AVM Inception: How we can use AVM instrumenting in a beneficial way
No ratings
Presented at Baythreat 2011 by
AVM Inception: How we can use AVM instrumenting in a beneficial way During the last few years, we have seen multiple instances of Adobe Flash related 0-day outbreaks. This paper examines the idea of using Flash Virtual Machine Instrumentation techniques in order to research Adobe Flash vulnerabilities. Adobe Flash ActionScript has its own instruction set and virtual machine. The virtual machine is called AVM (ActionScript Virtual Machine). Research into AVM related vulnerabilities is limited by the fact that it generates JIT (Just-In-Time) code, and malware abuses of these vulnerabilities are complicated by the execution flow. By introducing a binary instrumentation technique to Flash AVM bytecode, we can make the virtual machine act in a way that we intend. This is important because from in-the-wild sample code, we can create our own controlled version of the same exploit in a short time. This modified file can be used for vulnerability research. Binary instrumentation was traditionally an area for native code examination. But it is also possible to apply the same technique to bytecode that uses a virtual machine. We are surrounded by many types of virtual machines these days. One of them is AVM - and the truth is that AVM has been one of the largest targets for exploitation over the last few years. It has been prone to multiple vulnerabilities including CVE-2011-0611 and CVE-2011-0609. Because the issue covers both the bytecode and native world, the actual analysis of the vulnerability can take a long time compared to more traditional vulnerabilities. We developed bytecode instrumentation (in this case AVM bytecode instrumentation) to solve this challenging problem. What the analysts see from the crash dumps or debug traces are the dynamically generated code. Even though its not impossible to debug the problem tracing this dynamically generated JIT code, it would be much quicker if we knew what was really happening at the bytecode level. We examine a number of different techniques in this area. Including: Injecting validation or debugging instructions into AVM bytecode to debug AVM issues efficiently. Injecting routines to dump dynamically loaded Flash files. Using this technique to de-obfuscate highly obfuscated AVM bytecode. Putting heap spraying or JIT spraying detection logic inside AVM bytecode. Many things are possible with this approach - all of these are helpful when analyzing and determining the maliciousness of Adobe Flash files. This approach is also very useful when analyzing unknown Adobe Flash vulnerabilities (aka 0-days). We talk about the technical aspects of this approach and illustrate the techniques using case studies from the wild. This analysis also presents a clear picture of what is actually happening with broken AVM code. First we are going to show the basic concept on VM and bytecode. We will explain what the flash VM related security issues are and what the challenges for the analysts and researchers. After that we will present traditional native world approach, and will finally show the concept of AVM instrumenting. We will show the actual examples of malwares and the application of instrumentation technique. There will be story for all the barriers and methods to overcome them during the designing and implementing bytecode instrumentation. You can get the knowledge of what the basic concepts on AVM related security issues. The attendees will get to know there can other approach in analyzing this special class of vulnerabilities. Instead of struggling with traditional approach, they are given with new concept. This technology is not limited only to AVM, basically you can apply same instrumentation technology to any VM-based binaries.