KR102436522B1 - Protocol message format reversing apparatus and method thereof - Google Patents

Abstract

The present invention relates to a protocol message format reversing apparatus and method for analyzing meaningful information only with raw data such as messages or files for confidential information such as malicious programs or protocols exchanged between C&C, and the method, is, when a seed having a size of N bits is input, a bit flip fuzzing module that generates N modified input values by sequentially converting an input seed having a size of N bits by 1 bit; The N modified input values generated from the bit-flip fuzzing module and the seed having the N-bit size are received, respectively, and the API called by the executed program is recorded in chronological order, and N API sequences and one API sequence are output. API logging module; and a protocol analysis module that compares each of N API sequences and one API sequence output from the API logging module, and analyzes and outputs a message format of an input seed.

Description

Protocol message format reversing apparatus and method thereof

The present invention relates to a protocol message format reversing apparatus and method, and in particular, a protocol that enables the analysis of meaningful information only with raw data such as messages or files for confidential information such as malicious programs or protocols exchanged between C&C. A message format reversing apparatus and method are provided.

In general, protocol message format reversing according to the prior art can be performed through taint analysis, which analyzes which registers an input value passes through while a program is executed, and analyzes the influence of an input value on execution. .

In addition, the prior art is a method of finding out a field related to a length, a field indicating a boundary of values, a keyword field determined to a specific value, a data field, and the like from among protocol message formats.

Corresponding fields can be analyzed with a heuristic algorithm based on a generally developed pattern.

For example, the code that reads the input value has a method of checking whether the size has been read using a loop statement. With this in mind, when analyzing the program, if there is a loop statement and the operation to check whether the value of the variable that is continuously increasing is the same as the user input value is repeated, the user input value at this time is recognized as a field related to the length.

The field indicating the boundary is also recognized as a field indicating the boundary of the value by checking whether there is the same operation for comparison with a newline character or a comma.

Such a prior art has a problem in that it takes a lot of time because it analyzes a program in units of instructions.

In addition, it takes a lot of time because it takes a white box analysis method that closely analyzes the execution of the program, and there is a problem in that it is virtually impossible to analyze a large size program.

Therefore, the present invention is to solve the above problems, and an object of the present invention is to use a fuzzing technique, which is a software security test technique, to modify an input value normally executed by a program to find a technique for finding errors in the program. is in providing. That is, the present invention executes the input value generated by fuzzing, performs program analysis at the API level, compares the API sequence when the normal input value is executed and the API sequence when the modified input value is executed, An object of the present invention is to provide an apparatus for reversing a protocol message and a method therefor to check a protocol message format by analyzing the meaning of one bit.

The protocol message format reversing apparatus according to the present invention for achieving the above object, when a file format seed having an N-bit size is input, sequentially converts the input N-bit seed size by 1 bit to N a bit-flip fuzzing module for generating modified input values; The N modified input values generated from the bit-flip fuzzing module and the seed having the N-bit size are received, respectively, and the API called by the executed program is recorded in chronological order, and N API sequences and one API sequence are output. API logging module; and a protocol analysis module that compares each of N API sequences and one API sequence output from the API logging module, and analyzes and outputs the message format of the input seed.

The bit flip fuzzing module may generate a total of N transformed input values by flipping the N-bit seed input by using a fuzzing technique by only one bit from the first bit to the N-th bit, respectively.

The API logging module may analyze the program using the PIN Tool.

The API logging module may record the name, parameter, return value, and return address information of the executed API, and log the Heap Allocation-related API.

The API logging module may log the createfile and readfile functions to determine when the program reads the input, execute the one modified input value, and record the called APIs in chronological order to create an API sequence.

The protocol analysis module analyzes the meaning of the modified bit when the API sequence for the seed and N modified input values are executed to analyze whether the modified bit is the same sequence, and the API name, parameter, and return value of the two sequences After comparing whether they are the same, if they are not identical, the field identification and use of the identified field can be analyzed according to the API name, parameter, and return value of the modified API sequence.

Field identification in the protocol analysis module can be identified as one field when two adjacent bits have the same API sequence after determining whether they have the same API sequence.

