Today, I would like to present a new plug-in that I wrote called OllyEye. I wrote the plug-in to speed up the process of hunting vulnerability in applications. Here is a screenshot of the OllyEye plug-in:

How does OllyEye work?

Sometimes we want to find out where in a module the code parsing is done. In the example below, we want to find the code that parses the QuickTime video codecs that are in Windows media player. We know that the codecs support the raw, rle, jpeg, mjpb, and rpza tags, so all we need to do is to search for those tags in our module--in this case, the "quartz.dll" module.

The OllyEye hunter knows that it should check for the video codec’s tags such as code.equals ("rpza") and that in assembly it should be done with the CMP command that represents it. For this reason, it searches for the CMP command that matches the 'rpza' keyword. Here we can see the results of the OllyEye when the hunter searches for such patterns:


At the address 0x748FD28B, we see CMP EAX,617A7072. The ASCII translation of 617A7072h is 'azpr', which is one of the QuickTime video codec’s supported tags. Now all the hunter has to do is set a breakpoint there, load the movie file, and wait for the breakpoint to be triggered.

A QuickView in IDA shows us that our address, 0x748FD28B, is inside the QTDec::CheckInputType when the QTDec is QT=QuickTime and Dec= Decoder. Based on this information, we know that we reviewed part of QuickView codec's decoder.

Attached here is the source code of the OleEye plugin. You are welcome to extend it and to shoot us the update

b7d3_11.12.2008_CRACKLAB.rU.tgz - OllyEye.rar

-----
RE In Progress [!] Coding Hazard [!] Stay Clear of this Cube

| Сообщение посчитали полезным:

ну и в дополнение по реверсингу сетевых протоколов

OllySocketTrace
About
OllySocketTrace is a plugin for OllyDbg (version 1.10) to trace the socket operations being performed by a process. It will record all buffers being sent and received. All parameters as well as return values are recorded and the trace is highlighted with a unique color for each socket being traced.

The socket operations currently supported are: WSASocket, WSAAccept, WSAConnect, WSARecv, WSARecvFrom, WSASend, WSASendTo, WSAAsyncSelect, WSAEventSelect, WSACloseEvent, listen, ioctlsocket, connect, bind, accept, socket, closesocket, shutdown, recv, recvfrom, send and sendto.

Usage
Simply install the plugin and activate OllySocketTrace when you wish to begin tracing socket operations. OllySocketTrace will automatically create the breakpoints needed and record the relevant information when these breakpoints are hit. To view the socket trace select the OllySocketTrace Log.

Double clicking on any row in the OllySocketTrace Log window will bring you to the callers location in the OllyDbg disassembly window. The recorded socket trace is highlighted with a unique color for each socket being traced. Right clicking on any row will give you some options such as to view the recorded data trace. You can also filter out unwanted information if you are only concerned with a specific socket.

Screenshot




OllyCallTrace
About
OllyCallTrace is a plugin for OllyDbg (version 1.10) to trace the call chain of a thread allowing you to monitor it for irregularities to aid in the debugging of stack based buffer overflows as well as to quickly plot the execution flow of a program you are reversing.

Usage
Simply install the plugin and set a breakpoint on a location you want to trace from, e.g. ReadFile() or WSARecv(). When this breakpoint is hit, activate OllyCallTrace and press F7 to begin the automated single stepping and recording of the call chain. When you are finished tracing the code, pause execution or disable OllyCallTrace and view the OllyCallTrace Log to see the recorded call chain.

Double clicking on any Call/Return instruction in the OllyCallTrace Log window will bring you to that location in the OllyDbg disassembly window. The recorded call chain is highlighted with blue being for the main module, yellow for system modules and green for all other modules. The call chain is also displayed in a nested format to make it easier to read. All irregularities are marked in red.

Example
This example shows how OllyCallTrace handles the recording of a stack based buffer overflow. In the screenshot below we can see where an overflow occurred when returning from the function at 0x00401198 and an attempt was made to return to 0x41414141. We can see that the return address should have been 0x0040120E which was originally called from 0x00401209. We can also note that the memset operation before the stack smash is suspicious and probably the cause of the vulnerability. This information would not have been available without OllyCallTrace recording the call chain as the stack is destroyed after the overflow.

Screenshot


OllyHeapTrace
About
OllyHeapTrace is a plugin for OllyDbg (version 1.10) to trace the heap operations being performed by a process. It will monitor heap allocations and frees for multiple heaps, as well as operations such as creating or destroying heaps and reallocations. All parameters as well as return values are recorded and the trace is highlighted with a unique colour for each heap being traced.

The primary purpose of this plugin is to aid in the debugging of heap overflows where you wish to be able to control the heap layout to overwrite a specific structure such as a chunk header, critical section structure or some application specific data. By tracing the heap operations performed during actions you can control (for example opening a connection, sending a packet, closing a connection) you can begin to predict the heap operations and thus control the heap layout.

