- Видео 101
- Просмотров 76 734
VECTOR 35
США
Добавлен 28 апр 2015
VECTOR 35
Finding Windows Kernel Vulnerabilities Automatically
#hacking #education #reverseengineering #training
In this video we take a look at CVE-2021-31956, how it works, and how to write a script to find it using Binary Ninja.
Check out our trainings at binary.ninja/training/
SecureList.com's original blog post: securelist.com/puzzlemaker-chrome-zero-day-exploit-chain/102771/
This is the "vulnerable file" we used: msdl.microsoft.com/download/symbols/ntfs.sys/5FC8C124210000/ntfs.sys
This is the "patched version" we used: msdl.microsoft.com/download/symbols/ntfs.sys/6DFA6A4F29c000/ntfs.sys
[00:00:00] Intro
[00:00:14] Overview of the Bug
[00:01:13] Looking at it in Binary Ninja
[00:01:34] Modeling Vulnerabilities
[00:02:07] Writing the Script
[00:04:49] Insp...
In this video we take a look at CVE-2021-31956, how it works, and how to write a script to find it using Binary Ninja.
Check out our trainings at binary.ninja/training/
SecureList.com's original blog post: securelist.com/puzzlemaker-chrome-zero-day-exploit-chain/102771/
This is the "vulnerable file" we used: msdl.microsoft.com/download/symbols/ntfs.sys/5FC8C124210000/ntfs.sys
This is the "patched version" we used: msdl.microsoft.com/download/symbols/ntfs.sys/6DFA6A4F29c000/ntfs.sys
[00:00:00] Intro
[00:00:14] Overview of the Bug
[00:01:13] Looking at it in Binary Ninja
[00:01:34] Modeling Vulnerabilities
[00:02:07] Writing the Script
[00:04:49] Insp...
Просмотров: 1 311
Видео
Hotkeys/Actions: Binary Ninja Basics ep.4
Просмотров 9902 года назад
Hotkeys/Actions: Binary Ninja Basics ep.4
Crazybomb Stage 2 | Live Stream: May 7
Просмотров 1732 года назад
Crazybomb Stage 2 | Live Stream: May 7
BN Intro | Crazybomb Stage 1 | Live Stream: April 9
Просмотров 2563 года назад
BN Intro | Crazybomb Stage 1 | Live Stream: April 9
Opening Files: Binary Ninja Basics ep. 1
Просмотров 10 тыс.3 года назад
Opening Files: Binary Ninja Basics ep. 1
What will you learn at the Binary Ninja training at Infiltrate?
Просмотров 5065 лет назад
What will you learn at the Binary Ninja training at Infiltrate?
DEF CON CTF 2015 LiveCTF Mini Challenge
Просмотров 4,4 тыс.7 лет назад
DEF CON CTF 2015 LiveCTF Mini Challenge
Ok but @me when you do it on a white board 😂
Great update
How much price binary ninja enterprise
Contact support for more details on enterprise. binaryninja@vector35.com
FYI: Sidekick intro actually starts at 1:24:20
How to export the patched binary, or show differences I made so far to the input file?
im also interested in this feature. I have to keep patching every time I run the binary inside bin ninja it's annoying, I'd like to patch only ONCE
46:40 You can create multiple python windows?!?!?!?!? I have been using my OS clipboard for ages to go back and forth between commands...
I may need to wire up Python because I’m not seeing much on patching involving variable reassignment or replacement of one call with another. I’m very spoiled by supra-assembly languages.
Very nice! Is there a recap of the upcomming features?
The stream itself is the best recap, but when the stable goes live we'll have a summary on our blog too! binary.ninja/blog/
Love seeing this arch plugin for risc-v is written in rust!
Nice video, I plan on buying Binary Ninja soon.
These videos are very helpful. I didn't know about: * Hex autolinking from the console * Snippets plugin * current_ globals * Tab completion I've been like a blind man stumbling around in a cave, this video is super helpful. Please make more
Which text editor are you using ? This one is looking so cool 👨💼
That wasn't a text editor but the decompilation view of Binary Ninja.
love these shorts
which training class does the guy refer to?
This suggestion was from one of our Program Analysis for Vulnerability Research classes, with Margin Research, but we have a Binary Ninja for Reverse Engineers just around the corner that will go in-depth about using our ILs, writing scripts and plugins, decompilation theory, and a lot of other interesting topics as well! shop.binary.ninja/products/bnre-november-2023
Thank you, this so cool and useful to me !
amazing
I've been trying to write a plugin to find very similar issues, this is awesome. Thanks :)
higher resolution
Been using binja for a bit now, I decided to finally go through its tuts and resources. "we don't want people to pwn you a binary ninja bug browser drive-by" This had me rolling on the floor.
fyi: the hardware breakpoint triggers on the instruction after the access, thats why you got confused when you saw inc edx, if trace back 1 instruction then you will see the write access, infact you briefly did it @45:40, there you can see the mov byte [edx], al. im watching on a 4k tv with 1080p60 youtube setting and after the 1hr mark when you changed the stream setup everything became crystal clear instead of the start where it was slightly fuzzy, so the changes worked great :) \o/ love all the new features and its cool to see how much more powerful binja is becoming over time, you guys rock. /R.
