What's going on everyone Sam here with late in sports cards? We are ripping 2020 To tops Cosmic Chrome baseball hobby 12 box full case break number two random division style Here's a look again at your random results As always you can find these on the website under the results tab as well as the link that's in chat Let's do it guys got to fill up the next break. That is gonna be a 2122 Peninidon Russ optics basketball pick your team style, so you are able to select your own team, which is always nice no Leaving it up to the random gods on what team you're gonna get There is a team that you want sound to 13 is it? But good luck everybody let's do some cosmic yes 13 perfect. Yeah, we're down to 13 actually Shawn just can't type Counting is hard All right, here we go guys Miguel Cabrera Wilson Contreras base Chapman rocket arms will you Domus? There's an Alec Thomas for the NOS and the scope rookie Colors blue Josh Donaldson for the Yankees 22 out of 99 big Josh JD Chapman Luis Hill Launch into orbit Alex Rodriguez Yankees Hunter run for a Wilson Contreras Patrick wisdom Runs okay Launch into orbit this time mookie bets nice one there for the Dodgers and a West Lars New bar Justin Berlander what do the Yankees do this year to improve? It's hard dude.  They're like a dynasty the ashes are like a dynasty at this part to say they're not They've still got a pretty strong farm system Josh Donaldson, come on baby big red Starling Marseille nice and at least that's going to show F on the red lava to a five Nice red Alec bomb Stroh's are good man sucks to say that to launch an orbit Ken Griffey Jr. And a West Mariners Hellendricks hey, we're on a box to good luck everybody still 13 to go guys On our next break three or four a case I would say bedside so one every three or four boxes generally Chiseled Josh Hater. That's true That's true. We'll be interesting to see if Berlander stays Be kind of cool to see him go back to Detroit Go back to where he says I don't have anything else to prove There's Wander Franca He's got cool already. He's a first ballot probably another style young this year. It's got an MVP Once more Yeah auto checklist is excellent Yeah, last case we pulled a super fracter Walker Bueller auto A gulchman a judge and a Lonzo and one other one so I forget who the other one was now CJ Abrams on the back Walker Bueller speaking of nice one there Congrats the NL West. That'd be awesome. John. I'd love to have Verlander Yeah, it's supposed to be a snowstorm in Buffalo Supposed to get like a ton of snow in half 17 out of 99 on the Blue nice one there and I was central Yeah, all on card to from what I've seen at least they're all on card Scope Pita Lonzo Kyle Muller say that's a zoo clue. We got a gold Miguel Sunno a l central 23 out of 50 nice gold velocity Strasburg you haven't sheets Wander rookie Brendan Marsh Yellow 13 to go guys on the next break got to get that filled up. We want to keep on Rip it on schedule at least CJ Abrams refractor rookie nice one there for the Padres Chris sale Launch an orbit a rod Kershaw and JD. There you go Said everything is on sale for the next one as well one second guys. It's got to send one message. Oh Thank God. All right Dean's here. We can go again. What's up Dean? Blue Joe Ryan rookie for the AL central 87 out of 99 nice one there and Jayrod rookie German pane your rookie got your Florida fire frogs hat today. Let's go They're literally I love those hats did got a black Mitch Hannigan That's four out of ten. There you go. Congrats on that one a l West Yeah, hey Oscar Hernandez to the Mariners. That's a great pickup for them He's like one of the most efficient hitters in baseball. You start Shrens Shane boss Glad you think that Dean Just mad someone didn't buy a hat that you wore Yeah Like wait what hat Sean wearing I'm not gonna get that one That's what the people say Just I agree. What's up James we go Cabrera. There's an O'Neill cruise up Ken. How are you doing buddy? I've only been in for since like 330 Pretty much Gary at this point. I pretty much do Have more hats and live my apartment. It's like there's just hats everywhere. It looks terrible Scope Marcus Simeon Nice one there for the Rangers Fitted I'm all fitted John all fitted Why Bose that'd be cool That'd be really cool That's what you dream got lost in orbit Sammy Sosa and a youth invasion Hunter green nice one there NL central Congrats on that one Let's go.  I appreciate that John seven and a fourth generally Yeah, oh boy, yep Visional break. Let me take a look for you Brennan really quick. I'm not sure Washington orbit is a Tate's so Brennan take a look on that right now for a man a three ninety nine ninety nine a spot So 400 basically yeah, I appreciate that John why Bose baby Lakes now and guys we need to fill up the next break Ronald Acunha Take a look on spots really quick again down to 12 to go on it. Thank you guys 12 left A lot of good deals on those bigger teams that are still left to Pretty high percentage taken off those Griffin Jacks It's a 99 for the twins Breaking next as well Lots of good teams left for sure Check it on out Joe Julio Rodriguez. Oh, yeah, is that quick? Yeah Notting yeah Jeremy Pena on the back Matt Olson. Hell yeah, we're almost Launching orbit Lou Bob O'Neill cruise base rookie pirates and I'll central or hey solar face Patrick Corbin gold Zach Ranky for the nl center a l central nice one there 10 out of 50. Oh, yeah, bro. Pretty much right down the street Oh, yeah, that's awesome And that's why that field and pond can you ever been out there? I've not no those fields are out there Wow, that's awesome Orange of JT Real Muto going to the nl east nice one there four out of 25 And 20 cents. Yeah, guys choppy the link again to the next break All teams like I said are on sale And check it on out appreciate that Patrick took a couple teams and 54 nice nice nice Awesome awesome. Thank you guys so much Appreciate that All right, let me get back to there we go. That's right. Need to go Said 12 to go all the teams are on sale a lot of good deals in there as well Like you're looking to pick up maybe a little bit more expensive team They have been marked down the cheaper teams are generally marked down in most Most cases so if you want to get a team just chase them color of a star That's usually the way to do it right there. That's six spots six shots at it In terms of boxes, which is always good. So yeah, definitely a great way of doing it Great way of picking up some like greatable color. I mean we've been talking about PSA the entire time here. I mean optic One of like the mechas of PSA Say a Suzuki rocket arms Garrett Cole Carlos correct sir hanging out everybody got two hundred two viewers in here. That's awesome, man She hit that Launch into orbit show. Hey, oh, Tony Wander rookie Corey Seager Portland next break. Oh, that's cool. Nice. I got to pull some big Portland stuff now nice dame for him Yeah, that's cool. All right, so congrats to your buddy. Yeah, man Launch into orbit. We've got gold Shane Bieber going to the AL central with the Guardians 16 out of 50 nice one there Trevor story scope JD Martinez JD again to a keel but do 36 out of 99 AL central with the Tigers nice one there powder Gilbert Peter Lanzo Pitched in got him a dame rookie autos for his birthday. That's awesome dude. That's that's a great gift right there That's such a great gift Because those are hard to come a dame doesn't sign a lot like he did not sign a lot in his rookie year And then did not sign like anything up until a few years back. He was such a tough bull and autos Yeah Signing everything Clayton Kershaw scope blue Reese Hoskins 94 out of 99 for the NL East with the Phillies There's many Machado launch into orbit Please heal J. Berger Gabriel Arias was on the back there Guardians Lars new bar So the fall of their voya. Well, Bobby Whit. I like it. Honestly, cause I I've I Had no idea what to expect when I first came in and honestly I've had no complaints about it so far Yeah, it's clean. Yeah very clean It's a different approach. Yeah, the color guy. Oh, it looks good. I love the colors Guy cuts are pretty. There's Torkelson and Stephen Kwan Kwan, baby a hunter green scope rookie CJ Abrams rookie Great auto checklist so far too. I mean I haven't been disappointed with a single auto we pulled blue Kyle Hendricks 90 out of 99 NL central for the Cubs stop Andrew Andrew How you doing, buddy Yeah, insert their fire. Yeah. Yeah, the launch into orbits are Amazing in my opinion Big fan of those launch an orbit wander and gold jared kelnic 36 out of 50 a L West Mariners Royce Lewis rookie they got all the big rookies. You could really ask for I would say Like there's really nobody that's left out. You know what I mean on the box seven later Yeah Yeah, sure Vaughn absolutely Down to 11 to go now on the next break guys 11 to go Yeah, they're fun, man. Like I could see buying a personal of this for myself Yep, breaking next as well guys teams are all on sale a lot of good teams left a lot of really good deals to be had Definitely check it on out. We're almost there redemption of Fernando Tates, Jr Launched into orbit autograph variation. Wow, that's sick That's gonna be one of so that's going to NL West with Jason Kaye That's gonna be one of those inserts you guys saw Tatis nice Congrats on that And I'll last There you go Ross appreciate that man. Russ just took a couple spots in The break yeah, Nixon wizards good deal there too for sure a Lot of good vets you could hit out of those two teams as well Yeah, we're down to nine now. Thank you there appreciate that Russ down to nine guys Now I'm gonna go Does it just as variation I didn't say if it's numbered or anything Washington orbit judge Matt Chapman 83 out of 99 color match Heck yeah, I'm pumped man. Yeah, nice Julius Randall Julius Randall Get me started that blame that one on Gary Gary got me started there. It's a Shohei refractor CJ Abrams. Yeah, so he knew it to Trey Turner Spencer Turcalson yeah It already is I mean we're sweating I Stephen Kwan rookie Max Scherzer scope old Andrew Benintendi going to the AL central 39 out of 50 for the Royals nice one there Yankee legend Washington orbit bar in Buxton nice one there and McCullers Value-wise what's better for you to get Ken? Prott. Mmm. God. That's tough Probably hunter green I think hunter green is a little bit more hyped like Lidolo is good. Don't get me wrong but hunter green is just like He's just kind of like a freak of nature to some degree.  It's up waiting. Good morning. Yeah You're over in what Taiwan, right? Hey To tell Marta So you're hating on all those pizza chains I just look to my left. I'm rather hungry True that's not pretty good What up waiting Taiwan's finest. Oh, yeah launch an orbit one soda Hey, you got it. Ken. I like I like hunter. I like hunter. I think he's just He's like exciting. He's a guy that people are like getting excited for you know, he's gonna be one of those guys that When he pitches like you you watch a Reds game Salvador Perez Johnny Hernandez, I don't mean that is like like oh nobody watches the Reds, but like if they're on TV I would draw on the Reds game if hunter green pitching Lots of time. He's actually nice Clayton Kershaw. He's a wanderer rookie. Hey, Elise Exactly. He's one of the reasons you watch the Reds He's awesome. Yeah Yeah Blue Jack Flaherty 90 out of 99 going to the NL central black Javier by his supernova Six out of ten boom Al central Scott M. Congrats, man.  