FRODO: Format Reverser of Data Objects

No ratings

Presented at HackInTheBox 2014 by

All software works with data: receives input, processes it, and returns output. Understanding the data formats used greatly helps in reverse engineering of whole programs and allows fuzzing the program effectively. I’m dreaming about this kind of tool for a long time – A tool that can easily perform data format reversing. During the talk we will share the experience, findings, tricks and tips while creating FRODO – Format Reverser Of Data Objects. A tool for automating the task of reversing data formats. First, we review some previous works in data format reversing. Some of them concern the problem of determining the location and lengths of fields within data formats, especially in variable length formats. Some do data structure detection. Another tries to replay both the client and server sides for a variety of network applications. Others can reverse an input format with a rich set of information including record sequences, record types, and input constraints. And another can generalize the format specification over multiple inputs. We take a deep look into data format patterns to explore dependencies between different parts of them. It helps us to discover three types of fields: service fields (used to describe features of substructures and data organization), common fields (from life, time for example) and specific fields (which can have meaning only in program execution). While creating FRODO we have solved different tasks, such as: how to divide service data format information (headers and etc.) from data and how to find structure in binary stream. We also introduce a model to describe fields, structure of header etc on which FRODO is based.