A Guide to Multi-Level Pointer Analysis

 

A Comprehensive Guide to Multi-Level Pointer Analysis

 

A regular pointer points to only one address, but when it's accompanied by a list of offsets, you can walk that pointer chain to find the final or end address. This end address is the address of the variable you want, and it can be used for malware analysis.

By walking this pointer chain, you're actually replicating the actual logic that malware uses to access that variable. When you find a pointer in your malware analysis tool, what you're finding is a path from one address to another using pointers and relative offsets. It's like following a treasure map to reach the buried treasure.

The logic behind this is based on two important features of modern object-oriented programming:

1. Applications are made memory-efficient by dynamically allocating objects only when needed. Pointers are used to point at these objects, so you can access them via the pointers. Similarly, malware dynamically creates objects and points to them with pointers.

2. Classes can contain member variables that are pointers, specifically pointers to other objects in memory. In malware, these classes could be hiding malicious payloads, and these pointers can be used to execute malicious code.

The baseAddress or first pointer in the pointer chain is generally one that exists in static memory, meaning it's always located at the same address or can be accessed using a relative offset from the base address of a module. This base address acts as the starting point for your malware analysis and helps you trace the path to the desired variable.

Here's a simple example of real multi-level pointer logic in malware analysis:

// Defining a class
class MaliciousClass
{
public:
    int malwareType;
    int payloadSize;
    char* payload;
};

// Creating a pointer capable of pointing at a MaliciousClass object
MaliciousClass* maliciousObject;

// Creating a new dynamic MaliciousClass object and making our pointer point at it
maliciousObject = new MaliciousClass();


In this example, the malwareType and payloadSize variables are stored as integers at offsets 0x0 and 0x4, respectively. The payload variable is a pointer to a character array at offset 0x8, which contains the actual malicious payload.

Just like with regular programming, we use pointers to access and manipulate these variables. We can use the pointer arrow -> (called the structure dereference operator) to access the payload variable, like this:

maliciousObject->payload
maliciousObject->payload

To perform multi-level pointer analysis in malware, you can use malware analysis tools such as IDA Pro and OllyDbg. By using the "Find What Accesses This Address" or the pointer scanner on a variable, you can find a multi-level pointer where the baseAddress is the address of the maliciousObject and offset 0x8 leads you to the payload pointer. When dereferenced, this pointer yields the address of the actual character array containing the malicious payload.

In C++, we can manually perform multi-level pointer analysis by reading the process memory of each pointer in the chain, like this:

ReadProcessMemory(handle, (LPVOID)pointerAddress, &newPointerAddress, sizeof(newPointerAddress), NULL);
ReadProcessMemory(handle, (LPVOID)(newPointerAddress + offset[0]), &newPointerAddress, sizeof(newPointerAddress), NULL);
ReadProcessMemory(handle, (LPVOID)(newPointerAddress + offset[1]), &newPointerAddress, sizeof(newPointerAddress), NULL);
ReadProcess(handle, (LPVOID)(newPointerAddress + offset[2]), &finalAddress, sizeof(finalAddress), NULL);

This is a very basic example of how a multi-level pointer chain works in practice. In reality, it can be much more complex, with many more levels and offsets to navigate.But why would you need to do this in the first place? One common use case is in malware analysis. Malware often uses multi-level pointer chains to hide its own data and code from security software. By understanding how multi-level pointer chains work, security researchers can better analyze malware and find hidden information.

In conclusion, multi-level pointer chains are a powerful tool used in computer programming and analysis. By understanding how they work, you can gain a deeper understanding of how computers locate and act on data stored in memory. Whether you're a computer engineer, a game developer, or a security researcher, understanding multi-level pointer chains is a valuable skill to have.