This is like a case hit right here, too. Yeah two cases, dude Not bad rats on the supernova Frankie Lindor Yeah, super short-printed 10 right that's like hitting a downtown like black a lot of gold downtown right there Out of optic football Scope Bryson stop say a Suzuki Josh Bell and Correa nice. All right on to our next box here Stuff has been fun. I gotta be honest It's just different, you know down to five to go. Thank you guys Wow Five to go on the next break everybody Heck yeah, thank you guys so much. That's awesome I'm reading what the teams are yep. Thank you, sir Hornets warriors thunder 76ers and Raptors nice so a lot of good teams still left guys Supernova web what supernova luba? Wow Who's supernovas? Not bad We'll take that nice one there Jackson co-ar every captain though Unless I'm capping that supernovas aren't actually that rare Three in this case actually Andrew because we pulled the youth explode or the youth invasion to Jeff McNeil Blue to 99 for the Mets and at least your Donna Alvarez about an orange David Peralta to 25 That's going to the NL West. Oh, I totally agree there Lee Or leaf I should say the black coming up here of Max Muncie. Nice. There you go. I know West 10 of 10 on the auto Nice Muncie. That's sick. Take that for sure for sure for sure Totally totally dude dirt Like rad There's J rod launched into orbit O'Neill cruise rookie real mute up. I don't think so Is it? Yeah, is it sold out? Yeah I'll get you the link to the one Wow I'm still seeing five.  It's cuz go back on the link and you if you Yeah, I'll explain it J rod rookie If you click on a team accidentally then it does a variant instead of yeah, I'll drop you guys the link right here Yeah, if you click so say like say like you click here and you go and like click on the thunder It changes it to the variant so that's only the link for the thunder so someone buys the thunder then it gets You know what I mean? Yeah Yeah, I got it took me five left. Yeah five to go still I've to go Jeremy Pena rookie Joe Oliver as a Reds catcher nice Let's say I couldn't name you outside of Johnny Bench like a really good catcher either. There's an Frankie Montess Al West cast the ounce Andrew bone Yeah, Matt taught me that because I would just I would do the same thing I'll just send it. It's a variant all the time People be like DJ the man you that's cool. That's awesome John Mark McGuire launched into orbit. I like that McGuire and Sosa and the Blake to make it so like you can throw us BP. I can take them dead center or 50 Is that I won't yeah That's free money Stop KJ I'll Blake would throw me a curveball and sit on it KJ pizza made me hungry I Angry Verily Yeah, it does one photo there one photo on the back. That's a cool one man. It's a cool idea Chillin sorting Pokemon. That's fun man. I love sorting cards. It's like therapeutic and eBay doing eBay is like therapeutic It's awesome There was a Gabriel Arias really quick Right there for the Guardians Sold all my Dante Foreman's that I had. Oh, yeah. Yep. Nice orange Reese Hoskins auto NL East 13 out of 25. Congrats on that one a show F It's Reese Hoskins Yeah, cuz I just buy him I always pick him up because he was always like a fringe NFL sky When he got drafted in he was 2018 either 17 or 18 Think 18 Mike trout launch into orbit Bobby Whit rookie and like he played to the college of Texas Which is like one of the biggest fan bases in the world. I was thinking I'm like, yeah Even if he doesn't make it in the NFL like Texas fan base And then he made it in the NFL. He's doing well Oh, yeah Matt Manning scope blue MJ Melendez rookie to 99 for the Royals orange Christian Yelich and I'll central nice one there to 25 orange lava Jorge Soler For to go for to go on the next break guys For to go. Yeah, I saw that Lee. It looks really awesome. O'Neill Cruz. You seen the update next year Looks good. Yeah. Yeah, I'm not update series one top series one baseball looks awesome Like the players photo and it has like a headshot in the bottom right. Oh, yeah, there's Bryce Harper launching to orbit What's up, Sonia? Even especially like Vaughn likes it Vaughn's like a true baseball card guy like Forrest likes it Pretty much everybody Blake likes it. Everybody I've talked to seems to like it. It's interesting. It's different, you know Not something they generally will do If special for my personal box were made by nice Washington or nice Washington orbit J rod, that's awesome Yeah, I would say so tools of the trade RPI from absolute absolutely Yeah, definitely How guitar Ecuador's Monday for the World Cup Washington orbit Tati's junior Um Katar and Ecuador plan Monday for the World Cup Yeah, go DJ Friedel nice one there 46 out of 50 That is going to the NL central Sunday Sunday even better JV. What time is that game at here? All over the mall Sunday, and I am central Thanks, man. Appreciate that. Yeah, thank you JV. Good looking out. Yeah There's launching the orbit Sammy Sosa. We've all been excited about watching that. I know Yes, and it's in like Asia Middle East like they're all gonna be early, which is actually kind of cool for us. Yeah Yeah, it works out kind of well for us, obviously Sunday 6 a.m. For the in Hawaii for the World Cup. Oh, no stanger Yanni Hernandez and a West. Oh, that's top John. That's tough. I'll be waking up when the game starts Yeah, same probably now. I'll be streaming when the game starts here. Yeah football 8 a.m. That's wild It's like it's the Sunday night football is over and it's like 7 o'clock in Hawaii That's awesome though I'm always so jealous of like the West Coast. They football started 10 a.m. Then football like One is the four o'clock games and then their Sunday night starts at 5 Yeah, true Yeah, I would say so Sonya. There's a J rod We'll open at 8 a.m. For EPL games. That's sick. That's really cool Sunday night football ends when it's sunset. That's what really John just said. Yeah blue Bobby with jr There we go 95 out of 99 a l central Congrats on that one a l central Scott M. There you go Scott Scotty Grats, buddy Jeremy Pena quick refresh here for to go still guys We've got the Hornets Warriors Sixers Raptors Hornets Warriors Sixers and Raptors breaks next sixers Bar on sale as well All right last box of Cosme for the night. Good luck here. Well for group breaks. I know we already have a couple of personals Yeah, Ed Ed B jumped in got one heading bond was talking about getting Yeah, look it up. Yeah, I'm interested I'm gonna say For sale CJ Abrams rookie Versaigra Wander rookie. Oh geez gold Ronald Acuna Jr. 41 out of 50 and at least nice one there Did he end up he ended up winning it good. I'm glad he deserved it Sandy Alcantara for the Marlins one side young Good for him, man Wait, who ended up winning? Oh Michael Harris won the NL rookie there. That's right true does not play on a very good team Their pitching staff is so good.  Yeah, he's like watch this guy's just watched into orbit Stephen Kwan, whoa, whoa I guess statistically stands the best Probably he's show F and great auto is in this one. Congrats on that. Nice Acunya Heck yeah Cow Raleigh wanted him to be Yankee so bad Cow Raleigh refractor rookie Alcantara Nope, he signed like a five-year $50 million deal Lush in orbit Acunya Blue Teosca Hernandez the 99 they do have a couple and Austin Noah All right guys, so quick recap here not gonna read off the divisions or anything. It's gonna go through the players We have our color in autos Walker Bueller Akhil Badoe Josh Donaldson Ian Hap Joe Ryan Matt Chapman Reese Hoskins Jeff McNeil Jack Flaherty Kyle Hendricks MJ Melendez give Griffin Jacks. Those are your blues We had our golds Miguel Suno Zach Rankie Andrew Benintendi Jared Kellnick TJ Friedl Ronald Acunya Shane Beamer We had our oranges oranges the 25 JT Real Muto Christian Yelich David Peralta Reese Hoskins auto Max Muncie auto 210 is for the NLS Starling Marte Red Luis Robert supernova short print Tatis on the auto redemption we had Youth invasion of Hunter Green Supernova black to 10 hobby bias a Ronald Acunya junior auto and blue Bobby wet jr. 299 that'll do it for the break guys. Thanks again for the film next up We have basketball


Being good at something that you love gives you a lot of confidence. And so when I started doing standup, you know, right in college, I was like 21 or 22, didn't have confidence until I started doing well on stage. And then suddenly everything changed, like my whole life, the way I thought of myself, the way I carried myself, the way I talked to people, the way I talked to girls, they just changed, you know? All came from standup. Being really good at something that I loved and wanted to be good at was awesome. Yeah, so that sort of changed everything for me. And then I started acting as nerds and all of this stuff. And this industry, it really puts you in a box. It really is like, this is what this person does. This is what they play. And after doing that for years, I was like, there's so much work that I don't have access to. I feel like all they want me to do is play this kind of beta mail. And that was 10 years ago, I did that special. And that's how I presented myself. So that's what I'm saying, like as much as it's their fault, it's partially like you were, that's how you kind of thought of yourself. That's how I thought of myself and that's how I thought I could get work and that is how I got work. And standup will be a negative. It's a bit like you get laughs saying it. So then you're like, I guess this is who I am. You know what I mean? Sort of, and that is how I felt. But I had that thing of, that I think someone like Conan has, all his jokes were about how he's beta, but he's not Conan's alpha. Sort of like that. So I really had that drive and motivation and ambition and all this stuff. My jokes on stage were about how I'm terrified of stuff. But in real life, I really was, I wanted to be really good at it. I wanted to be successful. I wanted to crush on stage. If I went on a show, I wanted to be funnier than everybody else. I wanted to bury my friends. That's very fun to acknowledge. Yeah. And that, and I love, I always knew that about you. You did? And I always knew that about you. So I always knew that about you. So I'd go to like this sort of communal meltdown thing. And I was like, no, this is for keeps. Yeah. This is like, there's definitely a competition here. Oh yeah. And it's not, it's not a commune. No, it wasn't for me. It was for some people. It was for a lot of people. And I know that some people didn't like that about me. That at the meltdown, which was such a great room and this communal space that I was sort of like, I want to do, I want to invite all these people to my show. All these really funny people. The funniest people in the country. Every famous, you know, comedian did that show. And on that night, I want to bury them. I want to be funnier than this. That's the spirit of alternative comedy, ladies and gentlemen. Yeah. I totally, I don't, I never think of burying people, but I do think of like, I want to come in first. I want to come in first for sure. I don't, I was always like, no matter how good my set was, if somebody did better than me on that show, I wasn't that happy. Cause it's like, oh, it was possible to do better. Yes. I want to talk about the psychological underpinnings in that though. Okay. Your desire to win, your desire to win. And I don't think that there's anything wrong with it, by the way, like I don't, it's a part of myself that I'm, I like. Meaning like, I'm not ashamed of the, of being competitive. I think it's fucked up when you're not, if you're not rooting for your friends, if you're not, my, my thing is I, the only way I win is if I really prepare. Yeah. It's, it's, to me, it's like motivation for like, you have to prepare. For sure. You have, you can't wing it. I can't wing it. I can't wing it either. I can't, I can wing it here and there, but it, it's not, it's not like, I can't count on that. I mean, the ultimate block, I don't know if it's a block or, it does lead me to being a little bit unsatisfied. I don't want to say I'm happy because I am generally pretty happy. My self-worth, ultimately, is too tied to my career and what I'm doing. My, my, my, my worth as a human being is too based on how I perceive myself as being at my job. I don't have that, like, it don't matter. I'm like, if I, that's what was hard when I would do stand-up all the time.  Yeah. It's the same with like acting.  I feel like I'm not like a worthy person. Too much of my worth is not inherent. Too much of my worth comes from how I think I'm doing. Totally agreed that I'm in the same boat.  I think we are. I don't know if you're born with it or it's you learn it. I know I've been like this since I can remember. Like with studies, I was a big nerd. I wasn't, you know, good at sports or cool or... Good title for a special big nerd. Yeah. Hooked out. Then I hooked out. But I really, really cared, big nerd. Yeah, that's the next one. Hey, did you like that? Did you like that? Yeah, did you like it though? You want more? Don't wanna work? Would rather watch videos of me grab acid with people?  This is like when the weatherman says there's a high pressure system coming in. I'm not really used to the green screen.


