3

I have a proprietary executable (no code source), and I’d like to confirm that a particular string is vulnerable to buffer overflows (security audit). But I need its algorithms for that. (I don’t know how assembly work at all outside what I know from C).
It’s a custom low used http server part of a larger commercial product that only process queries when the content type is equal to certain strings (otherwise it’s the well-known nginx who process the response). So I doubt fuzzing would be an appropriate technique for detecting flaws in http header parsing.

I know the program is written in C, and that there are several tools that aim at producing pseudocode. But in my case, I have got a debug build with debug information for gdb (lines numbers ; source files paths ; variable names).
In the meantime the program was compiled with-g2 -fvar-trackinginstead of-g3. Soobjdump ‑Sdoesn’t work because the symbols don’t contains source code of each line.

So is there a C decompiler which is able to to take advantage of full debug symbols in the elf binary ?
The expected result is C preprocessed source without assembly, where each line of each file contains the corresponding Pseudocode according to the debug symbols.

By the way, the binary is compiled for the amd64 architecture.

  • 1
    Please do not add special unicode characters in your question unless required. They are not compatible with standard fonts that many of our visitors are using. They are also not compatible with most screen readers. – RockPaperLizard Nov 29 '15 at 19:05
  • 1
    Arguably the best decompiler out there at the moment is Hex-Rays, which - however - is a plugin to IDA, so you need both IDA and Hex-Rays which both come at a steep price point. To confirm a single thing, simply use a disassembler. Aside from that, if the string is passed as a particular form of input (e.g. environment variable or command line argument), simply use a fuzzer to check. Even Hex-Rays doesn't always give stellar results. When I tried it during initial beta it even misled me several times. So I clearly prefer the disassembler. – 0xC0000022L Nov 30 '15 at 8:10
  • 1
    Aside from that on Linux you have convenient dynamic analysis options like injecting your own version of library functions via LD_PRELOAD. – 0xC0000022L Nov 30 '15 at 8:12
  • 1
    @0xC0000022L : isn’t ɪᴅᴀ only for disassembly ? I’m currently trying to guess how to do this without getting assembly. – user2284570 Nov 30 '15 at 9:22
  • 1
    @user2284570: as I wrote, to get Hex-Rays Decompiler, the best decompiler available (which also makes use of debug symbols), you need IDA. But, if this is a hobbyist project and you are able to invest a little, just not the amount IDA+Decompiler will cost, check out Hopper. It is only available for Linux and OSX these days (used to have a Windows version as well), but it gives decent results. – 0xC0000022L Nov 30 '15 at 12:37
1

Hopper is not gratis, however, it is not very expensive (89€ or 119€ depending on the license). Moreover, its decompiler comes at no extra cost, even though it is not as good as IDA, it's still quite good. With debugging symbols it should produce a good output.

Ah, the decompiler can also be used free of charge with the trial version of the software. It decompiles one function at the time, however, one of these nice scripts automates the process for every function.

  • I tried it with code I compiled. And the resulting Pseudocode is wrong most of the time on large programs (it describe something different than the program is doing). Even with debug symbols. I reported several bugs. – user2284570 Dec 3 '15 at 0:02
  • 1
    @user2284570: for starters your goal seems to be one that doesn't require a disassembler or decompiler. And if you expect some magic to happen, be amazed - since it won't. Neither Hex-Rays nor Hopper will miraculously turn your code into compilable C code. Hex-Rays is even pretty clear about it by calling it pseudo code. As a reverse engineer you need to know your tools. And just because you got a hammer (decompiler) doesn't mean your problem at hand always is a nail. A lot of this is experience, of course. – 0xC0000022L Dec 3 '15 at 16:11
  • @user2284570: You asked for a particular path that you outlined yourself (instead of advice for what path to take). Well, this is a website for software recommendations, not SO or RE. Your problem seems to be solvable without any problem using common fuzzing techniques. In fact since you wrote it's nginx you probably need no more than a scripting language that can send garbage to nginx over TCP/IP and monitors the nginx process(es). It could be even easier than that if you simply find the exact source files used to build it. It's FLOSS. – 0xC0000022L Dec 3 '15 at 16:17
  • @0xC0000022L : no nginx is used as a load balancer, so I can’t send arbitrary any data directly to babled (babled is the program). It’s not a nginx, but something completely custom (and closed source) written by 100 peoples instead of taking a well audited program. – user2284570 Dec 3 '15 at 16:19
  • @user2284570: sorry, this makes no sense whatsoever. No matter what mode nginx is being run in, it expects input and creates output. Why on earth would you not be able to mess with the input via a custom fuzzer? In fact it becomes more and more unclear what exactly you are trying to fuzz/analyze. Because you write you need to analyze nginx, but babled sits behind nginx which runs as a load balancer. So are you trying to fuzz nginx and see if it's vulnerable or are you trying to fuzz this babled? – 0xC0000022L Dec 3 '15 at 17:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.