{"componentChunkName":"component---src-templates-post-template-js","path":"/magical-windbg-vol2-02-en","result":{"data":{"markdownRemark":{"id":"7746a17e-6b05-5df0-8011-db070807d2f1","html":"
\n

This page has been machine-translated from the original page.

\n
\n

This chapter performs surface analysis of DoPClient and DoPDriver, the programs analyzed in this book.

\n

Surface analysis generally refers to analysis methods that use information such as program metadata and strings contained in a file to understand the overall nature of the target.

\n

For example, when you perform surface analysis on Windows executables, you can identify the following kinds of information.

\n\n\n

Table of Contents

\n\n

Identify the File Type

\n

The type of the target file can be identified through surface analysis.

\n

On Linux, commands such as file, which are installed on many distributions, can easily identify the type of a target file.

\n

On Windows, by contrast, it is common to use third-party tools to examine file types.

\n

This book does not cover file-type investigation tools in detail, but TrID 1 is one commonly used option.

\n

TrID is also provided as an online tool, so it is convenient when it is acceptable to upload the file being analyzed to an external site, as in this case.

\n
\n

Online TrID File Identifier:

\n

https://mark0.net/onlinetrid.html

\n
\n

When the executables analyzed in this book are checked with the online tool above, they are identified as likely 64-bit Windows executables, as shown below.

\n

\n \n \n \n \n \n \n \n \n

\n

Note: Uploading files that are not publicly available to Internet-based analysis sites can become a serious security incident, so please use such sites with great care.

\n

Examine PE File Information

\n

Windows executables are normally created in the PE file format 2.

\n

PE file headers contain a wide variety of information about the executable.

\n

This book does not explain PE file headers in detail, but in general you can inspect the following kinds of information from a PE header.

\n\n

In addition, by analyzing data inside the executable, you can inspect the following kinds of information as well.

\n\n

Now let’s actually try some surface analysis on DoPClient and DoPDriver.

\n

There are several tools that can be used for surface analysis of Windows programs, but in this book we use the free edition of PEStudio 3.

\n

There are also several useful tools for surface analysis of Windows programs besides PEStudio.

\n

This book does not use them, but CFF Explorer included in Explorer Suite 4 and PE Bear are also extremely useful tools.

\n

When you analyze DoPClient and DoPDriver with PE Studio, a wide range of information is displayed at once, as shown in the image below.

\n

\n \n \n \n \n \n \n \n \n

\n

From here, you can inspect information such as hashes and timestamps for the target files.

\n

You can also inspect the strings embedded in DoPClient by opening the [strings] tab for DoPClient.

\n

\n \n \n \n \n \n \n \n \n

\n

And from the [strings] tab of DoPDriver, we can confirm that the string FLAG{The_important_process_is_ is defined.

\n

\n \n \n \n \n \n \n \n \n

\n

This looks like the first half of the correct Flag, and it seems likely to become an important keyword as we continue the analysis.

\n

Summary of Chapter 2

\n

In this chapter, we used PEStudio to perform surface analysis of DoPClient and DoPDriver, the programs targeted in this book.

\n

Although it did not appear in this chapter, surface analysis can sometimes reveal even more information, such as sensitive data embedded as text or data that may be encrypted or obfuscated.

\n

For various techniques related to surface analysis of Windows programs, “リバースエンジニアリングツール Ghidra 実践ガイド” 6 and “Practical Malware Analysis” 7 are extremely helpful references.

\n\n\n
\n
\n
    \n
  1. \n

    TrID - File Identifier https://mark0.net/soft-trid-e.html

    \n↩\n
    2. \n
  2. \n

    PE Format https://learn.microsoft.com/ja-jp/windows/win32/debug/pe-format

    \n↩\n
    3. \n
  3. \n

    PEStudio https://www.winitor.com/download

    \n↩\n
    4. \n
  4. \n

    Explorer Suite https://ntcore.com/explorer-suite/

    \n↩\n
    5. \n
  5. \n

    PE Bear https://github.com/hasherezade/pe-bear

    \n↩\n
    6. \n
  6. \n

    リバースエンジニアリングツール Ghidra 実践ガイド セキュリティコンテスト入門からマルウェア解析まで (中島 将太, 小竹 泰一, 原 弘明, 川畑 公平 著 / マイナビ出版 / 2020 年)

    \n↩\n
    7. \n
  7. \n

    Practical Malware Analysis: The Hands-On Guide to Dissecting Malicious Software (Michael Sikorski, Andrew Honig 著 / No Starch Press / 2012 年)

    \n↩\n
    8. \n
\n
","fields":{"slug":"/magical-windbg-vol2-02-en","tagSlugs":["/tag/magical-win-dbg/","/tag/windows/","/tag/win-dbg/","/tag/english/"]},"frontmatter":{"date":"2024-05-26","description":"This is the web edition of Magical WinDbg 2 - Learn User-Mode & Kernel Debugging Through CTFs -, distributed at Tech Book Fest 16.","tags":["Magical WinDbg","Windows","WinDbg","English"],"title":"Magical WinDbg VOL.2 [Chapter 2: Surface Analysis of DoPClient and DoPDriver]","socialImage":{"publicURL":"/static/e9bfc3718fd53ab58623a496fc9a302e/magical-windbg-vol2.png"}}}},"pageContext":{"slug":"/magical-windbg-vol2-02-en"}},"staticQueryHashes":["251939775","401334301","825871152"]}