Willi Ballenthin

"If you can reliably find shellcode during an attack, then you can detect and respond to some of the most interesting intrusions. Shellcode isn’t only deployed during exploitation and initial access, it can be found in implants packaged inside custom file formats and processes infected by runtime patching. There are challenges in analyzing shellcode that go beyond standard reverse engineering of PE or ELF malware binaries. Shellcode assumes little about its execution environment, so the reverse engineer must quickly understand the runtime framework carried along with the shellcode to determine what it does. Across hundreds of reverse engineering sessions, we’ve developed novel techniques for analyzing shellcode payloads automatically. In this presentation, we’ll start by teaching you how shellcode implements runtime linking so it can interact with the infected system. Then, we’ll explore how to use emulation and symbolic analysis to automatically resolve functions used by shellcode. With these imports and other features, we can build a system to automatically infer capabilities to remove the human from the loop. Finally, we’ll come full circle and use these generalized techniques to better identify previously-unknown shellcode. Attendees of this presentation will enjoy low-level, technical details such as how to use memory layouts to synthesize Yara rules that match pointer chasing in x86 instructions. Attendees will also learn about trends in shellcode payloads that they can use to identify and analyze shellcode themselves. We’ll perform live demos and release any referenced code via GitHub. "