Thanks! Been a while since I did HW breakpoints, you can tell. Appreciate the reminder, should have caught that.😉 Yeah, sorry it was so fuzzy before, literally just a few minutes before the stream went live the HW capture card died on me.
Hopefully we can see a capa integration and/or notes per function :)
It's on the roadmap. The notes per function does work with the ksuite plugin but it's a little bit of work to set up right now. Might take another look at expanding the existing notepad plugin on the next stream.
Was at work and missed the stream, I really appreciate "THE LIST" now haha
Nice
Great stream!!
Awesome!
Is it possible that the "Manage Plugins" view is only available in non-trial versions? Because Ctrl+Shift+M does nothing in the trial, at least for me.
Correct -- plugins are not available in the demo.
NOTE: I made a foolish mistake in this stream. I thought the APIs wouldn't load the raw file but I was just passing in an invalid path! I used "~/ls-broken" which of course assumes shell expansion which you won't get in a direct API! If I would have instead specified the full path or used binaryninja.load(os.path.expanduser("~/ls-broken")) it would have worked fine!
My first time trying to use the c-compiler I'm working on a crackme and want to printf debug something. I copy the pseudo-c and make sure it's valid c. I add a printf before the return and I compile. What I get is just an error saying: "[Compilation Failed] stdin:1: error: syntax error" I imagine there are probably some limitations I need to know about that weren't covered here.
Hard to know without more context -- what's the exact snippet of code you're trying to compile? Also, YT comments aren't a great way to get support, I'd recommend joining our public slack (slack.binary.ninja/) or getting in touch with us via twitter or email.
46:50 didn't know you could do that in the types view, neat!
Sorry for the abrupt ending there, wasn't planned but a network outage took down the stream! We'll get caught up on all the other new updates on the next stream!
I have been struggling to run a helloworld python script under personal license for a long long time... Even if i don't have the answer today...
How are you trying to run it? Personal licenses cannot run scripts without the GUI ("GUI-less processing" on the purchase description page). That said, the API is fully accessible so you can `import filename` the python script if it's in your plugin folder and run it from the scripting console directly.
@@Vector35 So I should put the python script file to the plugin folder and run it from the console ? I cann't directly load and run it from some menu or button, like the way ida pro does?😀
Do you have any videos demonstrating how to use/create python scripts to interactive with a binary ?
Yes, we've got many of them where we work on using API code to interact with plugins. I don't have links handy though, so your best bet is to look through the indexes, or check out these many examples: gist.github.com/psifertex/6fbc7532f536775194edd26290892ef7 github.com/Vector35/binaryninja-api/tree/dev/python/examples github.com/Vector35/community-plugins
@@Vector35 thank you very much. I just made the switch from Ghidra, so I'm trying to learn how the scripting works. Trying to learn how I can use binja to resolve apis , decrypt string etc then mark up the binary (typical RE stuff lol)
@@az2252 Come hang out in the BN slack -- any specific questions tend to get answered very quickly for specific tasks if you can't find them searching the docs. slack.binary.ninja/
Opaque predicates have entered the chat...
We have a really old blog post and plugin on the topic and we've been meaning to move to the new workflows API. Might be another good topic.
Not sure how this got recommended to me but this hits different after my machine architecture and operating systems classes
Maybe "rant" in the title gets the video promoted more. ¯\_(ツ)_/¯ Glad you can appreciate it though!
I just realized the iteration step.... Having to restart Binja every single time was killing me, I need to better at reading. Thank you for calling that part out.
You're welcome! Yeah, that can be tedious, glad you found that helpful.
please do video " hooking-binary-ninja" with "BNHook" gui thanks
That's a good suggestion. I'll add it to the schedule for this week's live stream!
Very nice, hoped to also see a bit about the SSA form ILs.
Ima ask you something and you have to be honest. Binary ninja wasn't better than ghidra a year ago. Is it now?
Depends on what you're doing and what your goals are. Our API is better. Our UI is better, but we don't support as many architectures. Our decompilation is sometimes better, sometimes worse. Our patching is better, our speed for doing full decompilation is much better. Ghidra is better at project-management and loading multiple binaries into the same analysis space, but our BNIL is much better for learning an architecture you don't know, or writing plugins to analyze binaries at scale.