So before I start, I would like to say that I'm really excited to present at the first edition of the NorthSEC conference, and it's a big pleasure for me to be on this stage among the other speakers. So today, I will be speaking about practical approaches to reversing object-oriented malware, using your hex-raised decompiler, which is a part of the IDA Pro Disassembler, and this project has been done together with Alexander Matrosov, who is not here, so I'll be presenting to you on my own today. So let's start first with the brief overview of today's presentation. So this is gonna be a practical presentation, and just to define the scope of the talk, we will limit our retention toward C++ as the object-oriented language, because this one is the language which causes a lot of pain for reversers. We will also limit our retention toward a specific compiler, Microsoft Visual C++, to produce the compiler code here, because some of the approaches I will be presenting today and speaking about, they may not work, for instance, for GCC Linux Compiler. And we will use all the year examples will be based on the IDA Pro and hex-raised decompiler, because this is a very versatile tool, and there is a de facto standard in the industry. So we will have three parts in this presentation. First, we'll be speaking about why is your reversing C++ here malware is difficult, how it is different to say, let's malware return and see. We'll just take some simple examples to understand what's the difference, and then we'll move toward malware seen in the wild, and here are some use cases what are the problems with reversing this malware and how to approach this problem. And finally, in the third part of the presentation, I'll be speaking about how to automate some reversers tasks using a hex-raised decompiler. So just to introduce the context, I wanna bring your attention to this slide. This slide here shows your modern C++ malware used for targeted attacks. So the list is not exhaustive and complete, it's not the goal, it's just to highlight the importance of the dealing with the C++ code because all this malware is developed using complex frameworks, and it is challenging for reversers, for malware analysts to reverse this malware to understand its functionality, what is it doing? So we can see a few nice examples like in 2010 Stuxnet, which challenged the industry, a malware targeting Iranian nuclear facilities. Then in 2012, we discovered Flamer, this is another malware, non-arguably one of the most complex to analyze, and recent examples with their animal farms and send-need, so everything is in C++ with the complex framework. So let's move on and speak about why reversers in C++ code is a hard problem, why is the different tour compared to the other C languages? So please take a look at this slide here, and let's compare two snippets of the code, one on the left-hand side and the one on the right-hand side. So on the left-hand side, we have a very simple code, we have a class cat with one method, eat, and we have just one instance of this class over here, I'm just, we'll use mouse to show you over there, we're calling eat method. So everything should be clear here. And on the right-hand side, we have a little bit more different situation because we have a basic class animal, and the cat is your actual child class, so it's inheriting from animal, and we have a virtual method, eat. So the principle difference here, we don't have any virtual methods on the left-hand side, but we have virtual method here. So let's compare the code which is produced by the compiler to see how this is your difference. Different so, I hope you can see this screenshot from the X-rays decompiler. We have an allocation memory for the object, we have initialization of the object here, where is the constructor, it's called, and we have an execution of the method, eat. So everything here is pretty straightforward and nothing special like is if we reverse and see program. But with virtual method, the things are a little bit different because now we have a call to our method, eat, but it is not called directly. A pointer to this method is stored in some variable which is known as a virtual function pointer table. And this is the key difference because the method is not called directly but it is called using a pointer which is stored in some table. And where this table is initialized, this table is initialized in the constructor at the creation of the object. Why does this happens? This happens because this method is virtual and at the time of the compilation, generally at the time of the compilation compiler doesn't know which method exactly which is going to be executed. If it's going to execute method which is implemented in the class cat or potentially there will be some other derived class with the base class animal which will have the other implementation of the eat method. So it encodes this information at the time of the creating the object and then uses this table of the virtual functions to execute this call. And let's speak about virtual functions table as we have seen on the previous slide. We have a instance of the type A class A and we have a virtual function table. So this is a table which lists pointers to the methods corresponding to this class. This is the rectangle in the middle. And additionally, we may have some additional information which is called RTTI object locator. RTTI stands for runtime type information and this is your optional object which may be inserted by the compilers. So compiler inserts this object when you're using dynamic cast or type ID information because in this case you're during the execution of the program the runtime environment would need to know information about the types. So this information is stored in the binary as well. And just to show you the example so we have here a constructor. I hope you can see it well. So this is here where the virtual function is a virtual table is instantiated. This is the pointer to the layout of the virtual table. We can see here pointers to the methods actually over here. And this is information about the RTTI object information. So what's the problem with the virtual functions? First, it leads to indirect method calls which is difficult to analyze in the static context because when you're looking at the program statically and you encounter at some point a call to the virtual method it is not clear exactly where the control is going to be transferred to and to be able to identify this you would need to track back objects to its creation to find constructors to the particular place where this object is instantiated and from the constructor you just gonna grab the pointer to the virtual table which is also generally a hard task because for instance you are maybe reversed in some instance of the code which reads objects from the vector and executes some routine in the virtual table but where these objects came from is not clear. Another problem with the C++ reversing is using C++ templates. This is here another way to implement polymorphic types. For instance, as we can see here we have different vectors of integers, strings, characters or some custom type and every time when you use these types the code will be unwinded by the compiler and inserting the binary so we will produce a lot of extra code to analyze. This is the first problem and the second thing when you're using C++ templates it creates some problem with the identifying some standard library code. For instance, IDAPRO has a special tool which is abbreviation FLIRT. It can highlight as shown here the standard library code so you don't have to reverse it. You just know that this is called like memory location operator new or some other. When you're using these templates you can, the code is generated, the code is not pre-generated because library code is your coder pre-generated and you're just using this library to link it so you can just put some signature on these functions and then you can easily retrieve them. In case of your templates you are going to regenerate this code. For instance, if you're using a vector the vector is defined in the header file and as a result the code responsible for handling methods of the vector will be compiled with your application and you can play with different compiler optimization options to produce different codes with the same class. And just to summarize some problems with the reverse and C++. So generally we have two problems. First to reconstruct the type. When we have reconstruct her but first we need to find the place where the classes are instantiated. We need to reconstruct it attributes. We need to find the virtual tables and if we have information about RTTI in the binary it is always useful to reconstruct class hierarchy like which interfaces and which classes this particular instance which we are analyzing is inheriting from. So this is the first part. Let's now take a look at some real malware which we've come across during working on the malware analysis. And the first I'm going to speak about the Flamer. Flamer is nonarguably one of the most difficult malware to analyze. One of the samples which we received is about six megabytes which is statically linked with the lower interpreter, SQLite database and a lot of additional code to analyze. First let's take a look at this framework because it's very common for such complex malware to implement itself as a framework. And here for instance here we can see at the right in the center there is a vector of tasks. So the tasks are some routines which are executed in the separate threads and there are different kind of tasks here. For instance there is a task mark which is your implements a fake Windows Update Server to distribute malware within the organization. It just emulates Windows Update Server and when the computer operating system Windows requests for an update malware send its binaries as an update so the computer installs it and it's running and it used a forced certificate to be able to work by pass authentication. The file finder is responsible for finding files on the machine according to some pattern. There is a task for instance idler which is responsible for executing some tasks periodically. All these names which we retrieved from the binary from the configuration information so we didn't have any RTTI information in the binary but in the configuration maybe for debugging purposes or for communication with CNC server they kept these names so this is how we got them. So either has some other tasks which are executed periodically. For instance this Beetlejuice is using Bluetooth hardware installed on the computers to be aware of the different instances which are infected in the networks which are air gaps separated which are not in the same network segment. There is a frog module which is responsible for replicating itself using creating user accounts. Ifary is for distribution using removal media using linker files. There is a