The field means a bit range recognized as one semantic in the program.

When the field identification is completed, the protocol analysis module may compare the API sequence of the seed input value with the API sequence of the modified input value for each identified field, and analyze the use of the corresponding field according to the comparison result.

The protocol analysis module recognizes a field having a length less than 10% of the API sequence length of the seed input value as a field related to program setting, and a field having a length of 10% or more of the API sequence length of the seed input value is It can be recognized as a field related to data recognized by the program.

On the other hand, in the protocol message format reversing method according to the present invention, when a file format seed having an N-bit size is input in the bit-flip fuzzing module, the N-bit size seed is sequentially converted by 1 bit. generating N transformed input values; In the API logging module, the N modified input values generated from the bit flip fuzzing module and the N number of API sequences and the 1 outputting API sequences; and comparing, in the protocol analysis module, each of N API sequences and one API sequence output from the API logging module, and analyzing and outputting the message format of the input seed.

The generating of the N transformed input values generates a total of N transformed input values by flipping only one bit each from the 1st bit to the Nth bit of the N-bit seed input using a fuzzing technique. can do.

In the step of outputting the sequence, the program may be analyzed using a PIN Tool.

In the step of outputting the sequence, the name, parameter, return value, and return address information of the executed API may be recorded, and the Heap Allocation-related API may be logged.

The step of outputting the sequence may include logging the createfile and readfile functions to determine when the program reads the input, and executing the one modified input value to record the called APIs in chronological order to create an API sequence. .

The step of analyzing and outputting the format includes analyzing the meaning of the modified bit when the API sequence for the seed and N modified input values are executed to analyze whether the modified bit is the same sequence, the API name of the two sequences, After comparing whether the parameters and return values are the same, if they are not the same, the field identification and use of the identified field can be analyzed according to the API name, parameter, and return value of the modified API sequence.

Field identification in the step of analyzing and outputting the format may be performed as one field when two adjacent bits have the same API sequence after determining whether they have the same API sequence.

The field means a bit range recognized as one semantic in the program.

The field usage identification in the step of analyzing and outputting the format is performed by comparing the API sequence of the seed input value with the API sequence of the modified input value for each identified field when the field identification is completed, and the corresponding field according to the comparison result use can be analyzed.

In the step of analyzing and outputting the format, the field usage identification is that a field having a length less than 10% of the API sequence length of the seed input value is recognized as a field related to program setting, and the API sequence length of the seed input value A field having a length of 10% or more of ' can be recognized as a field related to data recognized by the program.

According to the present invention as described above, the existing protocol message format reversing method requires a lot of memory and time to perform taint analysis and white box analysis in units of commands, so the limitation of analyzing only a small program is improved. The present invention changes the paradigm in a way that the input value is changed through the fuzzing technique, and the program analyzes the result of the response of the modified input value. In addition, it is possible to reverse the message format that can be applied to a large-capacity program by improving the analysis time and requiring less memory through the analysis of logging information at the API level.

The accompanying drawings below are provided to help understanding of the present embodiment, and provide embodiments together with detailed description. However, the technical features of the present embodiment are not limited to specific drawings, and features disclosed in each drawing may be combined with each other to constitute a new embodiment.
1 is a diagram showing a block configuration of a protocol message format reversing apparatus according to the present invention.
2 is a diagram showing an operation flowchart of a protocol message format reversing method according to the present invention;

With respect to the embodiments of the present invention disclosed in the text, specific structural or functional descriptions are only exemplified for the purpose of describing the embodiments of the present invention, the embodiments of the present invention may be implemented in various forms and It should not be construed as being limited to the described embodiments.

Since the present invention can have various changes and can have various forms, specific embodiments are illustrated in the drawings and described in detail in the text. However, this is not intended to limit the present invention to the specific disclosed form, it should be understood to include all modifications, equivalents and substitutes included in the spirit and scope of the present invention.

