Thursday, August 15, 2013

Reverse Engineering DLLs

A DLL is usually imported by an EXE. A DLL usually has a number of functions that the EXE can usually directly use. If you want to debug an EXE in OllyDbg, all you need to do is load it in Olly and set a breakpoint on the entry point of the Exe. If you want to debug a specific DLL though, it's not that straightforward.

There's 2 ways of doing this:

a) Open the DLL in Olly. If you also have an EXE called LoadDLL.exe in the Olly directory on your hard disk, LoadDLL.exe will automatically pick up the DLL you want to analyze, load it and stop at the entry point for the DLL. This though seems to work only for Olly 1.10.

b) The other way of doing this is to tell Olly to break each time a new DLL is loaded. You can do this by going to Olly's (2.01) Options - Debugging - Events and tick the box which says 'Pause on New DLL' and OK your way out.

The next time you load an Exe which in turn loads up DLLs at runtime, Olly will break each time a new DLL is loaded. So you can keep hitting F9 (Run program) until you reach the DLL you want to debug.

Now you can debug the DLL as you would debug an EXE :)

Thursday, August 8, 2013

My first ever Defcon

Defcon was something that I'd heard about for a long long time and I was pretty excited to finally be able to attend it. Matthew and me landed in Las Vegas at about midnight on the 31st and took a cab to the Rio.

The first thing that struck me..as I looked through the cab windows was how bright everything was. I'd always read about Vegas and its colourful night life but seeing it firsthand was..something else. If you think Times Square at New York is bright..then you should definitely come to Vegas at least once in your lifetime :)

Rio's very close to the airport and the roads were quite empty at that time, so it wasn't long before we arrived at the hotel. I pinged David who'd kindly stayed awake so I could get in to the room without any trouble. We talked a bit..after which I unpacked and headed off to search for some food at 1:00am. Sadly, there weren't any all veg places inside the Rio; for that matter...there was exactly one hotel open at that hour - The American Grille. The menu on the wall outside the restaurant was NOT promising. The only thing that was vegetarian was rice and fruit. That's IT. All the same I had a short discussion with the bartender which er went somewhat like this..

AD: Hey..do you guys have anything vegetarian on the menu?
Bartender: (Looks me in the eye)... Looks down...starts laughing..shakes his head in slow motion...Laughs more...
AD: (Yeah Yeah very funny). Bah.

... I ended up eating fruit and a smelly (I don't even want to think what it smelt of) plate of rice at 2:00am. Luckily I was extremely tired and dropped off very quickly.

David and me got up at around 6 and went and stood in the gigantic line for Defcon badges. We had the pleasure of speaking with a SysAdmin from France and a dude who worked in the Fraud department of a bank. We had quite a few interesting conversations about the culture in the different countries. I quite like talking about the culture in these different places...where you can just do away with all the usual 'polite social' babble and just talk. If you want to exchange names..go ahead. If not..that's fine too. I never met the guys in the line again..but enjoyed an hour with them..with zero expectations. That's probably how life is best lived...if you expect nothing. Oops..I started again ;)

The guys managing the herculean lines were incredibly efficient and we got our badges in less than half an hour. Anywhere else...that line would have taken at least a couple of hours to clear. It is amazing how every job can be done efficiently... if everyone does what they're supposed to do..the way it's supposed to be done.

I had the remaining fruit for breakfast and then attended Defcon 101..which was interesting for around half an hour. After that, the cussing and ceaseless focus on being drunk all the time started to get boring. Not that the dudes on stage cared though. They even said...' Are we boring you? Fuck off if we are'. Yep. Sounds about right :). I did just that..heh.