I guess I would ask you -- in what ways was Ghidra better for you and your workflows a year ago and I can tell you what changed that might impact it. You can also see what has changed just in the last six months: binary.ninja/2022/01/27/3.0-the-next-chapter.html
@@Vector35 all of these reasons are why I bought myself a license for Christmas
Time stamps: 4:37 intro ends 6:14 introductions along with what everyone is working on 15:11 infinity percent speedup 16:14 hex integers plugin 17:26 peter worked on python API specifically revolving around type hints 19:05 il API refactor 22:44 il graph visualization 26:50 il show debug report 30:21 3.0 changelog easter egg 30:32 addition of pseudo-c and the arrival of *the intern* 34:10 c parser is not related to pseudo-c view 35:19 more info about parsing c like things 37:39 pseudo-c is not really c, not guaranteed to be compilable 39:50 future update could have improved graph layout algorithm 40:30 john has arrived + what he has been working on, variables view, stack view. everything below here is mostly about possible future additions to binary ninja and more broadly, Vector35 as a company 43:48 talks about the python debugger and the native port of it, the native port should be ready for the next stable (windows 3.1) 47:52 Jordan answering the question regarding the hill syntax not looking like ghidra, answer: pseudo-c is now available and is there for if you want the c style decompilation offered by ida hexrays decompiler and ghidra 48:36 Jordan has PTSD about crazy bomb re Livestream 49:41 talk about windows 3.1 roadmap as well as how binja 3.0 release cycles will work 51:32 the two focussed things for the 3.1 release (database load/store performance, type libs?) 54:20 UI for making type libraries & general talk about type libraries 57:10 talk about binja memory consumption & rusty talking about serializing il to disk for performance speedup 1:01:30 windows 3.1 milestone is incomplete, expect more things to be added 1:02:00 question: any love for sigkit ( github.com/Vector35/sigkit ) 1:03:16 Vector35 employee smash tournament? 1:03:30 question: what was thought to be "hard" however turned out to be easier than thought 1:05:07 type hints were harder than expected 1:06:08 question: how hard would it be to undo patches 1:06:27 question: intern of the century tshirt denied 1:06:41 type lib gotchas (unions), and difficulties with type parser 1:08:30 history viewer to allow undoing patches to a file (answer for the above question how hard would it be to undo patches) 1:11:16 binary ninja product SKU's & a whole bunch of other monetization techniques (binja battle pass), and how binja doesn't want to become ida in respect to pricing 1:13:35 Rusty's paid plugin sidequest & paid plugins in general 1:15:19 database changes and undoing changes to the database 1:16:56 reverse engineers can afford to buy paid plugins if they benefit from them, binja wants the base product to be competitive and does not want to alienate the userbase, but is not against a paid plugin marketplace. As well as binary ninjas pricing. 1:24:47 Jordans poor financial decision(s) 1:25:45 VMP goofs 1:27:20 Bulletproof money-making idea & an anecdote for certain government agencies. 1:27:49 lumina alternative (CODENAME: Match Maker <3) 1:38:30 il emulator 1:42:03 Rusty blessing update speed in the coming future & reason for updates historically being slow (API doc files) & emojis are very important 1:46:50 stream winding down & DWARF info is still in the works
Great livestream as always! Both the UI and Debugger are shaping up to be extremely helpful for my workflow, like everything else it seems for 3.0 😀.
Thanks! We're super excited for 3.0 as well -- can't wait to get all the final polish done and land it for everyone!
Congrats, very interesting, thanks
cool stream, I like it. Thumbs up. Where to get Li Xusheng BN script? is it public?
I did a write up on it. The script and the binary come with it. Once it is published, you can have access to it
@@xushengli7252 thanks
When it's posted, you'll be able to find the writeup on both our blog: binary.ninja/blog and Xusheng's blog: xusheng.dev/posts/
This is super cool, Jordan. I have young guys I'm mentoring into cybersecurity and I'm sure they'll love to keep a tab on the chan!
Props to the editor for packing so much into this video in only 3.5 minutes. I wish I knew that URL handler existed sooner, I can't wait to add that to one of our projects now. Please keep these coming!
Glad it was helpful!
@@Vector35 Thanks for this video! BTW some CTF/crackme video(s) showing how you go about doing it on Binary Ninja would be useful
Hey I live in the area and looked you guys up from your sign. As an aspiring comp sci Would it be possible for me to talk with anyone in the Melbourne office to talk to me about your company?
Sorry we missed this earlier David, but certainly. Hit us up on the website chat at the bottom of binary.ninja and we're always happy to talk to folks starting out in this field.
You code this is C? Sweet game.
Nope, it was actually hand-written 6502 assembly. You can see the source here: github.com/Vector35/PwnAdventureZ
Heyyy. Why have you guys stopped conducting ctf challenges?
red cat We didn't! Did you see sourcery.pwnadventure.com?!
Couldn't hear the other guy.
Yeah, we almost didn't publish it for that reason. Sadly the gain was accidentally turned way too low but we figured something is better than nothing.
If it weren't for the music i would have no excuse to not buy/download this. But now i do.
Just don't Look at the code behind the scene, just enjoy the game, eh?