The talk “unrubby: reversing without reversing” was part of the Troopers conference in Heidelberg, 16 March 2016. The talk was done by Richo Healey, who is currently working on the security engineering team at the Irish payment company Stripe. Richo Healey is an experienced conference speaker. Amongst other he has spoken at Kiwicon, DEF CON and 44con.
In his talk Richo Healey spoke about reverse engineering of Ruby software. First he talked about existing tools and techniques to regenerate source code from Ruby bytecode. Then he presented a new concept, which is implemented in his tool “unrubby”.
Ruby is multi paradigm programming language, which uses a “Just-in-time” – compilation approach. First, Ruby source code is translated into bytecode, then the bytecode gets interpreted by a virtual machine like YARV during the runtime. This approach provides portability as well as performance. GitHub and Metasploit belong to the biggest projects which are written in Ruby.
Software packages in Ruby are provided either in source or bytecode. For closed-source software only the bytecode gets published. To prevent the users from regenerating the source code various obfuscating techniques are used. Nevertheless there also a lot of approaches to bypass these obfuscating techniques. Most of them are based on reverse engineering of the bytecode.
Reversal is a tool which analyzes the bytecode of the YARV to recover the original source code. The tool was written by Michael Edgar from Dartmouth College. Although Reversal achieves good results, there are compatibility issues and the tool is outdated. To make Reversal work with a recent version of Ruby Richo Healey patched Reversal and added the support for new instructions. But in the end Reversal is still fragile. In Addition to that, Reversal tries to turn back the whole program into source code. But this is often too ambitious.
After describing these problems Richo Healey presented a different approach, which is not affected by these disadvantages. His tool unrubby is a hacked Ruby virtual machine. It changes the internal behavior of the virtual machine to generate the source code while the program is running. So analysis of the source code is not needed. In addition to that unrubby is able to also deliver the source code of dynamically generated methods. The code is dumped by unrubby after termination. Although this tool is for Ruby, this technique can be applied to the virtual machines used by other languages.
According to Richo Healey there is no obvious way to defeat this technique. It may be possible to use checksums or internal offsets, but the best way seems to be to put everything in statically linked libraries.
Finally Richo Healy encouraged the audience to download the tool, play with it and report bugs.
The slides for the presentation can be found at https://speakerdeck.com/richo/unrubby .
The source code for unrubby can be found at https://github.com/richo/unrubby.
Thanks for reading
Robert