<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>Casaba Security &#187; Nebulous</title>
	<atom:link href="http://www.casaba.com/blog/category/nebulous/feed/" rel="self" type="application/rss+xml" />
	<link>http://www.casaba.com/blog</link>
	<description>Building and breaking software and robots</description>
	<lastBuildDate>Wed, 11 Jan 2012 18:08:45 +0000</lastBuildDate>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.org/?v=3.3.1</generator>
		<item>
		<title>X5S V2.0&#8230;. its coming!</title>
		<link>http://www.casaba.com/blog/2011/01/x5s-v2-0-its-coming/</link>
		<comments>http://www.casaba.com/blog/2011/01/x5s-v2-0-its-coming/#comments</comments>
		<pubDate>Mon, 03 Jan 2011 16:59:22 +0000</pubDate>
		<dc:creator>John Hernandez</dc:creator>
				<category><![CDATA[Code Review]]></category>
		<category><![CDATA[Development]]></category>
		<category><![CDATA[Nebulous]]></category>
		<category><![CDATA[Security Testing]]></category>
		<category><![CDATA[Tools]]></category>
		<category><![CDATA[Unicode]]></category>

		<guid isPermaLink="false">http://www.casaba.com/blog/?p=233</guid>
		<description><![CDATA[So, It&#8217;s been awhile since we&#8217;ve done any public updates to X5S. Over the last year, I&#8217;ve improved the algorithm and process significantly. Be on the look out, it should be released within the next couple of weeks (Sometime in Jan. 11). Some of the improvements include: * Better Algorithms for doing checks * Better [...]]]></description>
			<content:encoded><![CDATA[<p>So, It&#8217;s been awhile since we&#8217;ve done any public updates to X5S. Over the last year, I&#8217;ve improved the algorithm and process significantly. Be on the look out, it should be released within the next couple of weeks (Sometime in Jan. 11).</p>
<p>Some of the improvements include:<br />
* Better Algorithms for doing checks<br />
* Better output format .. Now uses a tree view.. Going to add better support for reporting too..<br />
* Cleaner UI (Easier to use)<br />
* Re-factored the code to be cleaner/make more sense and easier to maintain. It&#8217;s much easier to understand/work with.. before was mostly prototyped code/ Alpha code.<br />
* Changed how test cases are defined for more control over the types of injects<br />
* Added a fuzzing mode that will take data from a file and inject it where canaries would normally be injected. (This can be slow with lots of injections)<br />
* Added a replay from Fiddler capture.. (Replays the capture while fuzzing/injecting on the requests). </p>
<p>* many many more minor/significant changes..  =)</p>
<p>Check back soon for a release date!</p>
]]></content:encoded>
			<wfw:commentRss>http://www.casaba.com/blog/2011/01/x5s-v2-0-its-coming/feed/</wfw:commentRss>
		<slash:comments>5</slash:comments>
		</item>
		<item>
		<title>Microsoft CCI Framework for Deobfuscating .Net binaries. (Part 3)</title>
		<link>http://www.casaba.com/blog/2010/02/microsoft-cci-framework-for-deobfuscating-net-binaries-part-3/</link>
		<comments>http://www.casaba.com/blog/2010/02/microsoft-cci-framework-for-deobfuscating-net-binaries-part-3/#comments</comments>
		<pubDate>Thu, 18 Feb 2010 18:04:51 +0000</pubDate>
		<dc:creator>John Hernandez</dc:creator>
				<category><![CDATA[Code Review]]></category>
		<category><![CDATA[Debugging]]></category>
		<category><![CDATA[Development]]></category>
		<category><![CDATA[Malware]]></category>
		<category><![CDATA[Nebulous]]></category>
		<category><![CDATA[Reverse Engineering]]></category>
		<category><![CDATA[Babel]]></category>
		<category><![CDATA[CCI]]></category>
		<category><![CDATA[Deobfuscation]]></category>
		<category><![CDATA[Microsoft]]></category>

		<guid isPermaLink="false">http://www.casabasecurity.com/blog/?p=188</guid>
		<description><![CDATA[Renaming parts of the assembly. So I promised this last week, but I&#8217;ve been busy on a new project. Below is some code that shows renaming of methods. This is a solution to renaming classes within namespaces. It iterates over each namespace renaming classes from class1 -&#62; classN. This is more useful for human readability [...]]]></description>
			<content:encoded><![CDATA[<p>Renaming parts of the assembly.</p>
<p>So I promised this last week, but I&#8217;ve been busy on a new project. Below is some code that shows renaming of methods. This is a solution to renaming classes within namespaces. It iterates over each namespace renaming classes from class1 -&gt; classN. This is more useful for human readability and tracing logic. I leave it as an exercise to the reader to figure out how to rename other parts of the assembly. But hey if you really need it an get stuck, let me know!</p>
<p>I&#8217;ll be posting a tool at some point that does all these different actions for you. Hopefully I&#8217;ll have a early release out by mid next month. I&#8217;m currently learning WPF well enough to build in visulalizations of the control flow graph. That way after a mutator is applied you can visually see the results.</p>
<p>There is a dictionary in the mutator class that uses the namespace string as a key in order to know which class # i left off at. I test on the string length &lt; 2 because the obfuscators I&#8217;ve seen that do this trick tend to just rename everything to some obscure unicode code point of length 1. Just a easy stop condition. You can use any stop condition that suits your needs.</p>