Terms such as first, second, etc. may be used to describe various elements, but the elements should not be limited by the terms. The above terms are used only for the purpose of distinguishing one component from another. For example, without departing from the scope of the present invention, a first component may be referred to as a second component, and similarly, a second component may also be referred to as a first component.

Hereinafter, a protocol message format reversing apparatus and method according to a preferred embodiment of the present invention will be described in detail with reference to the accompanying drawings.

1 is a diagram illustrating a block configuration of a protocol message reversing apparatus according to the present invention.

Referring to FIG. 1 , the apparatus for reversing a protocol message format according to the present invention may include a bit flip fuzzing module 100 , an API logging module 200 , and a protocol analysis module 300 .

The bit flip fuzzing module 100, for example, when a seed having a size of N bits input from an operator is input, by using the fuzzing technique, the input seed is sequentially converted by 1 bit to obtain a total of N modified input values. to provide N transformed input values to the API logging module 200 . Here, the seed is input in the form of a file, and for example, means a file such as PDF, image, HWP, and the like.

The API logging module 200 provides the N API sequences that the executed program calls the N input values modified from the bit flip fuzzing module 100 to the protocol minute module 300, and The seed also provides one API sequence called by the executed program to the protocol analysis module 300 , respectively.

The protocol analysis module 300 receives N API sequences and one sequence provided from the API logging module 200, and analyzes the message format of the seed by comparing N sequences and comparing one seed API sequence. Thus, the analysis result information, that is, the message format analysis result information is provided to the operator. Here, the message format analysis may be a field analysis of a message and a usage analysis of the analyzed field, and the detailed analysis operation will be described later.

A detailed operation of the protocol message format reversing apparatus according to the present invention configured as described above will be described.

First, the bit flip fuzzing module 100 flips the n-bit seed input by the operator by only one bit from the first bit to the N-th bit, so that a total of N transformed input values After generating , the generated N modified input values are provided to the API logging module 200 .

The API logging module 200 is a module for analyzing a program using the PIN Tool, and records the name, parameter, return value, and return address information of the API executed by the program.

The API logging module 200 in the present invention logs the Heap Allocation-related API frequently used in the program, and since the API has a high call frequency, the actual execution can be approximated. Also, by logging the createfile and readfile functions, you can determine when the program reads the input.

The API logging module 200 executes one modified input value and records the APIs called in chronological order to generate an API sequence.

That is, the API logging module 200 provides the N API sequences in which the executed program calls the N input values changed from the bit flip fuzzing module 100 to the protocol minutes module 300, and The seed also provides one API sequence called by the executed program to the protocol analysis module 300 , respectively.

The protocol analysis module 300 receives N API sequences and one sequence provided from the API logging module 200, and analyzes the message format of the seed by comparing N sequences and comparing one seed API sequence. Thus, the analysis result information, that is, the message format analysis result information is provided to the operator.

Specifically, the protocol analysis module 300 is a module for analyzing a protocol of a program by analyzing a relationship between several API sequences. When the seed and the modified input value are executed, the API sequence may be the same or different depending on the meaning of the modified bit.

It compares whether the API names, parameters, and return values of the two sequences are the same, and if they are different, analyzes the meaning of the changed API sequence, API name, parameters, and return values.

First, the protocol analysis module 300 identifies a field using N API sequences provided from the API logging module 200 and one API sequence for the seed, and when field identification is completed, the purpose of the identified field to analyze

First, looking at the field identification operation, in the API sequence provided from the API logging module 200, if two adjacent bits have the same API sequence, it is determined that the two bits constitute one field. In this case, the field means a bit range recognized as one semantic in the program. This is based on the fact that error handling routines for each field, such as magic number, checksum, or length information, which are representative of input values, are different.

For example, suppose that input values obtained by changing the 0xa-th bit to the 0xf-th bit have the same API sequence. If the six input values are changed through this, the same error routine is executed, so that it can be determined that they are the same field.

After the field identification is completed in this way, in the analysis of the use of the analyzed field, the API sequence of the seed input value and the API sequence of the modified input value are compared for each identified field, and the purpose of the field is analyzed.