I spent a while roaming all around..getting my bearings of what_was_where so I wouldn't lose my way. At around 12:00 I met up with the rest of the team. It was really nice to see all of them after quite a while. That's one drawback of being in Boston...I rarely get to meet any of them. Although..thanks to those weekly calls..I do get to hear most of them at least. So we decided to eat lunch. Guess where they went. Go ahead. Guess. It was that super tasty, mouth watering American Grille. Sheesh. Needless to say..I took a pass :)

I spent the rest of the day attending a few talks..since none of the workshops were open on Thursday. Seriously..it'd be nice if they were. There would be some more stuff to do apart from attend talks which I wasn't interested in anyway. Anyway..the talks weren't too bad...although they were reasonably basic. I quite liked the Pentoo talk...maybe I'll give it a spin sometime. Maybe :)

The rest of the guys from Seattle eventually turned up at around 5:00 in the evening. It was good to meet up with Amar after quite a while...and also a lot of the other guys. Met Nora too..a long time after I first said hello about a year and a half ago..while still on contract. John I, Max C, Eby..good to fix faces to all the guys I talk to online in short.

Ian/Joe/Marcus (Dunno who...coz Ian complained Joe was getting a lot of credit :).. so I'll play safe) booked one gigantic limo/bus into which everyone piled in and roamed all around Vegas. There was one pitstop made..obviously...where a few of the guys went in and bought around 500 litres of booze of all kinds. This resulted in Tom playing a terrible game with everyone. He asked everyone to drink a peg? of whisky and eat a Hershey's kiss (chocolate) at the same time. Obviously..all the experienced dudes had no apparent trouble .. but Eby sadly suffered quite a lot and was high/in some discomfort for a while. Amar only cackled at all of it... he's an old hand at all this ;).

Eventually we reached this place called the SkyMall where there is a dome and the roof is painted to look like the blue sky. Parts of the dome are rigged to turn sprinklers on...and generate flashes of lightning and cause thunder to rumble. For a good 15 minutes .. I had no clue we were inside the mall..that's how well it was designed. This was definitely one of the most unique places I had ever seen.

Hopped in and met up with Max.V (who was my first ever project lead while I was on contract) and Jon Boyd...good to see him too..after working quite a bit with him. Had a few really good discussions with Marcus on reversing...and later Dinis popped in as well...for a while. Morgan very kindly helped me out with my salads for the night...he always looks out for my food when I'm around, which is really nice of him. Talked quite a while with Tyson and Amar too..outside the hotel....good to speak to Tyson too...after the infamous "experience" in Connecticut ;).

During dinner...there were some er disturbing parts for me...maybe this discussion will throw more light on it.

AD: Reversing blah blah
Marcus/Jon.B/Matthew/whoever: yeah yeah
Waiter: White roasted chicken...who wants
All: yeah yeah we want
Waiter: chop chop chop
AD: ugh
AD: so ..blah blah blah
All: blah blah...
Waiter: Red steak
All: yeah yeah
Waiter: chop chop chop
AD: (oh fuck off)

Repeat a million times... :D

Just when it was all finishing..Dinis turned up...and the whole saga repeated itself just as I was finally hoping it'd ended. Thanks Dinis for coming late :D

ah well.. it was a steak house really..so for me to expect Indian vegetarian delicacies was a little er.. unrealistic ;) .. but the meat chopping exhibition was not a lot of fun..frankly. I've got a very thick skin...but this was a bit too much even for me. The rest of the dinner though..thanks to all the guys was a lot of fun and I enjoyed speaking with all of them.

Tyson and me lost our way in the mall and had to run a lot..one way and then the other until we finally found the limo again..and got dropped at the Rio. A lot of the guys went off for booze session 2 at a Microsoft Party. David, Garrett and me went off to the room though and slept off..after discussing some deep stuff for a while. I just can't shut up..you know :). I must add here that Amar's plans for reducing his liver's age by another month were dashed by the security guards at the Microsoft party }:)

Day 2 started with a bunch of us having some breakfast at Starbucks and then splitting up to get to different talks. I attended the quite awesome CDMA interception talk where a bunch of complex demos worked flawlessly. It just proves once more...that if you work hard enough and have a clear thought process... the hardest thing is easily doable. Big props to Tom Ritter and the guys at Isec for pulling that talk off.

