Location via proxy:   [ UP ]  
[Report a bug]   [Manage cookies]                
skip to main content
10.1145/3471621.3471848acmotherconferencesArticle/Chapter ViewAbstractPublication PagesraidConference Proceedingsconference-collections
research-article

Lost in the Loader:The Many Faces of the Windows PE File Format

Published: 07 October 2021 Publication History

Abstract

A known problem in the security industry is that programs that deal with executable file formats, such as OS loaders, reverse-engineering tools, and antivirus software, often have little discrepancies in the way they interpret an input file. These differences can be abused by attackers to evade detection or complicate reverse engineering, and are often found by researchers through a manual, trial-and-error process.
In this paper, we present the first systematic analysis and exploration of PE parsers. To this end, we developed a framework to easily capture the details on how different software parses, checks, and validates whether a file is compliant with a set of specifications. We then used this framework to create models for the loaders of three versions of Windows (XP, 7, and 10) and for several reverse-engineering and antivirus tools. Finally, we used this framework to automatically compare different models, generate new samples from a model, or validate an executable according to a chosen model. Our system also supports more complex tasks, such as “generating samples that would load on Windows 10 but not on Windows 7.”
The results of our analysis have consequences on several aspects of system security. We show that popular analysis tools can be completely bypassed, that the information extracted by these analysis tools can be easily manipulated, and that it is trivial for malware authors to fingerprint and “target” only specific versions of an operating system in ways that are not obvious to someone analyzing the executable. But, more importantly, we show that there is not one correct way to parse PE files, and therefore that it is not sufficient for security tools to fix the many inconsistencies we found in our experiments. Instead, to tackle the problem at its roots, tools should allow the analyst to select which of the several loader models they should emulate.

