Environment Setup and Tooling

Table of Contents

Tools and Scripts

In order to perform patch analysis the following tools and scripts will be used:

  • Ghidra - the primary SRE tool
  • ghidra-patchdiff-correlator - plugin to improve default Ghidra version tracking correlators. Latest version available here.
  • Java 11+ (JDK) (Ghidra Dependency)
  • symchk - Microsoft Utility to download relevant symbols for Microsoft binaries (optional as Ghidra provides a way to download symbols)

Installation

  1. Install minimum+ version of Java Runtime and JDK.
  2. Download and unzip Ghidra to local directory. C:\Ghidra or some other place
  3. Download and unzip ghidra-patchdiff-correlator.zip.

    1. In Ghidra: File -> Install Extensions hit the top right green + icon; then select the ghidra_<VERSION>_PatchDiffCorrelator.zip (that you either build from source with the GhidraDev plugin or downloaded pre-build from the releases section; please make sure VERSION matches your Ghidra version!)

  4. Just need python for Patch-Delta and Patch-Extract.
  5. Symchk is included with Microsoft’s Debugging Tool for Windows

Preparation

File Collection (suggested)

Gather all the binaries for Patch Diffing into a single directory.

Sample collection of files from Security-Patches conclusion.

$ find WindowsPrintSpooler/
WindowsPrintSpooler/
WindowsPrintSpooler/2020-04
WindowsPrintSpooler/2020-04/p..ooler-core-localspl_6.1.7601.24383
WindowsPrintSpooler/2020-04/p..ooler-core-localspl_6.1.7601.24383/localspl.dll
WindowsPrintSpooler/2020-04/p..ooler-core-localspl_6.1.7601.24383/winprint.dll
WindowsPrintSpooler/2020-05
WindowsPrintSpooler/2020-05/p..ooler-core-localspl_6.1.7601.24554
WindowsPrintSpooler/2020-05/p..ooler-core-localspl_6.1.7601.24554/localspl.dll
WindowsPrintSpooler/2020-05/p..ooler-core-localspl_6.1.7601.24554/winprint.dll
WindowsPrintSpooler/2020-08
WindowsPrintSpooler/2020-08/p..ooler-core-localspl_6.1.7601.24559
WindowsPrintSpooler/2020-08/p..ooler-core-localspl_6.1.7601.24559/localspl.dll
WindowsPrintSpooler/2020-08/p..ooler-core-localspl_6.1.7601.24559/winprint.dll
WindowsPrintSpooler/2020-11
WindowsPrintSpooler/2020-11/p..ooler-core-localspl_6.1.7601.24562
WindowsPrintSpooler/2020-11/p..ooler-core-localspl_6.1.7601.24562/localspl.dll
WindowsPrintSpooler/2020-11/p..ooler-core-localspl_6.1.7601.24562/winprint.dll

Symbol Collection (mostly required)

Symbols improve Ghidra’s ability to analyze a binary and also speed up the Patch Diffing process.

Create Symbol Directory

Create a directory on your OS to store symbols:

  • C:\symbols
  • /home/user/symbols
  • any path you like

Download

Run symchk on all the collected binaries and cache the symbols locally.

symchk /r /v /s SRV*c:\symbols*https://msdl.microsoft.com/download/symbols .

This command will recursively download symbols from https://msdl.microsoft.com/download/symbols and cache them in c:\symbols.


PS C:\Users\user\Desktop\WindowsPrintSpooler> symchk /r /v /s SRV*c:\symbols*https://msdl.microsoft.com/download/symbols .

.
.
.
.

[SYMCHK] PDB: "c:\symbols\winprint.pdb\BA411BB6DA07421F9EDF79D8EE6F218E2\winprint.pdb"
[SYMCHK] CV: RSDS
[SYMCHK] CV DWORD: 0x53445352
[SYMCHK] CV Data:  winprint.pdb
[SYMCHK] PDB Sig:  0
[SYMCHK] PDB7 Sig: {BA411BB6-DA07-421F-9EDF-79D8EE6F218E}
[SYMCHK] Age: 2
[SYMCHK] PDB Matched:  TRUE
[SYMCHK] DBG Matched:  TRUE
[SYMCHK] Line nubmers: FALSE
[SYMCHK] Global syms:  FALSE
[SYMCHK] Type Info:    FALSE
[SYMCHK] ------------------------------------
SymbolCheckVersion  0x00000002
Result              0x00030001
DbgFilename
DbgTimeDateStamp    0x5f8667a4
DbgSizeOfImage      0x0000e000
DbgChecksum         0x00018262
PdbFilename         c:\symbols\winprint.pdb\BA411BB6DA07421F9EDF79D8EE6F218E2\winprint.pdb
PdbSignature        {00000000-0000-0000-0000-000000000000}
PdbDbiAge           0x00000000
[SYMCHK] [ 0x00000000 - 0x00030001 ] Checked "C:\Users\user\Desktop\WindowsPrintSpooler\2020-11\p..ooler-core-localspl_6.1.7601.24562\winprint.dll"

SYMCHK: FAILED files = 0
SYMCHK: PASSED + IGNORED files = 11

Configure Ghidra to User Your Download Symbols

env-setup-symbol-config

Ghidra also has an option to download the symbol, and has the Microsoft symbol server baked in.