• malware, generally
• course overview, logistics
• (if time) x86-64 assembly review

• AT&T, Intel syntax
• official sources for instruction info
• some x86-64 nits

• misc ASM things (label(%rip); segmentation)
• official sources for calling convention info
• ELF executable format (start)

• ELF executable format (finish)

• reverse engineering: strings
• Ghidra as example
• annotation, tricky cases for disassembly

• dynamic linking realities
  • procedure linkage table
  • global offset table
• control flow graphs
• intermediate representation

• decompiling

• x86-64 encoding

• x86-64 encoding (finish)
• virus example: Vienna

• options for viruses/worms:
• where to put code
  • appending, replacing
  • “cavities” in executables
  • system files, bootloaders
• how to get to code to run
  • bootloaders

• how to get to code to run
  • replacing jumps, returns
  • dynamic linking information
  • default start-up program
• whitelisting
• signatures as regexes

• state machines for pattern matching
• combining patterns
• heuristic matching on “weird” executables

• behavior monitoring
• obfuscation techniques to hide flow-control
  • merging/splitting functions
  • Tigress’s flatten pattern
• “encrypted” code

The first 100 seconds of audio were not recorded in lecture; the lecture recording linked above has a rerecording of that audio; that audio has been rerecorded the video spliced together.

You can alterantely obtain a recording of just the part that was recorded in lecture: screencapture mp4

• “encrypted” code and decrypter generators
• emulation as analysis tool
• anti-emulation/virtualization techniques

• “mutation engines”
• anti-debugging techniques (start)
  • code checksumming

• anti-debugging techniques (finish)
  • emulation-based obfuscation

• rootkit-style malware

• review: command injection vulnerabilities
• taint tracking (start)

• traint tracking (finish)
• buffer overflows

• stack smashing pattern

• stack smashing pattern (finish)

• dealing with restrictions on shellcode

• stack canaries
• (if time) information disclosure, shadow stacks

(Reiss out of town)

• pointers on the stack
• “write gadgets”
• targets for write gadgets
  • global offset table
  • VTables (start)

• targets for write gadgets
  • VTables (finish)
    • exercise
• arc injection
• ntpd exploit example
• exercise

• information disclosure
• memory protection, guard pages
• RELRO
• write XOR execute

• ASLR: making addresses hard to predict
  • limits on entropy
  • things that must be kept together

• idea of using gadgets
• chaining gadgets together

• finding gadgets automatically
• automatic chain generation
• gadgets without RET

• exercise on placing chain
• attempting to get rid of gadgets
• blind ROP

• overflows on the heap (preview)
  • into other objects (sudo example)
  • into heap metadata
• interlude: use-after-free introduction

(Reiss out of town)

• why people like C/C++
• Rust intro
• ownership rule

(Reiss out of town)

• Rust borrowing

• escape hatch in Rust; smart pointers

( Reiss out of town)

• Rc (reference counting)
• RefCell (dynamic borrow tracking)

• consistency and the heap
• pointer subterfuge via heap metadata
• double-free vulnerabilities
• use-after-free
  • prevalence
  • using type confusion

• use-after free exercises / examples

• integer overflow

• greybox fuzz testing

• symbolic execution idea
  • solving equations
• splitting execution on if statements
• collecting/solving for constraints
• automatic overflows
• optimizing symbolic execution in practice

• briefly static analysis — tracking approximations
  • example for use-after-free
  • points-to analysis difficulty
• sandboxing idea
• problem of applications doing too much
• privilege seperation intro

• challenges with selecting system call filters
• privilege seperation con’t
  • example interface
  • limits on what it does/does not mitigate

• limiting naming — chroot, Linux namespaces

• sandbox escapes (start)

• sandbox escapes (finish)
• whole-application sandboxing
• usability issues with mobile permissions
• sandboxing without OS help

• “fat” pointers (pointer has objcet bounds)
• baggy bounds checking (lookup object bounds)

• baggy bounds checking (con’t)
• AddressSanitizer
• comparing bounds checking

2PM-5PM.