vector of consumers. These are a kind of triggers. They are called in the flamer consumers and they are triggered when some specific event is happening. For instance mobile consumer is triggered when a mobile device is attached to the infected computer. Media is when some media is inserted in the computer and there is a vector of the common executors so those modules are basically responsible for dispatching commands from the command in control center. So let's speak about some types which we were analyzing while we were working on this malware. A lot of work was done with the standard types like smart pointers, string vectors to maintain objects or some other custom data types. Maybe these types are taken from some standard libraries. We were not able to identify these because we came across from different libraries and it is very likely that this is some custom implementations of the types. And since they are used very heavily the abstracted analysis significantly. For instance smart pointers. I think for those who are not aware of what the smart pointers are these are the objects which are helped to manage pointers in C++ to avoid memory leakage. So they contain two fields here. One is the pointer to the object and the second is the number of references. So it keeps track of the references and when the number of references is zero you can dispose the object and release the resources. And this is just an example of how a constructor of the smart pointer looks like we are just allocating memory for reference and initializing it with the object over here. And other types which is heavily used in this kind of malware is the vectors. This implementation of the vectors is definitely something different toward for instance a standard template library vector implementation. The vectors are used for handling objects like tasks and triggers. It is very common instead of just creating a thread, a thread in the computer on the machine, the malware just creates a special object thread, inserts it into a vector, then passes this vector to the executor which is just going through the elements of the vector and executes them. And those parts are implemented in different parts of the binary. So it's not clear exactly when you have a vector what kind of objects are in. And since this is your implemented using templates, you cannot recognize them automatically that this is your standard code. And of course strings. Strings are used very heavily for paths and a lot of work was done. Maybe you're about 70% of all the code which is reversed. It is your vectors and strings and smart pointers. Okay, so now let's speak about how we're going, what are the approaches here? What is the methodology toward reversing object-oriented malware and specifically C++? And here I wanna bring your attention that when working with the object-oriented malware, we are shifting focus to type reconstruction because when you're working with the C code, this is mostly all around you're all about reconstructing control flow graph. You need to understand where this function is called from, where it transfers control tour and what API routine it is using just to grab the context and describe this functionality. In C++, the things are a little different because there is a lot of work between types. So instead of reconstructing control flow graph, we would need to concentrate on what types are implemented in the binary and how they are interconnected with each other. So to achieve this, we need to first identify object constructors to see where the objects are created to grab information about virtual functions, et cetera. We need to reconstruct objects and reconstruct their methods to understand this functionality. About constructors, sometimes it's tricky, but generally you can recognize constructors using some clear pattern. For instance, there is a memory location using new operator. And then the pointer is passed as shown on this slide to some routine over here. Like we are locating memory and then passing this to this routine which your insight does initialization and you're assigning a virtual table. Okay, so when we have identified constructors, we are going to reconstruct object attributes. We can efficiently use a sear structure representation to describe the objects. And in the IDA Pro, we can use your IDA local types to create the structure describing the objects like here. For instance, this is one of the, this is the structure description of the object in the flamer. When it comes to virtual functions, as we can see on this slide, we have a virtual function for a C socket object. We can create a C structure to describe it in IDA Pro here where the fields are the name of the methods actually here. And we can then modify a pointer in the very beginning of this structure which is a struct C socket to point to this table. And when we will be decompiling the code, we will have this nice picture because it's very clear and straightforward. We have a structure, we have a V table and we have an execution of this routine which we named and this is a readable code. Without this, we would just have some codes going to arbitrary, at some arbitrary offsets. So this is about the flamer. The other malware, which we will consider is one of the modules of their operations and need. We'll specifically restrict our attention to one of the models which is x-agent and tomorrow my colleague Jean Calvié will be speaking about this operation in details, cover all the modules. So let's take a look at the x-agent framework. It is a little less complicated as the framework of the flamer. We can see here that however, it has a lot of similarities. For instance, we have a vector consisting of the objects which are implemented by agent module. So these are the modules which are executed by the malware and kind of stand alone and communicating with your CNC server. And by the way, one thing to mention here that this modular framework is being used here in such a way that for malware developers, it is very easy to develop malware which is operating on the multiple platforms. For instance, we have modules which have with the same framework but they are compiled for Linux and for Mac operating system. But the interfaces and the modules are the same. So we have here an agent kernel which provides some basic services as local storage, crypto and some reserved APIs and channel controller. Channel controller is a kind of multiplexer. It multiplexes your messages between channels and the channel is the object used to communicate with your CNC server. In this case, we can see that there is one channel here in HTTP which implements communication with CNC server over HTTP protocol. We have some modules here, module file system. This is your responsible for triggering events related to file system to scan for the files, remote keylogger, as you can guess from the name is just your keylog, the functionality process retranslator is a remote shell. Here is the architecture of the agent modules reconstructed. So all these modules implement a single interface which is your agent model consistent of five routines here. The first two are used to exchange information with CNC server, receive a message from the CNC server, receive some commands and send message to report something to CNC server. And there are some routines, get module ID and set module ID. Each model has its personal identifier and the final is the method is execute module, actually run its functionality. Okay, how did we get all these names here on this slide? Thanks to RTTI because in the samples we analyzed they contained RTTI information. This allows us to recover type names, reconstruct class hierarchy and identify object virtual function tables. Like here is the screenshot from the plugin class and the former which automatically goes for the binary and extracting all the RTTI information and we can see for instance here that the agent kernel is the implements to interface's agent model and I kernel provider. So this information is very useful for reversers. This is the good thing, the bad thing is that RTTI is not always available in the binary and it is very compiler specific. For instance RTTI information is not present for classes which doesn't have any virtual methods because in this case your compiler know the compilation time, what's the type of this class and there is no need to insert RTTI in the binary. And this is for instance a screenshot of the win of the model remote K-logger virtual table reconstructed using this RTTI plugin. Let's take a look at some of the modules here implemented here. So local data storage it inherits as we can see here it inherits to it implements to interfaces I local parameter storage and I local data storage. Parameter storage is actually a registry reader writer over here so it can read and write data in the registry and the file reader writer does the same thing but only with the files on the hard drive. The crypto interface is used to encrypt messages in communication with CNC server. It has only three methods here validated buffer encrypt buffer and decreed buffer. The crypto interface is based on the RC4 implementation and one particularity which I want to bring your attention here is that toward encrypt a message here it uses a key which is your hard core in the binary but it also generates a random sort of four bytes and when it encrypts a message it generates random four bytes, can continue with the key and uses this information to encrypt the message and then it depends these are sold to the end of the message. So whenever every time the same message is encrypted with the same key the Cypher text is gonna be different. And there are some other reserved API's we have only here like API's listed at the bottom of the slide get volume serial number create mutics and shell execute. We also saw some types heavily strings and containers but in this case it was fairly easy to identify that this is standard template library classes. Over here for instance, we can see find the strings in the binary and this is the on the right hand side we can see source code from the header files. So basically they are using strings and vectors from the standard library which made the analysis significantly easier because we know exactly what kind of types are used and there is no need to reverse them from scratch. Okay, so now let's move on to the third part of this presentation and speak about how can we automate some tasks of reversing C++ applications, C++ malware. We'll be speaking about a tool which is a plugin for the X-rays decompiler. This is an open source tool which was first presented at ARICON 2013. It was inspired on the work on the Gabs Bootkit when we were dealing with the position independent code and this is the first time when we can save this tool but later we decided there's some functionality which was suitable for working with the position independent code. Actually it may be applied to the object-oriented reversing. So before we speak about functionality we need to introduce some basic things about X-rays or SDK, how it works. So because this is the plugin for the X-rays SDK and to represent decompiler function X-rays uses a special tree structure which is called C3. Basically this is a syntax tree structure which consists of objects which is of nodes which are called C item T. There are nine maturity levels because this structure is generated using several iterations and you can actually hook at any level but we are using maturity level final when this structure is ready to use. And on this slide we can just see how for instance these expressions, this expression, variable three equals variable two plus variable seven is represented over here. This is the variable three and this is the operator of the assignment. So assignment here on the left hand side we have variable three over there and on the right hand side of the