A field having a length less than 10% of the API sequence length of the seed input value may be recognized as a field related to program setting. This is because setting fields such as magic number of the program are checked at the beginning of the program, so there is a high possibility that the program will be terminated due to an error.

Also, if the readfile API is terminated immediately after calling, the error handling code is executed in the process of checking the integrity of the input and the program is highly likely to be terminated.

On the other hand, a field having a length of 10% or more of the API sequence length of the seed input value is recognized as a field related to data recognized by the program. Because the parsing of the data to be transmitted is processed after the program execution time has elapsed, the match rate with the seed input API sequence is high.

The protocol message format reversing method according to the present invention corresponding to the operation of the protocol message format reversing apparatus according to the present invention as described above will be described in stages with reference to FIG. 2 .

2 is an operation flowchart of a protocol message format reversing method according to the present invention.

Referring to FIG. 2 , first, a seed having a size of N bits is input from an operator to the bit flip fuzzing module 100 and the API logging module 200, respectively (S201 and S202).

Then, when a seed having a size of N bits is input from the operator through the step S202, the bit flip fuzzing module 100 converts the input seed 1 bit by bit in order using the fuzzing technique to obtain a total of N transformed The input values are generated and the N changed input values are provided to the API logging module 200 (S203). Here, the seed is input in the form of a file, and means a file such as PDF, image, HWP, and the like.

That is, in step S203, the bit flip fuzzing module 100 flips the N-bit seed input by the operator by only one bit from the first bit to the N-th bit, so that a total of N After generating the transformed input values, the generated N transformed input values are provided (transmitted) to the API logging module 200 (S204).

Next, the API logging module 200 converts the N API sequences in which the executed program calls the modified N input values input from the bit flip fuzzing module 100 through the step S204 to the protocol analysis module 300 . , and the N-bit seed input through the step S201 also provides one API sequence called by the executed program to the protocol analysis module 300, respectively (S206).

That is, in step S206, the API logging module 200 is a module that analyzes a program using the PIN Tool, and records the name, parameter, return value, and return address information of the API executed by the program.

The API logging module 200 logs a heap allocation related API that is frequently used in a program, and since the API has a high frequency of calls, actual execution can be approximated. Also, by logging the createfile and readfile functions, you can determine when the program reads the input.

Meanwhile, the API logging module 200 executes one modified input value and records the APIs called in chronological order to generate an API sequence. That is, the API logging module 200 provides the N API sequences in which the executed program calls the N input values changed from the bit flip fuzzing module 100 to the protocol minutes module 300, and The seed also provides one API sequence called by the executed program to the protocol analysis module 300 , respectively.

Next, the protocol analysis module 300 receives N API sequences and one sequence provided from the API logging module 200 through the step S206, compares N sequences and compares one seed API sequence, By analyzing the message format of the seed (S207), the analysis result information, that is, the message format analysis result information is provided to the operator (S208).

Here, referring to step S207 in more detail, the protocol analysis module 300 is a module for analyzing the protocol of a program by analyzing the relationship between several API sequences. When the seed and the modified input value are executed, the API sequence may be the same or different depending on what the modified bit means.

It compares whether the API names, parameters, and return values of the two sequences are the same, and if they are different, analyzes the meaning of the API names, parameters, and return values of the changed API sequence.

First, the protocol analysis module 300 identifies a field using N API sequences provided from the API logging module 200 and one API sequence for the seed, and when field identification is completed, the purpose of the identified field is determined to analyze

First, looking at the field analysis operation, in the API sequence provided from the API logging module 200, if two adjacent bits have the same API sequence, it is determined that the two bits constitute one field. In this case, the field means a bit range recognized as one semantic in the program. This is based on the fact that error handling routines for each field, such as magic number, checksum, or length information, which are representative of input values, are different.

For example, suppose that input values obtained by changing the 0xa-th bit to the 0xf-th bit have the same API sequence. If the six input values are changed through this, the same error routine is executed, so that it can be determined that they are the same field.

In this way, after the field analysis is completed, the usage analysis of the analyzed corresponding field compares the API sequence of the seed input value with the API sequence of the modified input value for each divided field, and analyzes the use of the corresponding field.