References

[1]
A. Albertini. [n.d.]. Corkami PE files corpus. https://github.com/corkami/pocs/tree/master/PE.
[2]
A. Albertini. 2013. Making a Multi-Windows PE. POC or GTFO0x01(2013).
[3]
Alexander Sotirov. [n.d.]. TinyPE. http://www.phreedom.org/research/tinype/.
[4]
B. Baker, A. Chiu. 2015. Threat Spotlight: Rombertik – Gazing Past the Smoke, Mirrors, and Trapdoors. https://blogs.cisco.com/security/talos/rombertik.
[5]
Clark Barrett, Aaron Stump, Cesare Tinelli, 2010. The smt-lib standard: Version 2.0. In Proceedings of the 8th international workshop on satisfiability modulo theories (Edinburgh, England), Vol. 13. 14.
[6]
S Bratus and J Bangert. 2013. ELFs are dorky, elves are cool. POC or GTFO0x00(2013).
[7]
David Brumley, Juan Caballero, Zhenkai Liang, James Newsome, and Dawn Song. 2007. Towards Automatic Discovery of Deviations in Binary Implementations with Applications to Error Detection and Fingerprint Generation. In USENIX Security Symposium. 15.
[8]
Chocolatey. [n.d.]. Chocolatey - The Package Manager for Windows. https://chocolatey.org/
[9]
Cisco. [n.d.]. ClamAV. https://www.clamav.net/
[10]
Cisco. [n.d.]. ClamAV - Bytecode Signatures. https://www.clamav.net/documents/bytecode-signatures
[11]
Cisco. [n.d.]. ClamAV - File hash signatures. https://www.clamav.net/documents/file-hash-signatures
[12]
Emanuele Cozzi, Mariano Graziano, Yanick Fratantonio, and Davide Balzarotti. 2018. Understanding Linux Malware. In IEEE Symposium on Security & Privacy (San Francisco, CA). IEEE Computer Society.
[13]
Leonardo De Moura and Nikolaj Bjørner. 2008. Z3: An Efficient SMT Solver. In Proceedings of the International Conference on the Theory and Practice of Software, International Conference on Tools and Algorithms for the Construction and Analysis of Systems (ETAPS/TACAS).
[14]
Edsger W Dijkstra. 1975. Guarded commands, nondeterminacy and formal derivation of programs. Commun. ACM 18, 8 (1975), 453–457.
[15]
erocarrera. [n.d.]. pefile. https://github.com/erocarrera/pefile
[16]
Xinyang Ge, Mathias Payer, and Trent Jaeger. 2017. An Evil Copy: How the Loader Betrays You. In NDSS.
[17]
Yinrong Huang. 2006. Vulnerabilities in Portable Executable (PE) File Format For Win32 Architecture. Technical Report. TR, Exurity Inc., Canada.
[18]
J. Bangert, R. Shapiro, S. Bratus. 2013. Weird Machines and revisiting Trusting Trust for binary toolchains. http://www.cs.dartmouth.edu/~sergey/trust/30c3-chain-of-trust.pdf.
[19]
Dan Kaminsky, Meredith L Patterson, and Len Sassaman. 2010. PKI layer cake: New collision attacks against the global X. 509 infrastructure. In International Conference on Financial Cryptography and Data Security. Springer, 289–303.
[20]
Doowon Kim, Bum Jun Kwon, and Tudor Dumitraş. 2017. Certified malware: Measuring breaches of trust in the windows code-signing pki. In Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security. 1435–1448.
[21]
Dhilung Kirat, Giovanni Vigna, and Christopher Kruegel. 2014. Barecloud: bare-metal analysis-based evasive malware detection. In 23rd USENIX Security Symposium (USENIX Security 14). 287–301.
[22]
Clemens Kolbitsch, Engin Kirda, and Christopher Kruegel. 2011. The power of procrastination: detection and mitigation of execution-stalling malicious code. In Proceedings of the 18th ACM conference on Computer and communications security. 285–296.
[23]
Martina Lindorfer, Clemens Kolbitsch, and Paolo Milani Comparetti. 2011. Detecting environment-sensitive malware. In International Workshop on Recent Advances in Intrusion Detection. Springer, 338–357.
[24]
Microsoft. 2018. Control Flow Guard. https://docs.microsoft.com/en-us/windows/win32/secbp/control-flow-guard.
[25]
Microsoft. 2018. LoadLibraryExA – Windows API. https://docs.microsoft.com/en-us/windows/win32/api/libloaderapi/nf-libloaderapi-loadlibraryexa.
[26]
pe format [n.d.]. PE Format. https://docs.microsoft.com/en-gb/windows/win32/debug/pe-format
[27]
pev [n.d.]. pev - User manual. http://pev.sourceforge.net/doc/manual/en_us/
[28]
radare2 [n.d.]. radare2, a portable reversing framework. http://www.radare.org/.
[29]
roy g biv / defjam. [n.d.]. Virtual Code Windows 7 update. https://github.com/darkspik3/Valhalla-ezines/blob/master/Valhalla%20%233/articles/VCODE2.TXT.
[30]
saurik. 2013. Exploit (& Fix) Android Master Key. http://www.saurik.com/id/17.
[31]
Rebecca Shapiro, Sergey Bratus, and Sean W. Smith. 2013. “Weird Machines” in ELF: A Spotlight on the Underappreciated Metadata. In 7th USENIX Workshop on Offensive Technologies (WOOT 13). USENIX Association, Washington, D.C.https://www.usenix.org/conference/woot13/workshop-program/presentation/shapiro
[32]
Siguza. 2020. Psychic Paper. https://siguza.github.io/psychicpaper/.
[33]
skape. 2006. Locreate: An Anagram for Relocate. http://www.uninformed.org/?v=6&a=3&t=txt.
[34]
T. Petsios, A. Tang, S. J. Stolfo, A. D. Keromytis, S. Jana. 2017. NEZHA: Efficient Domain-independent Differential Testing. In Proceedings of the 38th IEEE Symposium on Security & Privacy. San Jose, CA.
[35]
Todd Cullum. 2017. Portable Executable File Corruption Preventing Malware From Running. https://toddcullumresearch.com/2017/07/16/portable-executable-file-corruption/.
[36]
Xabier Ugarte-Pedrero, Mariano Graziano, and Davide Balzarotti. 2019. A Close Look at a Daily Dataset of Malware Samples. ACM Transactions on Privacy and Security (TOPS) 22, 1, Article 6 (January 2019), 30 pages. https://doi.org/10.1145/3291061
[37]
ulexec. 2019. ELF Crafting Advance Anti-Analysis techniques for the Linux Platform. https://github.com/radareorg/r2con2019/blob/master/talks/elf_crafting/ELF_Crafting_ulexec.pdf.
[38]
virustotal [n.d.]. VirusTotal. https://www.virustotal.com/.
[39]
VirusTotal. 2021. File statistics during last 7 days. https://www.virustotal.com/en/statistics/.
[40]
Mario Vuksan and Tomislav Pericin. 2011. Constant insecurity: Things you didn’t know about portable executable file format. In BlackHat.
[41]
Zhaoyan Xu, Jialong Zhang, Guofei Gu, and Zhiqiang Lin. 2014. Goldeneye: Efficiently and effectively unveiling malware’s targeted environment. In International Workshop on Recent Advances in Intrusion Detection. Springer, 22–45.
[42]
yara [n.d.]. VirtusTotal - yara in a nutshell. https://github.com/VirusTotal/yara
[43]
yara pe [n.d.]. PE module — yara 4.0.2 documentation. https://yara.readthedocs.io/en/stable/modules/pe.html
[44]
Akira Yokoyama, Kou Ishii, Rui Tanabe, Yinmin Papa, Katsunari Yoshioka, Tsutomu Matsumoto, Takahiro Kasama, Daisuke Inoue, Michael Brengel, Michael Backes, 2016. SandPrint: fingerprinting malware sandboxes to provide intelligence for sandbox evasion. In International Symposium on Research in Attacks, Intrusions, and Defenses. Springer, 165–187.

