DEF CON 23 - Chris Domas - Repsych: Psychological Warfare in Reverse Engineering

[@ronin6158]

This guy is next level. Alot of people are very technically strong, knowledgeable or even clever, but they are compartmentalized. He really allows ideas to recurse, cross-pollinate and doesnt stop going with them. To me that is the true definition of genius.

[@htomerif]

yeah, but you gotta ask yourself: which of these two things would deter you more: seeing a picture from your sandbox execution environment in a control flow graph, or just plain run of the mill obfuscation?

[@0xf7c8]

Since I knew Chris Domas from a video of one of his conferences, I couldn't stop watching them He is truly a genious.

[@vuurniacsquarewave5091]

You really need this kind of low-level thinking for that, because there are no constraints, you can do anything when you're close to the metal.

[@RobinObinray]

Ronin it's called being geeky without internet's hivemindness.

[@thatsweetlilthing2]

@@htomerif Why not both?

[@frosty9392]

this guy is the best. somehow rolled a 20 INT, 20 CHR, and a cyber security trait lol

[@0xbitbybit]

Epic. Taking a pic off their webcam if they had one and using that as the image in the CFG would be good too!

[@photovi]

Or their IP address 👌🏼

[@cpuexpert]

it's tremendously scarier knowing that it is pulling personal photos as opposed to your ip address which it probably already pulled

[@xponen]

they fear things like this, that's why they do stuff using virtual machine.

[@noobian3314]

@@xponen have u seen this guys other talks, he probably does know some secret instruction that can escape the hypervisor and pull in images from memory.

[@Celastrous]

​@@noobian3314Yeah for real. I imagine next version of REpsych will use SMM to control the current running to the CPU, which (if there is particularly noticeable noise from the power supply), could be used to play audio. One day I hope to see malware that causes my PC tower to audibly rickroll me.

[@jonathancook8343]

This is my third talk by Domas, I love this guy, he's funny, a hyper-nerd and I understand around 70% of what he's talking about. His exposition on reverse engineering reversers was awesome.

[@markpenrice6253]

The other two (about different CPU backdoors) both put me to sleep. Which is by no means an insult to him or his talks ... it was late at night and trying to comprehend all of what he was saying simply overloaded my brain. It's like the quantum astromechanics of computer hardware hacking. Probably the guys at Intel and AMD have a looser understanding of what's going on inside their processors than he does, right now.

[@chomo54andbabyaisha97]

The most insane stuff I have seen. Man is a genious.

[@markpenrice6253]

Next step: operating system, compiled entirely into MOVs, running inside a VM... also compiled into MOVs. Bonus points for implementing Quicktime drivers as part of the system, so it can _play_ .MOVs using only MOVs (...ahem)

[@proxy1035]

so all we need is an open source OS that is entirely written in C, then you can just throw it through the MOV compiler and there you go.

[@sycration]

@@proxy1035 linux is

[@proxy1035]

@@sycration thing is i'm an absolute noob when it comes to Linux so someone else would need to do that...

[@hadinossanosam4459]

Linux isn't written *entirely* in C, and neither can any other OS be, you will always need some inline assembly for stuff that C (and only mov's) cannot accomplish, like port I/O (IN, OUT), setting up the interrupt and global descriptor tables (LIDT, LGDT), enabling interrupts (STI), handling interrupts (IRET, or alternatively some flag manipulation commands to achieve the same behaviour), system calls (INT), ...

[@proxy1035]

@@hadinossanosam4459 i mean yea technically, but it still counts as "C" even if you use inline assembly since that is part of the C Syntax...

[@FedericoTrentonGame]

This guy is truly a genius

[@Staplegunned911]

That QR Code got me.

[@EwanMarshall]

Well, I deliberately followed it, but my barcode scanner just displayed the URL, then unshortened it to find the real destination and displayed that and I was like, oh, youtube video, I bet it is that one... lols.

[@Phoen1x883]

Is it rickroll? I bet it's rickroll.

[@Phoen1x883]

It was rickroll.

[@ashurean]

@@Phoen1x883 I was watching the video when I got to the qr code bit. At that point, you know this man will destroy the universe to troll people, so I was 99% sure that it was either a gnome link or a rickroll.

[@alexoja2918]

@@Phoen1x883 it's not.

[@remicou8420]

"Why is my dog in the malware?" - Hypothetical reverse-engineer who fell for the dumbest malware plan ever

[@ericmonson3760]

Now I need to go put Clippy in my assembly.