A field having a length less than 10% of the API sequence length of the seed input value may be recognized as a field related to program setting. This is because setting fields such as magic number of the program are checked at the beginning of the program, so there is a high possibility that the program will be terminated due to an error.

Also, if it terminates immediately after calling the readfile API, the error handling code is executed in the process of checking the integrity of the input and the program is highly likely to terminate.

On the other hand, a field having a length of 10% or more of the API sequence length of the seed input value is recognized as a field related to data recognized by the program. This is because the parsing of the data to be transmitted is processed after a relatively long program execution time, so the matching rate with the seed input API sequence is high.

The protocol message format reversing apparatus and method according to the present invention as described above perform message format reversing using a fuzzing technique, which is a software security test technique, and modify the input value normally executed by the program to to find the error. And, the present invention executes the input value generated by fuzzing, performs program analysis at the API level, compares the API sequence when the normal input value is executed and the API sequence when the modified input value is executed, It is to find out the protocol message format by analyzing what one bit means.

Therefore, the present invention improves the limit of the existing protocol message format reversing method that can analyze only a small program because it requires a lot of memory and time to perform taint analysis and white box analysis in units of commands. The paradigm was changed by changing the input value through the technique and analyzing the result of the program's response to the modified input value.

In addition, the present invention improves the analysis time through the analysis of logging information at the API level and requires a small amount of memory, so that message format reversing that can be applied to a large-capacity program can be performed.

Even though all the components constituting the embodiment of the present invention described above are described as being combined or operated in combination, the present invention is not necessarily limited to this embodiment. That is, within the scope of the object of the present invention, all of the components may operate by selectively combining one or more. In addition, although all the components may be implemented as one independent hardware, some or all of the components are selectively combined to perform some or all functions combined in one or a plurality of hardware program modules It may be implemented as a computer program having In addition, such a computer program is stored in a computer readable media such as a USB memory, a CD disk, a flash memory, etc., read and executed by a computer, thereby implementing an embodiment of the present invention. The computer program recording medium may include a magnetic recording medium, an optical recording medium, a carrier wave medium, and the like.

As described above, the protocol message format reversing apparatus and method according to the present invention have been described according to embodiments, but the scope of the present invention is not limited to a specific embodiment, and those of ordinary skill in the art Various alternatives, modifications, and changes can be implemented within the range obvious to the person concerned.

Accordingly, the embodiments and the accompanying drawings described in the present invention are for explanation rather than limiting the technical spirit of the present invention, and the scope of the technical spirit of the present invention is not limited by these embodiments and the accompanying drawings. . The protection scope of the present invention should be construed by the claims, and all technical ideas within the scope equivalent thereto should be construed as being included in the scope of the present invention.

100: bit flip purging module
200 : API logging module
300: protocol analysis module

Claims (20)