Lunch on Day 2 was downright awful as the food in the fridge had frozen up and I didn't have a microwave to defrost it. Somehow though I ate it up :D. I spent quite a while in the Tamper village learning to break seals open. The simplest one was using Acetone to peel labels off carefully without being detected. I tried to break open quite a few other seals using these things called shims (pieces of Coke cans :)) but was a miserable failure at all of it. Oh well. I'll learn.

I spent the latter part of Day 2 in the hardware village and soldered my first ever piece of hardware. That gave me a huge kick and I was very very happy that I did something new. The feeling of achievement is a unique thing...it never gets old. I was too late to join the rest of the guys for dinner. Not that I'd have eaten anything anyway ;). Some more rice and chips for dinner, a little TV, a little Kindle reading..some more discussions with the guys on tons of things that I cannot remember .. I hit the hay. Seriously...I was in Vegas..and instead of ogling at babes in strip clubs...I read the Kindle? Yes Yes.. much better :)

Day 3 on Saturday...David, Garrett and me went off to Palms for breakfast... where they actually let me eat my own food..interestingly. That wouldn't have been allowed in India. Those pancakes looked delicious...but sadly I couldn't eat any of it..coz of my rules. I spent a good 5.5 hours doing a surface mount at the hardware village. The end result was a weakly blinking LED which was utterly useless. All the same..it blinked...and it was the result of a lot of painful work. So Im happy.

The other good thing was that I discussed a ton of things with a ton of people whose names I don't know and I probably will never ever meet..but all of whom helped me a lot. I prefer it this way without all of that artificial societal crap that everyone deludes themselves into thinking is 'necessary'... life long. Also... I managed to skip a meal. Yay. One less meal at some terrible hotel.

I think I saw Amber's talk on suicides where she talked a bit about Aaron Swartz and on how to detect the signs of suicide. I thought it was a really great talk..and I hope to learn a little bit more about it going forward.

Met up with Amar and Nipun and talked a bit. Met people I never thought I'd see again. The world is a super small place. Spent quite some time playing the fool along with Zak. If you're reading this Zak...I hope you realize that you've scarred me mentally lifelong by bullying and harassing me that evening and showing interest in a lot of extremely 'delicate' rest room related issues. I hope you reflect deeply and do some soul-searching. :)

We all walked down to Palms where I found out that I had to spend 25$ and buy the sea-food buffet and then eat just a salad. That made no financial sense whatsoever so I came back and ate more rice and chips. Spent some time watching some people selling houses to people on TV. I quite enjoy that show. David got back at around 10 in the night following which we talked about a lot of things (Ayn Rand included (finally :))) for a couple of hours. Garrett was painting the town red that day and didn't get in till 5:30am  or something. I think this was the night of the famous pool party which I too attended and had a blast. Oh wait ;)

I attended Dinis's highly energetic talk on Sunday morning and met up with him as well. It was cool to see him and talk a bit. Unfortunately, he was surrounded by too many people so I couldn't talk too much with him..maybe some other time. That apart Sunday was pretty uneventful...and I kept hanging around here and there until the Defcon closing conference.

The Defcon closing showed me a side of America that I hadn't seen. There were a lot of guys who were moving on from the Defcon management team..after a ton of years of loyal service. Jeff Moss gave a number of extremely genuine tributes to all the guys moving on. The thing that touched me a lot though..was the obviously genuine affection that the rest of the team had for these people. There wasn't a bit of that ..that was fake or made up by anyone. And these are all big bad hackers...who do not have feelings and supposed to be extreme egotists who give a damn about anyone. For them to come out, express themselves and talk so well... that for me was pretty cool. It also showed me that... people.. deep down... are all the same. You just have to look beneath the surface..and not go with your instincts.

I spent a lazy evening with Amar and Eby on the Vegas strip after which I headed back to the hotel and then flew back to Boston the next morning with Matthew.

Considering the size of the event...and the complexity of it all...and having to manage a group of people who call bullshit out better than most other professions...and doing it so well...Defcon for me was an absolute hit. Sure there's little cribs...but overall...big big respect to all those who made that happen.

Hopefully... I'll be back for Defcon 22.