<div class="wp_codebox_msgheader"><span class="right"></span><span class="left"><a href="javascript:;" onclick="javascript:showCodeTxt('p188code2'); return false;">View Code</a> CSHARP</span><div class="codebox_clear"></div></div><div class="wp_codebox"><table><tr id="p1882"><td class="code" id="p188code2"><pre class="csharp" style="font-family:monospace;"><span style="color: #0600FF; font-weight: bold;">public</span> <span style="color: #0600FF; font-weight: bold;">override</span> NamespaceTypeDefinition Visit<span style="color: #008000;">&#40;</span>NamespaceTypeDefinition namespaceTypeDefinition<span style="color: #008000;">&#41;</span>
<span style="color: #008000;">&#123;</span>
  <span style="color: #6666cc; font-weight: bold;">string</span> key <span style="color: #008000;">=</span> namespaceTypeDefinition<span style="color: #008000;">.</span><span style="color: #0000FF;">ContainingUnitNamespace</span><span style="color: #008000;">.</span><span style="color: #0000FF;">Name</span><span style="color: #008000;">.</span><span style="color: #0000FF;">Value</span><span style="color: #008000;">;</span>
  <span style="color: #0600FF; font-weight: bold;">if</span> <span style="color: #008000;">&#40;</span><span style="color: #008000;">!</span>classDict<span style="color: #008000;">.</span><span style="color: #0000FF;">ContainsKey</span><span style="color: #008000;">&#40;</span>key<span style="color: #008000;">&#41;</span><span style="color: #008000;">&#41;</span>
  <span style="color: #008000;">&#123;</span>
     classDict<span style="color: #008000;">.</span><span style="color: #0000FF;">Add</span><span style="color: #008000;">&#40;</span>key, <span style="color: #FF0000;">0</span><span style="color: #008000;">&#41;</span><span style="color: #008000;">;</span>
  <span style="color: #008000;">&#125;</span>
  <span style="color: #0600FF; font-weight: bold;">if</span> <span style="color: #008000;">&#40;</span>namespaceTypeDefinition<span style="color: #008000;">.</span><span style="color: #0000FF;">Name</span><span style="color: #008000;">.</span><span style="color: #0000FF;">Value</span><span style="color: #008000;">.</span><span style="color: #0000FF;">Length</span> <span style="color: #008000;">&lt;</span> <span style="color: #FF0000;">2</span><span style="color: #008000;">&#41;</span>
  <span style="color: #008000;">&#123;</span>
     <span style="color: #6666cc; font-weight: bold;">int</span> i <span style="color: #008000;">=</span> classDict<span style="color: #008000;">&#91;</span>key<span style="color: #008000;">&#93;</span><span style="color: #008000;">;</span>
     namespaceTypeDefinition<span style="color: #008000;">.</span><span style="color: #0000FF;">Name</span> <span style="color: #008000;">=</span> <span style="color: #0600FF; font-weight: bold;">this</span><span style="color: #008000;">.</span><span style="color: #0000FF;">host</span><span style="color: #008000;">.</span><span style="color: #0000FF;">NameTable</span><span style="color: #008000;">.</span><span style="color: #0000FF;">GetNameFor</span><span style="color: #008000;">&#40;</span><span style="color: #6666cc; font-weight: bold;">String</span><span style="color: #008000;">.</span><span style="color: #0000FF;">Format</span><span style="color: #008000;">&#40;</span><span style="color: #666666;">&quot;Class{0}&quot;</span>, i<span style="color: #008000;">&#41;</span><span style="color: #008000;">&#41;</span><span style="color: #008000;">;</span>
     i<span style="color: #008000;">++;</span>
     classDict<span style="color: #008000;">&#91;</span>key<span style="color: #008000;">&#93;</span> <span style="color: #008000;">=</span> i<span style="color: #008000;">;</span>
  <span style="color: #008000;">&#125;</span>
  <span style="color: #0600FF; font-weight: bold;">return</span> <span style="color: #0600FF; font-weight: bold;">base</span><span style="color: #008000;">.</span><span style="color: #0000FF;">Visit</span><span style="color: #008000;">&#40;</span>namespaceTypeDefinition<span style="color: #008000;">&#41;</span><span style="color: #008000;">;</span>
<span style="color: #008000;">&#125;</span></pre></td></tr></table></div>

]]></content:encoded>
			<wfw:commentRss>http://www.casaba.com/blog/2010/02/microsoft-cci-framework-for-deobfuscating-net-binaries-part-3/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
	</channel>
</rss>