assignment we have node add with the variable two and variable seven. This is the underline structure. And these are nodes, the item maybe of two types, expression or statement. The statement is there maybe block which is here in the curl brackets or if for while. Expressions is everything what has type. You can do whatever you want with the C tree structure but you have to make sure that the type information is consistent as shown here. Like if you're just doing assigning to integer you have to assign similar type. Well in this case it's the word but that's okay because it's the word and integer, the year have the same properties here and the word is obtained as a result of the call to this routine and this is the signature of this routine so it returns the word and takes two parameters, the word and byte, we can see the word here and the other parameter is third, is just here, it's not on the screenshot. So you can do any manipulations with this node and you have to make sure that the type information is consistent. Why we have chosen HexRace decompiler because this is assembler independent. HexRace supports x86, x64, R so we don't have to care about specific compiler. You are just working with this C tree structure and a lot of work to construct it is handled automatically by HexRace so we are just using this C tree representation to work with this and it offers also some classes to do traversal like C tree and C tree per entity. There should be some demonstration but I think I'm gonna skip it because we're just running out of time and I have two presentations so I'll just spend a little more time on the second presentation because this one is more important. So how we are using this C tree and how it is useful in the reverse in object-oriented malware. We can reconstruct type using this representation so for instance on inputs we can take a pointer to the object instance and it's constructor and then on the output we can get a representation of this object as shown here for instance. To be able to reconstruct we need to pay attention to some specific nodes of the C tree. These nodes are main PTR, IDX, member reference, call PTR and assignment. For instance main PTR is a dereferencing pointer within the structured specific offset. IDX is actually using an index to address specific element in the array. MemberF is a reference to a memory and so on. So for instance we can see here over here on the left hand slide that there is a reference to this field, virtual function table and we can reconstruct this reference using this C tree representation so we are just monitoring main PTR. We are tracking this keyword and we see that at offset zero there is a dereferencing of this pointer so there is a field within this object and we can build structure this way. This is another example but we're using PTR in assignment. We can see here that we have this code over here which is this plus 212 and this is an assignment operator and we can detect that there is some field from offset 212 from the beginning of the object so we are just creating some type since we know that the type of the assignment is integer we're supposing that there is four fields four bytes at offset 212 and as a result we can reconstruct the structure like shown here automatically here which saves a lot of time in dereferencing. For instance here we have another example we have this in the decompiler output a1 plus 12 so we are just casting it to the pointer to the word then we are dereferencing the pointer and assigning some value over here and this is represented in the C structure like this and we can understand that at the offset of 12 there is some member which received this value and this is how we have this structure signature. So over the last few weeks we have been working on the special edition of the HexRace code explorer for the NorthSeq conference and in this special edition we implemented automatic virtual table identification and type reconstruction. So basically we are scanning the binary for virtual tables in it so we know where the virtual table starts, where it tends and we can create structure describing the easier virtual table and once we reconstructing objects we can create an automatically generated type here. For instance this is the type for local data storage and it has two virtual tables over here, this one and this one we automatically generate these structures for this table and show them these parts and these are the tables which are located within the binary. And there this version supports IDEPRO 64 bit as well so I have some demonstration to show you how it works in action. We will use a, okay you can see it over here. So this is a module of the hexagent. Let's go toward this routine. Yeah, I'm just trying to play something with the resolution of the screen to make sure. So this is the one and okay let's try it. Okay, I think this is better or yeah, so we're just going here. This is the routine of the hexagent module so I just committed some fields here. For instance we can go to the constructor of the agent kernel which is looks like this. This is a pointer to the instance of the object past as a parameter in the register ECX and this is how the fields are initialized. So let's reconstruct the object like this here so we need to enter name of the type. We are entering agent kernel and we have automatically reconstructed fields over here and we have created structures for virtual tables. So open sub use and go into local types here. We can go down and see this one is here and this is it. We can go down and reconstruct the other one. Channel controller, for instance. Let's go here, we can see the same constructor. We reconstructing type and entering channel controller. Again, this type is reconstructed so we are just exiting from here and we can see that this variable is then assigned to this one. So I need to cast it to the structure agent controller which we created. This is it and then go back to the channel controller and we can see that this is stored in the field here and this field. So this is type agent controller. We can rename it as the channel controller and the most important thing is we need to reconstruct it to your type as well so we are channel controller. Okay, and now when we are going this variable we can go to this method which is to register channel. This is another object which is created. So we're just gonna go here and see that this is the pointer to the agent controller which we just reconstructed. We need to cast a type, struct agent controller and see here if it is being used. Okay, I think we can see it here. Now we have this automatically reconstructed at this point and we can use this method is executed so we can just navigate into it and this is it. This is how it works because otherwise you would have this call which is your rather meaningless. You don't know what is here at this subset without reconstructing this type. Yeah, this is about the demonstration. Okay, let's go on and just to wrap up the presentation I would like to say a few words about the next plans for the project so we are just going to use, we are going to switch to IDAPython because right now the plugin has developed in C++ and when we started to work on the plugin there was no Python interface. So we did everything in C++ but why Python? Because it's interface now is more consistent. When a new version of the IDAP or IDAP SDK is released the developers sometimes change something in the interface so you have to, sometimes your code is not compilable because there are some changes in the SDK and you need to see what are the changes in the adjusted code. But with the Python this is okay because the interface is pretty much consistent and it's not changing, it is the way easier to develop. For instance this small plugin which is just printing the types of your blocks in the city structure looks very nice and very neat and very small in C++ you would have got something bigger. And some plans about further research and development so something that we would like to improve first our version works for Visual C++ compiler. It would be interesting to see if it's working on GCCR compiler samples and you're to port it to your support for GCC compiler. Another interesting thing is to find cross-references to the object attributes. For instance when you have a type and there is some field in this type which is being used in reference you wanna get the other methods which are modifying this field. And another interesting thing is to look at their code similarity based on data flow analysis. For instance to find similar code based on their patterns of the access to these structure fields. For instance sometimes existing tools here which allows you to assess how one code is similar to each other doesn't handle it very well because of their code is recompiled with different compiler options with some optimization and sometimes these optimizations they render code completely different. So in line in functions I'm meeting frame pointers makes it difficult but generally the data access patterns should persist among these transformations so this is an interesting field for the research. So for me that's it for today. Thank you for your attention. And if there are any questions I can take Zany.


Hey everybody Matt here for late in sports cars ripping 2022 Panini XR football hobby 7 box half case break number 7 pick your team We have Adam T. Lyons Adam P. Cardinals Brian K. Titans Charles N. Chiefs Chris J. Seahawks Chris S Colts Chris B Panthers Cody H. Bears Daniel D. Bills Derek T. Dolphins Edward B. Steelers Edward P. Cowboys James T. Raiders James H. Jags Jesus T. Chargers Joel Vikings and Jets John Y. Niners Jonathan Q. Patriots Jordan S. Commanders Kenny W. Texans Lauren B. Saints Martin W. Rams Matt L. Eagles Mathias S. Browns Nick M. Broncos Patrick L. Bengelsen Bucks Patrick T. Falcons Phillip M. Ravens Tara A. Giants and Tony H. Packers All right good luck everybody. Hey thanks William appreciate it it's been a good time so yeah those of you that don't know me i'm usually breaking over on the LSE baseball channel during the day and um nice to pop over here once in a while and get in some football and other sports now and then there's Sam Howell rookie to 149 Logan Hall rookie to 199 and Matthew Stafford to 249 Maine Johnson and Sarah Donald DeAndre Swift and Bills rookie patch auto to 25 James Cook nice three color rpa Grants buffalo that is 16 of 25 Nice start. Let's keep it going. I am ready for a shield Here's Andrew Booth rookie to 249 Antonio Gibson 75 and Isaiah Spiller rookie I heard it. I registered it and then that just still Kelsey and Stefan Diggs this is Colts rookie auto to 49 Jelani Woods Falcons rookie triple patch to 25 Desmond Ritter I really need to pull a shield because I know Sam's going to pull a shield tonight and right now after pulling that Jackson holiday black wave auto one-on-one from bowman draft yesterday I feel like I have a little bit of power over Sam But if I don't pull a shield today and he does tonight That power is going to vanish is Breece Hall extreme rookies gold to 10 Nice one Jets There's juju to 249 nice chiefs color match and base X Panthers Jeremy Chen case hit Alec Pierce rookie Sutton and Daniel Jones and Steelers one-on-one Rookie helmet logo auto Kenny Pickett That thing looks insane Dude that thing looks insane Congrats Steelers My friend is a Steelers fan is going to go nuts when I send him that That was Edward B Yeah, we said shield one-on-one picket not helmet this shield it shields his it shields his head It's the shield.  