A protocol message format reversing apparatus comprising:
a bit-flip fuzzing module for generating N modified input values by sequentially converting the input N-bit seed by bit by bit when a file format seed having an N-bit size is input;
The N modified input values generated from the bit-flip fuzzing module and the seed having the N-bit size are received, respectively, and the API called by the executed program is recorded in chronological order, and N API sequences and one API sequence are output. API logging module; and
Comprising a protocol analysis module that compares each of the N API sequences and one API sequence output from the API logging module, and analyzes and outputs the message format of the input seed,
The protocol analysis module,
When the API sequence for the seed and N transformed input values are executed, the meaning of the transformed bit is analyzed to analyze whether the sequence is the same, and after comparing whether the API names, parameters, and return values of the two sequences are the same, If they are not the same, the protocol message format reversing device that identifies the field and analyzes the use of the identified field according to the API name, parameter, and return value of the modified API sequence.
According to claim 1,
The bit flip purging module,
A protocol message format reversing device that generates a total of N modified input values by flipping the N-bit seed input using the fuzzing technique by only one bit each from the 1st bit to the Nth bit.
According to claim 1,
The API logging module,
A protocol message format reversing device that uses the PIN Tool to parse the program.
4. The method of claim 3,
The API logging module,
A protocol message format reversing device that records the name, parameter, return value, and return address information of the executed API, and logs the Heap Allocation-related API.
5. The method of claim 4,
The API logging module,
A protocol message format reversing device that logs the createfile and readfile functions to determine when the program reads the input, executes the one modified input value, records the APIs called in chronological order, and creates an API sequence.
According to claim 1,
The protocol analysis module,
When the API sequence for the seed and N transformed input values are executed, the meaning of the transformed bit is analyzed to analyze whether the sequence is the same, and after comparing whether the API names, parameters, and return values of the two sequences are the same, If they are not the same, the protocol message format reversing device that identifies the field and analyzes the use of the identified field according to the API name, parameter, and return value of the modified API sequence.
According to claim 1,
Field identification in the protocol analysis module,
A protocol message format reversing apparatus that determines whether two adjacent bits have the same API sequence and identifies as one field if they have the same API sequence.
8. The method of claim 7,
The field is a protocol message format reversing device that means a bit range recognized as one semantic in a program.
8. The method of claim 7,
The protocol analysis module,
When the field identification is completed, the API sequence of the seed input value and the API sequence of the modified input value are compared for each identified field, and the use of the corresponding field is analyzed according to the comparison result.
10. The method of claim 9,
The protocol analysis module,
A field having a length less than 10% of the API sequence length of the seed input value is recognized as a field related to program setting,
A protocol message format reversing apparatus in which a field having a length of 10% or more of the API sequence length of the seed input value is recognized as a field related to data recognized by the program.
A protocol message format reversing method comprising:
In the bit flip fuzzing module, when a file format seed having an N-bit size is input, generating N modified input values by sequentially converting the input N-bit seed size by 1 bit;
In the API logging module, the N modified input values generated from the bit flip fuzzing module and the N number of API sequences and the 1 outputting API sequences; and
Comprising, in the protocol analysis module, analyzing and outputting the message format of the input seed by comparing each of N API sequences and one API sequence output from the API logging module,
The step of analyzing and outputting the format is,
When the API sequence for the seed and N transformed input values are executed, the meaning of the transformed bit is analyzed to analyze whether the sequence is the same, and after comparing whether the API names, parameters, and return values of the two sequences are the same, If they are not the same, the protocol message format reversing method of identifying a field and analyzing the purpose of the identified field according to the API name, parameter, and return value of the modified API sequence.
12. The method of claim 11,
The step of generating the N transformed input values includes:
A protocol message format reversing method in which a total of N modified input values are generated by flipping an N-bit seed input using a fuzzing technique by only one bit each from the 1st bit to the Nth bit.
12. The method of claim 11,
Outputting the sequence comprises:
A method of reversing the protocol message format by using the PIN Tool to parse the program.
14. The method of claim 13,
Outputting the sequence comprises:
A protocol message format reversing method that records the name, parameter, return value, and return address information of the executed API, and logs the Heap Allocation-related API.
15. The method of claim 14,
Outputting the sequence comprises:
A protocol message format reversing method that logs the createfile and readfile functions to determine when the program reads the input, executes the one modified input value, records the APIs called in chronological order, and creates an API sequence.
delete 12. The method of claim 11,
Field identification in the step of analyzing and outputting the format is,
After determining whether two adjacent bits have the same API sequence, if they have the same API sequence, they are identified as one field.
18. The method of claim 17,
The field is a protocol message format reversing method that means a bit range recognized as one semantic in a program.
18. The method of claim 17,
Field usage identification in the step of analyzing and outputting the format is,
When the field identification is completed, the API sequence of the seed input value and the API sequence of the modified input value are compared for each identified field, and the use of the corresponding field is analyzed according to the comparison result.
20. The method of claim 19,
Field usage identification in the step of analyzing and outputting the format is,
A field having a length less than 10% of the API sequence length of the seed input value is recognized as a field related to program setting,
A method for reversing a protocol message format, wherein a field having a length of 10% or more of the API sequence length of the seed input value is recognized as a field related to data recognized by the program.

Images