[@alexoja2918]

33:29 the most laborious one i've ever seen. i salute you, sir.

[@memoriasIT]

Amazing talk, knowledgeable speaker, makes the talk interesting and knows how to reach to people. Good job!

[@dipi71]

This is bonkers! Just my kind of thing; thanks for sharing. Cheers!

[@rkj11107]

Something like a surgeon placing atoms in liver in a way that next surgeon would see nice message. What a pro.

[@Tuxfanturnip]

or like that scene in The Last Mimzy where they put the teddy bear under an electron microscope and find the Intel logo nano-printed on every hair

[@chsovi7164]

there was a surgeon who actually left his initials on patients livers

[@Cubinator73]

That guy has wayyy too much time :) Best DEFCON talk I have every heard :D

[@cobraflunkie]

I love this. Trolling at an epic level.

[@bartlx]

Can't begin to describe all the thought paths this brought back making my own conclusions after looking at one piece of asm for hours on end... but then to make a compiler just to prove it and bring it to a stage... wtf... EDIT: okay, saw the whole thing now, with the manipulated control graph imagery based on your personal files etc... This guy is legendary.

[@andrewfielden284]

The Movfuscator is pure genius! But I'm interested to know what Chris can do with Java bytecode.

[@ped7g]

you can always delete it, and pretend it didn't exist... or wait until JVM will JIT it into machine code and then treat it like code... a bit retarded one, but whatever, it's highly likely the original Java source was already like that, so why should the final machine code look any better...

[@the_original_dude]

Oh my, this dude is a genius, and that's an understatement

[@dorukayhanwastaken]

23:54 Lesson learned: x86 is the hardware equivalent of Windows, which explains why Windows is mainly an x86 OS and Win 10 on ARM isn't making much progress in the market.

[@AgentLeon]

Intel or amd didn't invented these out of nowhere, it is probably optimises some algorithm or algorithm family and is easily implemented with all the same execution blocks that are already there

[@lucyinchat]

Now I need to compile Linux with Movcc

[@tysonnw]

Talk about extreme RISC, I wonder what a processor with only the mov instruction would look like and if it could be optimized to match modern processors.

[@Double-Negative]

en.wikipedia.org/wiki/Transport_triggered_architecture

[@discordiangod]

So terrible you would not need to know

[@FeribHellscream]

imagine this as real malware

[@lazertroll702]

...i need to rethink my career path...

[@thewatcher_476]

I need to too

[@RobinObinray]

LaZer Troll security researchers have God-tier coding skills? Enterprise programmers btfo.

[@markpenrice6253]

Hmm, now, the modern world has trained us to believe that pixels have to be square, but it wasn't always necessarily thus, and for applications like this it need not be either. For the greyscale photos it's fairly optimal, but there are other types of image where a wider or narrower pixel could be better suited, and certainly cases could be made for one or the other if they better suited an attempt to weave actually useful execution payloads through the maze of dummy code. For example wider ones would tend to suit old-school game sprites, whereas narrower ones are generally better for text (and some other forms of graphics). And of course if they're double/half the size in one dimension vs the other you can always double up where a square is still needed. Particularly with a tall, rather than wide "pixel", you can still retain a degree of greyscale capability with otherwise small blocks (as the shading is dependent on how much of the available height is used, not width), and be able to write a meaningful amount of text within even a relatively small edit window, perhaps even implementing anti-aliasing, but having some freedom over what code goes where as you could write dark-ish text on a light-ish background (which gives the greatest space for writing functional code, as well as obfuscating garbage) and it would still be legible with some degree of "noise", as one or two instructions more or less wouldn't cause the block to get close to the 50% mid-grey point. Text being quite good for really messing with someone, as they might not immediately recognise a random and probably long-forgotten photo or other image from their HDD that's been mashed down to a 64x64 pixel thumbnail in about 10 shades of halftone-simulated grey, but if you can fish their name or operating handle from somewhere on the system (or the name of some contact of theirs and treat it accordingly) and include it in a short passage of mildly threatening but above all _super creepy_ text that appears to rise stochastically out of the code... that's pretty unequivocal and I'm pretty sure that if I saw that happen at 3am after a long hacking session in a dark and suddenly very quiet, very cold, very lonely room, that program and immediately afterwards that laptop would be closed with a bang registerable on local seismometers and flung across the room with no heed paid to possible damage. And of course if you really wanted, photos could be adjusted for non-square pixels: you just have to do a smooth resize with proportions distorted in an inverse relationship to the pixels they'll be encoded as. Once converted into code, and displayed in IDA, they'll automagically reverse that initial distortion and appear with the correct aspect ratio. I wonder also whether fairly sparse code path maps could be used to do more vector-style rather than pixel grid drawing using some kind of viterbi reverse tree search voodoo, if the rules for how IDA arranges and spaces things out could be more concretely determined? It might actually allow for more sophisticated images to be created with smaller output executables...

