<
/Type /Font
/Subtype
/Type1
...
>>
>>
>>
>>
endobj
4 0 obj
<< /Length 47>>
stream
...
xref
01
0000000000 65535 f
0000000010 00000 n
...

42. DEMO

44. 10.1.4
10.1.5

52. Weaknesses
● evasion
○ filters → exfiltration
○ same origin policy
○ detection
■ ex: clean PE but malicious PDF/HTML/...
■ exhaust checks
■ pretend to be corrupt
● DoS

53. Conclusion

54. Conclusion
● type confusion is bad
○ succinct docs too
○ lazy softwares as well
● go beyond the specs
○ Adobe: good
● suggestions
○ more extensions checks
○ isolate downloaded files
○ enforce magic signature at offset 0

55. thank YOU !
Questions ?

56. http://
reverseengineering
.stackexchange.com
@angealbertini
✉ ange@corkami.com

57. Bonus