Hacking Articles Tips Tricks Videos Tutorials

Kam1n0 v2.x is a scalable assembly management and analysis platform. It allows a user to first index a (large) collection of binaries into different repositories and provide different analytic services such as clone search and classification. It supports multi-tenancy access and management of assembly repositories by using the concept of Application. An application instance contains its own exclusive repository and provides a specialized analytic service. Considering the versatility of reverse engineering (https://www.kitploit.com/search/label/Reverse%20Engineering) tasks, Kam1n0 v2.x server currently provides three different types of clone-search applications: Asm-Clone, Sym1n0, and Asm2Vec, and an executable classification based on Asm2Vec. New application type can be further added to the platform.
A user can create multiple application instances. An application instance can be shared among a specific group of users. The application repository read-write access and on-off status can be controlled by the application owner. Kam1n0 v2.x server can serve the applications concurrently using several shared resource pools.Kam1n0 was developed by Steven H. H. Ding (http://stevending.net/) and Miles Q. Li (http://milesqli.github.io/) under the supervision of Benjamin C. M. Fung (http://dmas.lab.mcgill.ca/fung/) of the Data Mining and Security Lab (http://dmas.lab.mcgill.ca/) at McGill University in Canada. It won the second prize at the Hex-Rays Plug-In Contest 2015 (https://hex-rays.com/contests/2015/). If you find Kam1n0 useful, please cite our paper:S. H. H. Ding, B. C. M. Fung, and P. Charland. Kam1n0: MapReduce-based Assembly Clone Search for Reverse Engineering (https://drive.google.com/file/d/0BzRSjM7kjy-rZWUtRnFXR0ZpSjg/view?usp=sharing). In Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining (SIGKDD), pages 461-470, San Francisco, CA: ACM Press, August 2016.S. H. H. Ding, B. C. M. Fung, and P. Charland. Asm2Vec: boosting static representation robustness for binary clone search against code obfuscation and compiler optimization. In Proceedings of the 40th IEEE Symposium on Security and Privacy (S&P), 18 pages, San Francisco, CA: IEEE Computer Society, May 2019.Asm-CloneAsm-Clone applications try to solve the efficient subgraph search problem (i.e. graph isomorphism problem) for assembly functions (Application Type: Asm-CloneThe original clone search service used in Kam1n0 v1.x.Currently support Meta-PC, ARM, PowerPC, and TMS320c6 (experimental).Support subgraph clone search within a certain assembly code family. + Good interpretability of the result: breaks down to subgraphs.+ Accurate for searching within the given code family.+ Good for differing various patches or versions for big binaries.- Relatively more sensitive to instruction set changes, optimizations, and obfuscation.- Need to pre-define the syntax of the assembly code language.- Need to have assembly code of the same chosen family in the repository.

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest & Hacking Tools

Leading source of security tools, hacking tools, cybersecurity and network security. Learn about new tools and updates in one place.

7 viewsedited 14:00

5 views14:00

Hacking Articles Tips Tricks Videos Tutorials

Sym1n0Semantic clone search by differentiated fuzz testing (https://www.kitploit.com/search/label/Fuzz%20Testing) and constraint solving. An efficient and scalable dynamic-static hybrid approach (Application Type: Sym1n0 (v2 only)Clone search by both symbolic execution (https://www.kitploit.com/search/label/Symbolic%20Execution) and concrete execution.Differentiate functions based on their different I/O behavior.Clone search conducted on the abstract syntax graph constructed from Vex IR (powered by LibVex). + Clone search across different assembly code families. For example, indexed x86 binaries but the query is ARM code.+ Subgraph clone search.+ Support a wide range of families throub LibVex. x86, AMD64, MIPS32, MIPS64, PowerPC32, PowerPC64, ARM32, and ARM64.+ An efficient dynamic-static hybrid approach.+ Ideal for analyzing firmware compiled for different processors.- Sensitive to heavy graph manipulation (such as a full flattening).- Sensitive to large scale breakdown of basic block integrity.

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest & Hacking Tools

Leading source of security tools, hacking tools, cybersecurity and network security. Learn about new tools and updates in one place.

6 viewsedited 14:00

Hacking Articles Tips Tricks Videos Tutorials

Asm2VecAsm2Vec leverages representation learning. It understands the lexical semantic relationship of assembly code. For example, xmm* registers are semantically related to vector operations such as addps. memcpy is similar to strcpy. The graph below shows different assembly functions compiled from the same source code of gmpz_tdiv_r_2exp in libgmp. From left to right, the assembly functions are compiled with GCC O0 option, GCC O3 option, O-LLVM obfuscator Control Flow Graph, Flattening option, and LLVM obfuscator Bogus Control Flow Graph option. Asm2Vec can statically identify them as clones.Leverage representation learning.Understand the lexical semantic relationship of assembly code. + State-of-the-art for clone search against heavy code obfuscation techniques. (>0.8 accuracy for all options applied in O-LLVM, multiple iterations).+ State-of-the-art for clone search against code optimization. (>0.8 accuracy between O0 and O3, >0.94 accuracy between O2 and O3)+ Even better result than the most recent dynamic approach.+ Much more efficient than recent dynamic approaches.+ Do not need to define the architecture. It self-learns by reading large volume of code.+ Static approach: efficient and scalable.- No subgraphs.- Assume the assembly code come from the same processor family.- Static approach: cannot recognize jump table, etc.

___________________________
@hacking_Attack
@Hacking_Video

6 viewsedited 14:00

Hacking Articles Tips Tricks Videos Tutorials

7 views14:00

Hacking Articles Tips Tricks Videos Tutorials

6 views14:00

Hacking Articles Tips Tricks Videos Tutorials

Executable ClassificationIn this application, the user defines a set of software classes which are based on functional relatedness and provides binaries belong to each class. Then the system automatically groups functions into clusters in which functions are connected directly or indirectly by clone relation. The clusters that are discriminative for the classification are kept and serve as signatures of their classes. Given a target binary, the system shows the degree it belongs to each software class.
Use Asm2Vec as its function similarity computation model+ Provide interpretable classification results.+ Learn common characteristics (i.e., function clusters) of each class.+ Able to handle smaller and imbalanced datasets than an ordinary machine learning (https://www.kitploit.com/search/label/Machine%20Learning) model.- The limitation is that the assumption that binaries in the same class share some common functions must hold for the system to work.

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest & Hacking Tools

Leading source of security tools, hacking tools, cybersecurity and network security. Learn about new tools and updates in one place.

5 viewsedited 14:00

Hacking Articles Tips Tricks Videos Tutorials

5 views14:00

About

Blog

Apps

Platform