[@CptThunderKnut]

This is a whole other level of trolling and genius. Props and wow! So interesting to watch

[@RobinObinray]

It's like emulation engineering via assembly with complex fractal abstrations

[@nullplan01]

The QR code didn't get me. That's the first time I'm thankful for GEMA.

[@electrontube]

so strong. love to you dude. best talk at 23

[@MuscleTeamOfficial]

Wow, this was his first talk? No way, he did that visualization stuff in 2012

[@Roxor128]

That Movfuscator is an atrocity!

[@Gaxhar]

I just had to scan the QR code, didn't I?

[@rogerwilco2]

+Twitch · Rick Ashley?

[@p4rsec]

*Astley?

[@Angloth]

*Ghastly?

[@freesoftwaretalk]

Aren't you happy to know that he will never give you up or let you down?

[@AndrewTJackson]

You and me both, mate.

[@temitopehardhekheyhe7359]

may be the most!! resounding!! applause!! ever@defcon!!! .... .... .... aRt!!!!

[@leahparsuidualc666]

Is there any way to rearrange those etch-a-sketch IDA control flow diagrams, due to recode at runtime .. and if so doing a 'lode runner'- 'qbert'- or at least 'snakes'- -'longplay' ??? Or, or, or ... a full Episode of Masters of the Universe! ... hmm reminds me of C=64 .. seems i have to PEEK a lil' deeper into that POKE; anyhow thanks for bringing back the magic via MOVfuscator and actually keeping the record straight for the x86-multiverse. Very entertaining. What worries me is i do understand what you are eloquently speaking about, although i can't remember when and where i could have set video-playback to 2.00x speed ... ;)

[@Raj_darker]

Great Efforts and Really c00l video, IDA got smashed

[@Bobucles]

So a movuscator program would be immune to CPU architecture exploits, right? A program that has two different behaviors between mov code and regular assembly would indicate something was amiss?

[@Syncopator]

I think it must be time to build a computer that only implements mov instructions.

[@larrygall5831]

Wow, that was hilarious. Very good video.. Very good. Smart guy right here.

[@eformance]

Achievement unlocked: Inception complete!

[@tnosugar]

This is nuts! I'd go with "We know where you live..."

[@drowningin]

forget security benefits. this is awesome in its own right

[@_hackwell]

oh wow! this one is high level!

[@BaSs_HaXoR]

IDA GOAT.

[@rogerwilco2]

That's brilliant. Probably Useless, but brilliant.

[@xesau]

RogerWilco Art

[@RobinObinray]

RogerWilco it's not useless. He showed us a sneak peek of how governments spy on us...

[@RobinObinray]

RogerWilco he uses code complexity fractaling?...

[@josephsagotti8786]

@@RobinObinray How governments spy on us? This is literally about making reverse engineer's jobs harder by making code harder to read.

[@RobinObinray]

On the fringe of cyber security research

[@floppydisk4500]

Artist absolutely everywhere even in your source source code go have fun with it

[@jamesgrimwood1285]

That final piece of "malware" should make use of the webcam... Seeing yourself would be a little weird :)

[@nunosilva6574]

So this is what being a next-level troll is... :)

[@softdatcls7156]

Good Job !

[@vizionthing]

Godlike!

[@robnergal575]

Could embed: "We've been trying to contact you about your Car's extended warranty. This is a final courtesy call..."

[@dutchgh0st540]

What about a kernel written with only mov instructions?...??

[@RobinObinray]

Dutch Gh0st what about a dynamic boot-time kernel replacement with a kernel that, if disassembled with IDA, leaks any possible personal data to pastebin and then links to the pastebin url via QR code a reverser will see in CFG

[@chrissxMedia]

wow...the qr code is a rick roll

[@nindger4270]

Epic idea and awesome talk. Sidenote though, regarding the QR-Code @ around 33:30: at least in Germany, the YT-link it takes you to is blocked :-( Still lol'ed pretty hard when I saw the title, but it kinda spoils the idea.

