L'évolution du décryptage du True Blue avance

Thanks to oct0xor we could get our hands on the decrypted TB payload (stage 2). Of course the first thing to do is to fire it up in IDA, our favourite tool of the trade. The entry code of the payload looks like this:

1337C0DE00000000 _start:
1337C0DE00000000
1337C0DE00000000 .set var_58, -0x58
1337C0DE00000000 .set arg_10,  0x10
1337C0DE00000000
1337C0DE00000000		 mflr	  r0
1337C0DE00000004		 bl		loc_1337C0DE00000008
1337C0DE00000008 1337C0DE00000008 loc_1337C0DE00000008:
1337C0DE00000008		 mflr	  r3
1337C0DE0000000C		 lis	   r4, 0 # 8
1337C0DE00000010		 addi	  r4, r4, 8 # 8
1337C0DE00000014		 subf.	 r3, r4, r3
1337C0DE00000018		 beq	   skip_reloc
1337C0DE0000001C		 li		r6, 0
1337C0DE00000020		 oris	  r6, r6, 0x1337
1337C0DE00000024		 ori	   r6, r6, 0xC0DE
1337C0DE00000028		 lis	   r4, 1 # 0xA848
1337C0DE0000002C		 addi	  r4, r4, -0x57B8 # 0xA848
1337C0DE00000030		 lis	   r5, 1 # 0x10D18
1337C0DE00000034		 addi	  r5, r5, 0xD18 # 0x10D18
1337C0DE00000038		 subf.	 r5, r4, r5
1337C0DE0000003C		 beq	   skip_reloc
1337C0DE00000040		 srdi.	 r5, r5, 3
1337C0DE00000044		 mtctr	 r5
1337C0DE00000048		 add	   r4, r4, r3
1337C0DE0000004C
1337C0DE0000004C reloc_loop:
1337C0DE0000004C		 ld		r5, 0(r4)
1337C0DE00000050		 srdi	  r7, r5, 32
1337C0DE00000054		 cmpw	  r7, r6
1337C0DE00000058		 bne	   skip_rewrite
1337C0DE0000005C		 clrldi	r5, r5, 32
1337C0DE00000060		 add	   r5, r5, r3
1337C0DE00000064		 std	   r5, 0(r4)
1337C0DE00000068
1337C0DE00000068 skip_rewrite:
1337C0DE00000068		 addi	  r4, r4, 8
1337C0DE0000006C		 bdnz	  reloc_loop
1337C0DE00000070
1337C0DE00000070 skip_reloc:
1337C0DE00000070		 std	   r0, arg_10(r1)
1337C0DE00000074		 stdu	  r1, -0x80(r1)
1337C0DE00000078		 std	   r2, 0x80+var_58(r1)
1337C0DE0000007C		 lis	   r4, 1 # 0x17E40
1337C0DE00000080		 addi	  r4, r4, 0x7E40 # 0x17E40
1337C0DE00000084		 add	   r2, r4, r3
1337C0DE00000088		 bl		payload_main

In the first loop it will relocate itself using 0x1337C0DE as an identifier for the upper 32 bits and rewrite that to the actual base. The disassembly above was already loaded using 0x1337C0DE00000000 as base. While scrolling through the data section at the end of the payload one quickly figures out that the RTOC is 0x1337C0DE00017E40.

As I was analyzing the code I found a sub that was basically just a really big switch with random looking case values. Once I reversed the sub at 0x1337C0DE00002578 and some of the following ones and analyzed their usage in the switch sub, I knew that I was looking at a fricking virtual machine.

1337C0DE00002578 vm_push_word_0:
1337C0DE00002578		 ld		r11, off_1337C0DE00010128 # stack_ptr
1337C0DE0000257C		 ld		r9, 0(r11)
1337C0DE00002580		 addi	  r0, r9, 4
1337C0DE00002584		 std	   r0, 0(r11)
1337C0DE00002588		 stw	   r3, 4(r9)
1337C0DE0000258C		 blr

Paranoid TB developers even used XOR-tables to obfuscate the VM instructions and data. The virtual machine is mostly stack based but the instructions let you work using registers too. The next thing to do is to reverse all the instructions and write a disassembler and emulator. Here is some code to unscramble the embeded vm binary for further investigation. I’m going to write more about this topic in the future.