Obfuscation Part 3: base64

00:00

all right. So as we continue our discussion, talking about Mauer challenges. Now let's learn about obfuscation. Using base 60 for encoding

00:09

based 64 is a binary to text and coding scheme. More specifically, it allows us to take a sequence of eight bit binary data and format them in a raid x 64 representation.

00:23

This allows malware authors to encode binary data into a nasty format.

00:27

Understand, though, that not all based 64 implementations are malicious. Today, you see based 64 pretty often it's used in http and email attachments. As the encoding scheme is very fast and easy to reverse.

00:43

The standard based 64 format employees the following characters that you see here in our raid ICS. We've got a combination of letters, numbers as well as the plus and slash at the end. Also, the base 64 format encodes data into 24 bits or three bytes of binary data,

01:02

and each three bites is translated into four characters from our rate ICS.

01:07

So let's understand how data is encoded.

01:11

The first thing that we need to dio is we need to look at our ratings and here we've got 64 values zero is a through slash, which is 63.

01:21

So now let's say we want to convert the message dog that we used earlier to base 64.

01:26

So the first thing that we want to dio is we want to convert each letter to binary. We could do this a few ways, but to speed up the process, I've already looked at the asking table

01:36

and we know that the X representation for D is 44 hex in binary is 01000100

01:47

The letter O is 01001111 and G is 01000111

01:56

Now what we do is we put all these values in a line together. This is a 24 bid, three bite piece of data. This is exactly how base 64 processes data.

02:05

So now what we can do is now we can split the binary digits into 46 bit groups, and then we convert those groups to their decimal equivalents. And then we look up their equivalents in the table.

02:19

So if we convert our first group of six digits, we have a value of 17.

02:23

If we convert our next six digits, we have a value of four.

02:30

When we convert our third set of digits, we have a value of 61. And if we convert our fourth set of digits, we have seven. Once we have the decimal equivalents, we simply look up the base 64 equivalent

02:43

17 as our

02:45

for his E

02:46

61 is nine and seven is H giving us a base 64 string of R E nine h.

02:54

Okay, so why is this all important? Why did I go through the steps to show you how to convert? Based 64? There are many tools that can help you locate in reverse based 60. For encoding. You could use Python Cyber Chef, which is a favorite of mine or even converter net.

03:12

But understanding the base 64 scheme that we've just reviewed can help you recognize and identify custom and coding schemes.

03:20

In general, you wanna look for the base 64 character set as a string in our programs to look for base 64 encoding. You can use any of the tools that I mentioned, but probably the fastest way is to use strings or a P E tool like P E studio. But I do pro can also help us in these situations.

03:39

Toe. Look for base 64 encoding. We can use the strings feature in Ida Pro,

03:45

so let's first load are binary.

03:46

If you're already working with the database such as I am, you can simply double click your database now. Once the data bases loaded, we can look for strings by navigating to the view menu item and then sub views and then strings.

04:02

You can then look for the base 64 character set.

04:05

Here we have one.

04:09

We can double click the item, and it will bring us to the section of the program where the character set is referenced. As you can see, this string is being referenced in a function by looking at the cross references listed on the right.

04:20

If we'd like to navigate to this function, weaken simply double click on the references,

04:27

or we can press X on our keyboard to view all of the cross references.

04:31

Once we find the function that we're most interested in, we can navigate to that function by double clicking. It As you can see, Ida Pro navigates us to a base 64 function. If you notice here on the right, we also have an equal sign.

04:46

This is because there's a number of alphabets that use 64 characters, and this additional character indicates padding to see where the base 64 encoding is happening. We can see what function calls this one by again using the cross references. We can do this by navigating to the top, clicking on the function name

05:04

and pressing

05:05

X.

05:06

We only have a one function so we can double click and navigate to it, and I do pro. The function we navigated from is highlighted in our graph.

05:15

From here. You could start to analyze your code by seeing how the base 64 is being implemented.