Cited By

View all
  • (2024)Explainability Guided Adversarial Evasion Attacks on Malware Detectors2024 33rd International Conference on Computer Communications and Networks (ICCCN)10.1109/ICCCN61486.2024.10637577(1-9)Online publication date: 29-Jul-2024
  • (2022)ExorcistProceedings of the 2022 ACM Workshop on Software Supply Chain Offensive Research and Ecosystem Defenses10.1145/3560835.3564550(51-61)Online publication date: 11-Nov-2022
  • (2022)SYMBEXCEL: Automated Analysis and Understanding of Malicious Excel 4.0 Macros2022 IEEE Symposium on Security and Privacy (SP)10.1109/SP46214.2022.9833765(1066-1081)Online publication date: May-2022
  1. Lost in the Loader:The Many Faces of the Windows PE File Format

    Recommendations

    Comments

    Information & Contributors

    Information

    Published In

    cover image ACM Other conferences
    RAID '21: Proceedings of the 24th International Symposium on Research in Attacks, Intrusions and Defenses
    October 2021
    468 pages
    ISBN:9781450390583
    DOI:10.1145/3471621
    Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than the author(s) must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from [email protected].

    Publisher

    Association for Computing Machinery

    New York, NY, United States

    Publication History

    Published: 07 October 2021

    Permissions

    Request permissions for this article.

    Check for updates

    Author Tags

    1. executable file formats
    2. malware analysis
    3. parser differentials

    Qualifiers

    • Research-article
    • Research
    • Refereed limited

    Funding Sources

    Conference

    RAID '21

    Acceptance Rates

    Overall Acceptance Rate 43 of 173 submissions, 25%

    Contributors

    Other Metrics

    Bibliometrics & Citations

    Bibliometrics

    Article Metrics

    • Downloads (Last 12 months)47
    • Downloads (Last 6 weeks)1
    Reflects downloads up to 03 Oct 2024

    Other Metrics

    Citations

    Cited By

    View all
    • (2024)Explainability Guided Adversarial Evasion Attacks on Malware Detectors2024 33rd International Conference on Computer Communications and Networks (ICCCN)10.1109/ICCCN61486.2024.10637577(1-9)Online publication date: 29-Jul-2024
    • (2022)ExorcistProceedings of the 2022 ACM Workshop on Software Supply Chain Offensive Research and Ecosystem Defenses10.1145/3560835.3564550(51-61)Online publication date: 11-Nov-2022
    • (2022)SYMBEXCEL: Automated Analysis and Understanding of Malicious Excel 4.0 Macros2022 IEEE Symposium on Security and Privacy (SP)10.1109/SP46214.2022.9833765(1066-1081)Online publication date: May-2022

    View Options

    Get Access

    Login options

    View options

    PDF

    View or Download as a PDF file.

    PDF

    eReader

    View online with eReader.

    eReader

    HTML Format

    View this article in HTML Format.

    HTML Format

    Media

    Figures

    Other

    Tables

    Share

    Share

    Share this Publication link

    Share on social media