Congrats Steelers We're gonna mag that one Let's follow it up with an Eagles one-on-one Davontes Smith Black base Back-to-back one-of-ones That is Matt L with the Eagles. Congrats Matt Mag that one too. It's Chad mama Is it mama? I don't know. I just like when you say it Chad moment in 99 and Rookie Chad mama Jordan Brooks and Zach Wilson This is Patriots rookie jumbo jersey auto to 99 Pierre Strong And Texans rookie jumbo patch to 49 John Mechie I'm gonna send this over to Lane right now So he can host it that way people can jump into the feed if they want That is extreme rookies to 149 Kenny Pickett jersey number 8 of 149, right? Yeah, yeah If you're asking if he's number 8, the answer is yes Jeremy Rucker rookie 75 and Alec Pierce rookie to 199 It's Carson Strong It's Sean Watson and Kirk Cousins and Steelers rookie jumbo patch auto to 15 Kenny Pickett Edward B Not a bad break for you. Yeah, you did all right Congrats Carson Wentz to 199 Kenneth Walker rookie to 249 Yonte Ingram rookie It's more than one It's Tyreek and Buddha Baker Dolphins rookie auto to 199 Channing Tyndall Commanders rookie jersey to 75 Sam Howell I don't stand to I like symmetry Son Haskins rookie to 49 Jermaine Johnson rookie to 199 Jeremy Rucker rookie Watson and Cousins This is Lions rookie auto to 99 Aidan Hutchinson You go Detroit And Ravens dual jerseys to 49 lamb jack and mark andrews We're on number seven right now. Number eight just has a Ravens and bucks left This is Trevon Walker rookie to 99 extreme rookies insert Yandre Swift 249 and cam makers 75 of 75 just chrysalov a rookie AJ and cam makers This is Texans rookie jumbo patch auto to 75 John Mechie Nice number patch three colors is Malik Willis rookie to 99 Iceman Titans Hunter Henry to 249 And Khalil Shakir Christian McCaffrey and Nico Collins. This is Texans rookie auto to 199 Derek Stingley Bill's rookie triple relic to 49 James Cook two jerseys in a patch nice blue color match That's one of the bluest cards I've ever seen Is that middle patches blue? It would be overkill wouldn't it? Yeah That is rookies extreme rookies Rookie insert to 149 Bailey Zappie easy for me to say there's Arnold E rookie to 49 And pierce strong rookie to 199 Malik Willis rookie Mooney and Mahomes This is Titans rookie patch auto 12 of 15 treylon berks Titans have done so well in these breaks today Here you go two to go in number eight. Let's get that filled up Actually never mind. We're sold out uh number nine Has ravens and bucks two to go on that one That is Devonte Adams to 49 Jerome Ford rookie to 49 And Bailey Zappie rookie Jones and Brooks Texans rookie auto to 99 John Mechie Packers that's rookie patch to 49 Christian Watson. That is a mod sauce gardener Rookie expose to 99 Joe burrow color match orange to 99 And Greg Dolchich Dolkich I mean it's Dolchich to 249 Majae Sanders Zach Wilson Travis etn And Titans rookie patch auto to 35 treylon berks. Nice color match there I have pulled a ton of treylon berks rpa's today. Hey, what's up Riley? It's going awesome. How are you doing? That is a Yeah, Berks and Mechie have been all over this today. That is rookie expose eight to 99 Matt Corral Yeah, me too That is Charleston Rambo rookie to 249 And Kennedy Brooks and gold rookie 10 It's Jordan Davis rookie lands land jack And saints rookie triple jersey auto to 99 chrysalave last pack. Let's finish strong Number eight is sold out. Number nine just had ravens and bucks last I checked Yep, still ravens and bucks number 10 Has cardinals ravens texans giants and bucks Mr. Vonte Williams to 99 Bronco color match and uh, joe mixon to 199 It was jones jr Now the um one on the left is number two 15 one on the right the one of one It's williams and prescott Browns that is rookie auto to 99 david bell And falcons that's rookie jersey to 75 drake london. All right, you mean just a minute. We'll do a hit recap Appreciate you all filling up that break. Yeah, we'll start off with The stack we have falcons jersey rookie jersey to 75 drake london Packers rookie patch 49 christian watson bills rookie triple relic 49 james cook That's ravens dual jerseys to 49 land jack mark andrews Commanders rookie jersey to 75 sam howell that's um texans rookie jumbo patch 49 john mechie Falcons rookie triple patch to 25 desmond ridder autos we had saints rookie triple jersey auto to 99 chrysalave Browns rookie auto david bell Titans rookie patch auto to 35 trailon berks Uh titans rookie auto to 99 john mechie is dolphins rookie auto to 199 channing tendall Titans rookie patch auto to 15 trailon berks Texans rookie auto to 199 derrick stingley Texans rookie jumbo patch auto to 20 or i'm sorry the 75 john mechie It's lions rookie auto to 99 adan hutchinson Patriots rookie jumbo jersey auto to 99 pierre strong Colts rookie auto to 49 gelani woods We had one of one davante smith that was eagles and uh bill's rookie patch auto to 25 james cook And then steelers we had kenny pickett rookie patch auto 12 of 15 And kenny pickett rookie helmet team logo Auto one of one rookie helmet logo auto one of one That will do it for the break. Thank you everybody. Appreciate it. Number eight is coming up next


Hi. Yeah, it's good to be back. Nowadays, virtual private network becomes more and more prevalent. For enterprise, SSL VPN is the most convenient way for their employees to connect the cooperation network. For hackers, it's also the shortest path to compromise your intranet. So today, let's take a look at how your SSL VPN could be wrong. Oh, before that, is there any NSA here? Okay, sorry for the title. Hi, I'm Orange. We are from Devcore Research Team in Taiwan. And now we're a zero day researcher and focusing on web and application security. Apart from that, I'm also a speaker, CTF player, and a bug bounty hunter. Hello everyone, I'm Mei Zhang. I'm a security researcher from Devcore. And I play CTF in Hiccown and 217 CTF team. I mainly focus on binary exploitation. Here is the highlight today. We will discuss pre-orth-remocal execution on both Fortinet and Pro-Secure SSL VPN. In the Fortinet case, we will show you the hard core, the reliable binary exploitation with the magic string to open the door. In the Pro-Secure, we will present the out-of-box web hacking and how we bypass the two, uh, bypass the two factor authentication on Twitter and hack into their most important server. Last but not least, we will introduce how we leverage a hidden feature to take over not only your SSL VPN, but also all of your clients. And this is the agenda. We first introduce the SSL VPN and why we focus on that. Most of the SSL VPN don't provide a shell. We will elaborate how we jailbreak the appliance and introduce the attack vectors to discover bugs. Of course, we will have case studies and demonstration. And the last is the SSL VPN weaponization and recommendations. So, what is SSL VPN? Compared to the side to side VPN such as the IPsec or PPP, SSL VPN is more of use and compatible with any network environments. All you need is just a browser. Because of the convenience, SSL VPN becomes the most popular remote access way for enterprise. SSL VPN are everywhere and protect cooperation access from internet exposure. They are trust to be secure and consider as the only way to your private network.  They will become your virtual public network. Yes, public. So that's why we focus on SSL VPN. They are important, but a blind spot. They are widely used by corporations of all size, but only few vendor dominate the market. According to our survey on Fortune 500, the top three SSL VPN vendors dominate about 75% market share. So if you find a high impact vulnerability on one of the leading SSL VPN, you can hack the planet. The most important is SSL VPN must be exposed to outside. So it must have direct internet access. Due to its importance, even an SA is hunting for SSL VPN bugs, such as the Equation Group leaks. SSL VPN is charged by large corporations, industry leaders, and tech giants, such as the Facebook, Twitter, and Marvel. Yeah, the logo is very cool. Even an SA uses the SSL VPN. They are everywhere, and they are everywhere but usually forgotten. Sometimes even hacker knows your SSL VPN more. For example, we discussed a previous remote execution on Palo Alto SSL VPN one month ago. We find a bug accidentally. However, while reproducing on the latest version, we failed. So we start to doubt if this is a known vulnerability. We search all over the internet but could not find anything related. There's no CVE, advisory, or any official announcement. Therefore, we believe this is a silent fix one day. We surveyed all over the world and find Uber suffered from this. So we report to their bug bounty program. This is not a fault on Uber. They are also the victim. We also report this to the Palo Alto P-3rd, but we got a following reply. They do not CVE items find internally. So that's the reason why there is no official advisory. Okay, this is fine. There is no CVE, so there is no vulnerability. Anyway, Palo Alto still assign a CVE for that. Just right after we publish all the story. Once we decide to research into SSL VPN, the next question is how to choose the targets. We did a little survey on leading SSL VPN. As you can see, even in the high civility label CVE, the Perl Secure and Fortinet are still the most secure one. We want to challenge you the mission impossible. So we put our priority on Perl Secure and Fortinet more. Perl Secure is the most famous VPN solution in the world and has the latest high label CVE. It's trusted by large corporations, service providers, and government departments. Fortinet is more used by end users, medium sized enterprise. It's common in Asia and Europe. Both vendors have little high label CVEs, so our mission is to find the most remote execution on them. So let's start hacking. To kick-start new research is always not easy. SSL VPN is a black box and closing source appliance. They usually build their own architecture stack from scratch and don't provide a shell to dive into. So the jail break is the essential step for researchers to turn the black box into the gray box. As you can see, most of the SSL VPN only provide a restricted shell. So let's talk about how to jail break then. We are not hardware guys, so we start researching from the virtual appliance. All the virtual appliance can be classified into the typical one and the encrypted one. It's trivial for typical one, so we don't pay a lot of time here. You can just enter the single user mode or mount the virtual disk on your box to modify the file since turn to get a shell. But what if the disk has been encrypted? Without the booting process, we cannot see anything. So today we will show you a trick to bypass the encryption. Here is the linear booting process. The common way in the past to break the encryption is to analyze or reverse the VM linear kernel to get the encryption key. However, we focus on another stage. Here we give an example to show how memory forensics takes us to the wing. As we know the booting process, it starts from the BIOS, the loader, and the kernel to drop the first process to initialize the operating system. In Procure, the initial process shows you a prompt. Press enter to view or update your appliance settings. And once we press the enter, the initial process spawns another process to allow you modify and view the settings. So we suspend the virtual machine at this time and scan the entire memory to do the memory forensics on the host OS. From the memory forensics, we observe that the spawned process is a Perl script, the name is dsconfig.pl. And since it can be the weak point of hold the booting process, so it's time to show the magic. We will just patch a few bytes to pop out the shell. We patch the memory and replace the dsconfig.pl to the bing.sh. Once the modification is done, the only thing we need is just press the enter. And we got the shell. Now, thank you. So now we have the full control of the system and can do further debugging and analyzing. Okay, so now we can start hacking SSO VPNs. But where's the bug? There are many demons running on the server. They're usually complicated and hard to analyze. Digging at the correct place is important for us. So we propose