Usage
Simply install the plugin and activate OllyHeapTrace when you wish to begin tracing heap operations. OllyHeapTrace will automatically create the breakpoints needed (RtlAllocateHeap, RtlFreeHeap, RtlCreateHeap, RtlDestroyHeap, RtlReAllocateHeap, RtlSizeHeap, GetProcessHeap and RtlInitializeCriticalSection, RtlDeleteCriticalSection) and record the relevant information when these breakpoints are hit. To view the heap trace select the OllyHeapTrace Log.

Double clicking on any row in the OllyHeapTrace Log window will bring you to the callers location in the OllyDbg disassembly window. The recorded heap trace is highlighted with a unique colour for each heap being traced. Right clicking on any row will give you some options such as to view the heap chunks data or the heap itself (only a raw dump of the memory is given, no parsing of the heap structures is performed). You can also filter out unwanted information if you are only concerned with a specific heap.

OllyHeapTrace has been successfully tested on:

Windows 2000 SP4
Windows XP SP3
Windows Server 2003 SP2
Windows Vista SP1
Windows Server 2008 SP1
Screenshot



-----
RE In Progress [!] Coding Hazard [!] Stay Clear of this Cube

| Сообщение посчитали полезным:

Can you build it by yourself? I have no C++ compiler installed.

-----
Stuck to the plan, always think that we would stand up, never ran.

| Сообщение посчитали полезным:

Гы-гы-гы
lib\ollydbg.txt (антивирь упёр в карантин либу):

ARCHANGEL, я думаю что mak не сам писал эту тулзу (иначе зачем писать в основном форуме по-английски? Worldwide есть для этого). Попробую собрать. Только вот SDK надо скачать.

| Сообщение посчитали полезным:

скомпиленная и либа

c3b4_11.12.2008_CRACKLAB.rU.tgz - OllySnake.dll+ollylib.rar

-----
RE In Progress [!] Coding Hazard [!] Stay Clear of this Cube

| Сообщение посчитали полезным:

скомпиленная всеравно на запускается чегото

Вот те 3 дополнительных , забыл их приложить

caa0_11.12.2008_CRACKLAB.rU.tgz - OLDBG plugin3x.rar

-----
RE In Progress [!] Coding Hazard [!] Stay Clear of this Cube

| Сообщение посчитали полезным:

mak пишет:
OllySocketTrace
То что давно искал. Спасибо!!!

| Сообщение посчитали полезным:

mak пишет:
скомпиленная всеравно на запускается
У меня вообще не компилится. Link не может разрешить импорт из ollydbg.lib. Ты какой версией компилил?

| Сообщение посчитали полезным:

Dem0n1C
давным давно все это дело выложено! Че искать то ?

-----
My love is very cool girl.

| Сообщение посчитали полезным:

mak
Эмм... еще былоб замечательно дать урл на сайтег автора www.harmonysecurity.com/tools.html

-----
Computer Security Laboratory

| Сообщение посчитали полезным:

[HEX]
Ну это автор второго блока плагинов. А тема называется OllyEye plug-in

Вот нечто похожее на первоисточник OllyEye. Правда скомпиленной либы там все равно нет
http://securitylabs.websense.com/content/Blogs/3244.aspx http://securitylabs.websense.com/content/Blogs/3244.aspx

| Сообщение посчитали полезным:

сам в блоге нашел , 6 кой С++ студией компилил, ошибок не было. Позже разберусь что такое.

-----
RE In Progress [!] Coding Hazard [!] Stay Clear of this Cube

| Сообщение посчитали полезным:

mak
Я тоже ей же. Но не получалось. Можешь скинуть весь проект (включая компиленную либу) сюда? В крайнем случае можно в IDA посмотреть, почему не работает...

| Сообщение посчитали полезным:

Просьба всем: кто может скомпилить или уже имеет скомпиленную версию этого плагина - выложить сюда.

| Сообщение посчитали полезным:

progopis пишет:
скомпиленную версию этого плагина

какого именно? Snake есть, уже и не помню, сам компилил или взяд где. Правда ниразу так и не заюзал

| Сообщение посчитали полезным:

Подсказка: тема называется OllyEye plug-in

| Сообщение посчитали полезным:

Что, правда? А теперь внимательно прочитай название плага на первом скрине и название архива в пятом посте. А ещё обрати внимание на то, что в двух первых постах даётся инфа по разным плагам.

| Сообщение посчитали полезным:

Ребята давайте небудим ссориться
Насчёт OllySnake у меня есть такой плагин но насколько я знаю без Windows debuggers он работать не будет(если вы его иммели в веду)
-----------------------------------------------------------------
Вот этот проект поинтереснее будет radare.nopcode.org/new/?img


6b95_13.12.2008_CRACKLAB.rU.tgz - OllySnake.dll

-----
Чтобы правильно задать вопрос, нужно знать большую часть ответа. Р.Шекли.

| Сообщение посчитали полезным:

ClockMan
Версия устарела, но все равно спасибо. У mak'а вообще не рабочий.

| Сообщение посчитали полезным:

Поскипал пару постов и подправил 1. Не нужно собачиться тут.

| Сообщение посчитали полезным: