DEF CON 32 - Autos, alcohol, blood, sweat, & creative reversing obfuscated Car Modding tool - Atlas

This DEFCON talk by Atlas demonstrates techniques for reverse engineering obfuscated automotive diagnostic tools to gain access to vehicle ECU authentication mechanisms 0:00.

Key Takeaways:
• The goal is remote code execution on vehicle ECUs through the update/diagnostics process, which requires bypassing authentication 2:23
• The "snatch and grab" technique involves running the obfuscated program, attaching a debugger, and taking memory snapshots when the program is functional 7:24
• Obfuscated programs typically use three methods: decrypting in place, creating new memory maps, or process hollowing variations 13:31
• The speaker explains how to identify valid code by analyzing stack return pointers and creating pointer arrays to find virtual function tables 19:01
• C++ destructor analysis is crucial for understanding object structures and how authentication mechanisms work 31:30

Atlas concludes by emphasizing the importance of understanding why tools work the way they do and creating new tools when necessary for effective reverse engineering 39:01.

Sources:

• 0:00 Introduction to the talk on reverse engineering automotive diagnostic tools
• 2:23 Goal of gaining remote code execution on vehicle ECUs
• 7:24 Explaining the "snatch and grab" technique
• 13:31 Common obfuscation methods in automotive tools
• 19:01 Techniques for