some attack vectors specific for SSO VPNs. We'll talk about a special feature called WebVPN. It's powerful but also vulnerable sometimes. We got lots of bounty from this feature. It's like our slot machine. The next one is the native script language extensions on SSO VPNs and how they can be dangerous. And we also introduce some multi-layered architectural problems. WebVPN is a convenient proxy feature. It's portable and clientless. It proxies all kinds of traffic through the web browser. It's supports various protocols like HTTP, FTP and RDP. It also handles many web resources such as WebSocket, JavaScript and Flash. We don't need to install any software. Only click on the browser and we can connect to other services. Sounds powerful, right? Apparently it's not easy to implement this feature. Some vendors choose to implement by themselves. However, protocols and web resources handling are prone to memory bugs. Think about SSO VPN processing SMB or Flash. You know how hard it could be. Also, this requires high security awareness. For example, we found some debug functions and sensitive data without encryption and information exposed carelessly. Some vendors decided not to reinvent the wheel. They modified from an open source project directly. But they copied the code and also copied the box. This kind of software are hard to maintain, update or patch. Or some vendors choose to co-existing libraries. But the vendors are often neglect to update these libraries. We found Live Curl and Live XML from over 10 years ago. Implementing WebVPN is really not easy. This is the most serious attack vector we found under SSO VPNs. During our research, we found that most SSO VPNs have their own native script language extensions. Like PHP extensions returning C or Pro extensions returning C++. Vendors like to use these extensions to do encoding, decoding or other operations to improve efficiency. Which may be vulnerable. And it's really prone to type confusion between different languages. As we know, string operation is always difficult for C. Like buffer size calculation, dangerous functions such as string copy or misunderstood functions. For example, do you really know how the return value of SM print F should be? Can it exceed the buffer size? Actually it's possible. So calculation like this will cause an integer overflow. The type of these extensions are also confusing. Although it seems the same. But do you really know what type it is? Do you know if you are using it safely? Who knows? And this may cause serious problems. The last one is the multilayer architecture problems. When there are different standards for processing the same thing, the inconsistency between them will lead to problems. Such as the attack surface on reverse proxy and Java web back end. The talk from Orange in DEF CON last year. And here we gave another case. This is also an SS control bypass. It's on C web server and RESTful back end. The regular expression dot plus matches too much. So we can leverage this to match the dot dot slash to assess the privileged pages. Okay, so here is the special attack vectors we found on the SSO VPNs. Following, we are going to talk about two case studies. We will show how we get the pre-orced remote code execution on Frosigate and Post Secure. Here is the disclaimer. All the CVS mentioned below have been reported and patched by Frosignet, Post Secure and Twitter. So please go update your SSO VPNs as soon as possible. The case one is Frosigate. We first show break the Frosigate and look into the binaries. We try to list the binaries in slash bin and we found there are all symbolic links point to the slash bin in need just like this snapshot. Frosigate compiles all the programs and configurations into one single binary. This makes the in need program really huge and annoying. The IDV file of in need is up to 500 megabytes with 85,000 functions and they are all stripped, no single. It contains plenty of function tables to manage each program, including the WebDemon. Throughout the investigation, we found the web service is modified from a patch, but it's a patch from 2002. So the web server running on your SSO VPN is actually as old as your grandmother. Compared to the admin page, the user login interface is the only one that definitely exposed to the internet. It looks like this. A simple login page, no other buttons or functions. So we're gonna exploit through this interface without authentication. We will talk about three bugs today. First is the pre-auth removal execution chain. We combine two bugs. A pre-auth arbitrary file reading to log in and a post of heap overflow to get a shell. We also introduce an interesting bug, the magic backdoor, which can modify any user's password with a magic key. Let's start with the file reading part. It was a function used to show corresponding language for users. It concatenates strings directly without a dot dot slash filter, but adjacent extension appended automatically. So it seems like we can only read adjacent files. Think about it. Can we remove the adjacent and read any file we want? The answer is yes. We can utilize the feature of S1 print F. According to the main page, it writes at most size minus one. The buffer size is fixed here so we only need to make it exceed the buffer size, like this. We fill it up with slashes. So the path after S1 print F becomes like this. The pending JSON exceeds the buffer size and is stripped by the S1 print F. Then we can read however we want. After getting our virtual file reading, we found something interesting. We call it an SSL VPN mystery. It appears in many products, not only for the gate, but for secure or other vendors. The mystery is they hold an excessively detailed session file on the SSL VPN. The file is called SSL VPN with session. What's the content? Session token? Of course. IP address? Sure. Here's a name indeed. Plantex password. Are you kidding? You should never store any Plantex password. We really wonder how this become popular. Let me guess. Maybe they learned it from Google or Facebook or Twitter. Who knows just kidding. Anyway, these Plantex passwords are really convenient. We don't need to crack password anymore and we can log in easily. Today we're going to utilize the WebVPN feature. As you can see, it supports many protocols. Let's try the HTTP. We only need to type URL and we can connect to the website through WebVPN. And we look at the URL. We can see that we're still connecting to the SSL VPN. So it practices the whole website for us. And if we look into the elements, we can find the URL of resources are also from SSL VPN. It rewrites all the URLs for us. As you can imagine, this involves in heavy string operation. So here is the heap overflow. It occurs in JavaScript parsing and it's simply because they could flinch check while memory copy. The buffer is only 0x2000 but the input string is unlimited. Generally, we do some heap feng shui to overflow a nice target and control the program counter and do code execution. But the situation is difficult in Fridgate. We face something destabilizing. First of all, the WebDemon handles connections with Epo, so it's a single thread process. And the main process and libraries use the same heap. It means all the memory allocations of all the operations in all the connections are the same heap. So the heap is really unstable. Moreover, there are some operations regularly triggered. They interfere the heap arrangement and it's uncontrollable. Therefore, we cannot arrange the heap allocation carefully. That would just make a mess. And there is something even more ironic. A patch implements an additional memory management. So there's no free until the connection ends. We cannot arrange the heap in a single connection. The allocator also limits our exploit. It's called Jemilock. It centralizes more objects. It calls a block of allocating memory origin and then maintains these regions in a round with a bitmap. This effectively reduces interference between small and large objects. It also limits our target options. It's hard to put small objects nearby our buffer. So we're stuck at that time and therefore we started to fuzz the server and it crashed. And we almost controlled the program counter. And yet this is why we love fuzzing. We crushed a function table pointer in an SSL structure. This structure stores information of each connection. It's used for connection handling and is an ideal target for our heap exploit. First, every new connection allocates an SSL structure. So we can trigger it easily. And its size is close to our JavaScript buffer. And therefore it can be placed nearby our buffer with a regular offset. The most important is it has some useful structure members. It contains a function table pointer called method. And this is how we triggered the crash. But we found one even better. It's a function pointer called handshake function. With this, the exploit can be much easier. We don't need a whole function table anymore. We only need a function address. All the connections are on the same heap. So we can mess up connections and overflow the SSL structure. So we send lots of normal requests and attack the server with an overflow request in the meantime. If we look into the heap, there may be several SSL structures on the heap. For example, here are three SSL structures for three connections. And the SSL structure is like this. Some basic information and the function table. And the function pointer is now pointing to an SSL function, SSL accept. Now if we trigger the JavaScript parsing. And the JavaScript buffer is allocated ahead of these SSL structures. Then we can trigger the overflow and override the SSL structure members like this. So now we fill up the SSL structure with capital A's and make the program crashes. What we need to do next is clear. We only need to forge the SSL structure with a fake function pointer like the address of system. So when the victim connection is trying to do handshake, the program executes whatever we want. Anyway, the heap is unstable. So we need to send fuzzy connections to meet the condition. The server may crash sometimes, but it's fine. Furgate has a reliable watch dog. We just need several attempts taking about one to two minutes to get a shell. So this is the whole details of how we achieve remote execution. Maybe some of you are not binary guys, so you may wonder, is there any other way to get into the server? So why not find another door to make your life easier? We found a magic backdoor in the login page. This function was originally used to update outdated password. However, they failed to authenticate. So we can simply use this secret key which is called magic to reset any user's password. Now we're going to demonstrate how we pop a root shell from the only exposed HTTP export. We put our PHP exploit on an HTTP server and this is our export. In order to control the perimeter of system, we first do a stack pivot and make our buffer become the stack. After that, we do an RLP chain to call system. And here is the reverse shell command. We use Python to build a reverse shell. And we concatenate these strings to overflow the SSL structure. Now we can start hacking. In the first panel, we open a port to receive the reverse shell. And we start a filing thread to build multiple normal connections. Then we attack the server. We first try to leak username and 10 hex password from the web session. As you can see, we found an username, main. And password, this is password for main. We can use this account to log in and make the SSL VPN proxy or PHP export. We only need to wait a few seconds. Okay, here we got the root shell. Thank you very much. The next class we talk about is Perl secure. Perl secure is the market leader of SSL VPN and was formed a diverse teacher of Juniper networks. They are a pro lover and built all the architecture stack from scratch. The architecture