>> I'm going to show you a little demo /of
the difference we can see in the code.
Over on the left here, we have the original bot binary
from the illusion bot
that we downloaded from the GitHub page.
I'm going to copy it over on the right side.
Over here, I've downloaded
this program called Cantor Dust.
It's made by a researcher,
he works in the national labs.
His talk at Black Hat, well,
he releases tools actually really, really good.
But he said he'd release
more than just this demo and he never did.
I don't know what his deal is,
but it makes really pretty pictures and it
allows us to quickly see what's going on.
We can take our original binary or bot.
We can drag it over here and we can say,
this thing, we can do it in
>> different coordinate systems.
>> [inaudible] It definitely has some patterns,
some lines in it that you can see.
It definitely has some data
right over here in the corner.
You can see these smaller cubes.
That is ASCII.
Those are the strings that we typically see.
Over on the left,
we can see these two columns of green.
That's all fine and good.
It gives us some clear idea
of the type of data that's in there.
It's basically showing us the bytes.
We have our original bot binary here.
I'm going to make a copy of it.
I'm going to pull up a command prompt,
[NOISE] CMD, it's in this directory.
I'm going to download a program UPX.
Like I said, one of
the oldest packers most commonly used.
I'm just going to download it for Windows here.
I've put the program right here.
I'm going to type
upx.exe and I'm going to pack the binary copy.
It does this little banner.
Then it says it edited this file,
it compressed the size by 41 percent.
That's nearly half of the size it was before.
I'll just rename this file to packed.
[NOISE] I'm going to run Cantor Dust again.
This was our original bot binary,
and this is our packed version.
You can see there's really no structure to it.
It's a lot of randomness.
There is really nothing there that we
can point and say, oh,
I can see that there's some structure to this file
that tends to be a cluster of
bytes that are very similar over here.
We can't really make much of it.
It's because it's compressed as high entropy.
Also, I'll show this in the future.
But if we run strings on our original binary,
we can see that there are plenty.
The user agents,
the obfuscated strings are
encoded pass, the function calls.
If we run the same strings
>> command on the packed binary,
>> we see that there are hardly any.
There's a few functions that it needs
to resolve the other functions dynamically.
There's probably a reference to UPX in there somewhere.
[NOISE] Yeah.
UPX explanation point;
UPX0, UPX1, UPX2.
These are actually the names of the sections.
But we'll take a look at that in a bit.
Just for a test,
we can look at the hashes,
SHA-1,
MD5, MD5.
They are indeed different.
All it takes is one bit to be flipped to generate
a new hash or to derive a new hash.
Visual reverse engineering might
take hold in the future,
but I don't see it happening just yet.
The tools aren't quite there,
but I definitely recommend this talk.
Even if he didn't really
release his tool that he said he was going to,
it's still pretty inspiring to see what's
possible with just visually inspecting binary.