[@josephmauck9200]

He's never gonna give you up, he's never gonna let you down... it's a rickroll ;)

[@AviPars]

Sweet video !!

[@blu3h4t]

Wait you expect a reverse engineer to run the malware bare metal on their personal machine?:D

[@mariarahelvarnhagen2729]

playing last return of the japanese final surrender with TRSi

[@kahungchim6367]

Alternative title: How to make pixel art with IDA pro

[@kuhluhOG]

So, what is the performance of a mov only program compared to a normal compiled one?

[@wirer0p497]

great talk :)

[@RahulJain-wr6kx]

This is something awesome 😁

[@CharlesVanNoland]

lol control flow graph messages

[@discordiangod]

But what if you embedded Opcodes in the control graph? Would science go too far?

[@DaveRoberts308]

Brilliant.

[@LuxiusDK]

Did this guy go for the Cypher look or was it the other way around?

[@Davi-c4q]

33:25 next level cryptography

[@bluescanfly1981]

Homeboy is an artist. It's like BB King playing the blues. As simple as possible, but no simpler - it just makes you happy.

[@b1ueberrycheesecake]

lmao i scanned the qr code out of curiosity watching this 4 in the morning.

[@blu3h4t]

This is like ascii art from hell. Or is it what snowcrush is about?:D

[@jamesdegriz]

This video makes Facebook throw an error message.

[@aquatrax123]

Amazing!

[@ICountFrom0]

I kind of wanted to see what a movoscated program looked like in Ida.

[@Nicofromtheweb]

I don't understand any of this... but the drawings were funny ! I feel like a child.

[@nullnull6032]

that is insane

[@isabelle5547]

this is great and all but does he not look exactly like the default runescape character

[@caleballen4721]

Every time this guy is in my recommended I hope so badly it's a new one.. but I heard he got hired by Intel so he probably won't be doing these public talks anymore..

[@KarlMySuitcase]

That would have been a great call on intels part

[@IvanToshkov]

Great talk! Just put in some quotes from the star wars prequels. I mean, how long do you think you can stare at something like “You are in my very soul, tormenting me…” or “I wish I could just wish away my feelings”?

[@Warutteri]

33:44 Got fucking Rick Rolled x'D

[@mariarahelvarnhagen2729]

can you see AC ?

[@danatronics9039]

"Why is my dog in the malware?" /r/brandnewsentence

[@evanperrygiblin]

I just don't think that any code should have to be written twice, there's so much time and headache to write it the first time

[@flapeee]

BEST TROLLing EVER !!!

[@yashbansod5628]

I use gdb mostly.

[@brashcrab]

Elvis is Alive

[@Some_Beach]

Now to embed goatse in my code

[@dylanmatthews7431]

I have a question for you when it comes to wanting to crack a game. Do you personally know if there is anyone talented enough in the scene to reverse engineer the game Path of Exile? People say it's one of the worst targets they've ever attempted, with a bunch of abstraction layers and you get perma banned if you even look too long. It's a live server client and the game is free, but people want to make their own private server out of it to be able to play the content the way they want, in a non-profit fashion obviously. Any ideas on how you would go about bypassing the drm on this live service client and getting the source code for people to make their own private server out of it?

[@peepopalaber]

He is the real king of trolls.

[@shredo2]

somehow I knew where that QR code will take me... ^^

[@tuanlinhdao3389]

Nice :D

[@jonascurry9996]

sick

[@NolePTR]

HOLY SHIT!

[@billigerfusel]

Holy shit, this is evil.

[@DJBillyQ]

A security in and of its own...

[@m3taldragon1]

And then someone runs your program through MASM... Wow so hard!

[@dasinhaberlicht3998]

I got lost at 0:00

[@Engineerisaac]

One dude I reversed his code lots of Bible verses...

[@DrewWalton]

So you reversed TempleOS?

[@TrexityTrex]

This man is a fucking legend lmaooo

[@jorgediaz6730]

Holy shiiiieeet

[@TatsuZZmage]

oh god idea a full build of gentoo with it mwa hahahaha

[@margueritemunson6447]

Hes the Tai Lopez of reverse engineering

[@stutavagrippa8690]

I hate myself so I'll reverse engineer this

[@elidrissii]

What a genius lol.