is old but stable and secure. And it's worth to mention, Perl secure hooks all the process by LD preload due to the due to the monitor and security consideration. We will discuss this later. Here is the vulnerabilities we find. Among them we will introduce the pre-auth arbitrary file reading and the post-auth command injection. We change these two bugs into the pre-auth remote call execution. The first bug is the pre-auth file reading. Perl secure introduce a new feature called HTML file access since version add .2. It can access the tail net SSH and remote desktop by browsers. In order to adapt the new feature, Perl secure create a new if condition to handle all static resources. Thanks to the new feature, the original strict validation has been bypassed. So, and not effect by this, all unpatched version except the end of live version are affected. Here is the payload for you to check your SSL VPN. When there is a special pass in the end of the URL, the pass validation become loose. And what can we get from this? We can get numbers used for information such as the server private key to decrypt the SSL connection. We can also get information, we can also get important configurations such as the radius and all of that password. And all users password hash and sensitive cookies which are cached in the web VPN like Google, Dropbox and iCloud. The last and the most important is the cached plain text password. Yes, plain text again. For now we get a credential so we are able to access the corporation network easily. However, our goal is to get call execution for persistent and further actions. So here we change a command injection in management in the face together. From this call fragment, it's very obvious and straightforward. If we can control the options, we can inject arbitrary command to this Perl function. And of course we can. We can control the options from the troubleshooting patch. So is that simple? No, I don't think so. In order to avoid potential vulnerabilities, Perl secure applied a lot of hardening on their products. Such as the system integrity check and the rate only files instant to protect the back door from, to protect from back doors in Chrome tab or web load. The most effective hardening is the DSSF module. It's like the safeguard to protect Perl from dangerous operations. The DSSF is the Perl module which is written in C++. The module implements its own command parser and hooks several dangerous functions, such as the since turn, open, and back stick. It also disallows numbers, bad characters, and we implement the Linux IO redirection in Perl. So due to the hardening, we cannot perform any command injection. We try several ways to bypass the hardening. Of course the first count out of my mind is the argument injection. However, the TCP dump in Perl secure is too old. So we failed because it didn't suppose several juicy features, such as the post-rotate command. While examining the since turn, we find Perl secure stole the template cache in a directory. We try to write into this directory. But we can't use standard out because it's already directed to the neural device. What we can do is only abusing the saved file argument. But it seems there is no way to generate a polygraph file in both Perl and pcap format. So it's time to dig deeper. We dive into the DSSF implementation to see is there anything we can leverage. We found a flaw in the command parser. When there's an incomplete IO redirection, the rest of the IO part will be truncated. However, also we can re-control the standard out. We still can't find any way to generate a valid Perl. So let's think out of the box. Standard out is uncontrollable. But could we write a script by a standard error? When you force the TCP dump to open an non-existent file, it will show the error, no such file or directory. From the error, it seems we can partial control the message. We try to pipe the standard error to Perl. But we still get nothing. However, when we try to use another file name, such as the print 123 with a hashtag, we try to pipe the standard error to Perl again. And the magic happens. The Perl print out the 123 without errors. So, okay, the Perl 101. Perl suppose the go to label. So the TCP dump with a column becomes a label in Perl. And we use the hashtag to comment the rest of the part. So the standard error becomes a valid Perl now. This is our final expiry. We will explain the payload one by one. The first is to make the TCP dump open an non-existent file. The file name will be part of the error message in standard error. And then we redirect the standard error into the cache directory. Here we name the file as set cookie dot tht n error dot ttc. The last is the incomplete IEL symbol. This symbol abuse the command parser to ignore the rest of the IEL redirection. Once our standard error has been written into the cache directory, we can just fetch the corresponding patch to execute our command. By training these two vulnerabilities, we can get a reliable pre-off remote call execution. We have a report of our finding to Perl secure p cert. And this is the response from them. They fix all the bugs we seen amongst. Their reaction is very quick and professional. It's a great time to work with Perl secure. They are such a really responsible vendor. After Perl secure release all the patches, we kept monitoring the internet to see the large corporations response time. Twitter is one of them. They are known for their bug bounty program and nice to hackers. However, it's not good to exploit a one day right after the patch released. So we wait 30 days for Twitter to upgrade their SSO VPN. This is the Twitter SSO VPN. It's just a simple looking patch. From the reconnaissance, we know the last time Twitter upgrade is in last December. So Twitter is likely vulnerable. We have verified the bug and got a bunch of user credentials in plain text. However, we encounter some problems while trying to pop out a shell from Twitter. Yes, the first problem is the two-fact authentication. Due to the two-fact authentication, also we can get the plain text password. We still can't do anything. So the first thing we need is to find a way to bypass that. We observe Twitter enable the roaming session. Longing session is a feature to enhance the mobility. It allows a session from multiple IP locations. So once we know that, we download the database and for the session to bypass the two-factor authentication. And finally, we log into their system. The next problem is the SS control in management interface. As we mentioned before, we have a command injection here. However, for security consideration, most of the corporation disable this interface on public. So we need to find another way to access the interface. We leverage the web VPN feature again to connect to itself. It's just like the SSRF. We use the zero to bypass the SSRF protection and access the management interface. And finally, we got there. However, the last problem is that we don't find any manager's plain text password in cache. Practically, most of the manager only log into their system at the first time. The only thing we have is the password hash in sorted and if I creep and shot 256 format. So, we launch a 70 core AWS to crack the hash. And see hours later. We crack the hash and successfully log into their management interface. We are lucky because the length of the password is only 10. And the first character is capital B. It's a very early stage of our quaking queue. We exploit our command injection and try to run the command ifconfig. And we got a shell. We report all of our findings. Thank you. We report all of our findings to their bug bounty program. And got the highest bounty from Twitter. Also, we cannot prove that. It seems this is the first remote call execution on Twitter. Okay, the last is the bonus for you. Our company Devcore provides the most professional rating service in Asia. So, let's talk about how to make the rating more read. In a rating operation, the personal computer is more valuable. So, in order to take control of all the clients, we need to weaponize the SSL VPN. There are several old school methods before, such as the waterhole attack and repress the VPN installer. But here we propose a new method. It's the logon script. Logon script is the feature in almost every SSL VPN. It can ask you to corresponding script to mount the network file since turn or change the routing table. So, here we will show you a demo to show you that how we compromise all the VPN clients. Okay, this is our demonstration. As you can see, the exploit need one argument. So, we append our target right after the exploit. Here we got a username and hash of admin. Also, we could not find the plain text password. We can still change our cookie to the session ID of admin. Okay, once our modification is done, we can access the management in the fast. And we have become the admin. Thank you. Here we leverage the feature on the user roles and the VPN tunneling. We find the logon script section. Here you can see the logon script supports not only Windows but also Linus and Mac OS. So, we use the calculator as our backdoor. And once our modification is done, we change to the laptop of our victim. Yeah, it's cute. The victim launched a per-skill agent. And try to connect to the SSL VPN with his username and password. And once the connection has been established, the calculator will be popped automatically. Okay, here we finish all of our slides. But how to mitigate such attacks? Here we give several recommendations. The first is to, is the client science certificate. We saw the certificate, the malicious connection will be dropped during SSL negotiation. The next is to enable multi-factor authentication. It can decrease number of attack surface. And the last, remember to enable full log audit and subscribe to vendor's advisory to keep your system updated. This is the end of our presentation. And here is our contact information. We will, okay. Okay. We will post all the detail right after our talks. So please check that and let us know if you have any further questions. Thank you for being here again. Thanks.


In Sylvia Brown's book, End of Days, she made a startling prophecy that has chillingly come true. On page 117, the words read, In around 2020, a severe pneumonia-like illness will spread throughout the globe, attacking the lungs and the bacterial tubes and resisting all known treatments. Almost more baffling than the illness itself will be the fact that it will suddenly vanish as quickly as it arrived, attack again 10 years later, and then disappear completely. Sylvia died in 2013. Other predictions haven't been fulfilled, but these sensitive words highlights our need for answers. Of course, our faith is important during these times, but could someone really know of a coming event? Probably a lucky prediction in all probability. We say this because Sylvia predicted her own death. She predicted she would die at age 88. She was 77 in 2013, and it seems to us that she may have simply been looking at her own life.  She also struggled like a smoker as if she lived with difficulties with her lungs. On page 73 of Sylvia's book, Secrets and Mysteries of the World, she writes, After my divorce, my doctor found a tumor in my throat that was wound around my vocal cords. Since I don't smoke and have always had a husky voice, as have all the women in my family, I wasn't concerned about my throat. These things heightened her suitability to be drawn to the things that she had been credited for predicting, and it should be known that she got a lot of her predictions wrong, including telling Amanda Berry's mother she was dead in 2004. She was found alive in May 2013. Sylvia Brown died November that year of heart failure, but what do you guys think of these prophecies that has grasped the attention of the world? Comments below and as always, thank you for watching.