Reverse engineering tool to fight cyber security attacks
BlackBerry has announced it is making available a free open-source tool for cyber security professionals, called PE Tree that significantly reduces the time and effort required to reverse engineer malware. The announcement demonstrates BlackBerry’s continued commitment to the cyber security community in the fight against constantly evolving cyber threats.
Reverse engineering of malware is an extremely time- and labour-intensive process, which can involve hours of disassembling and sometimes deconstructing a software program. The BlackBerry Research and Intelligence team initially developed this open source tool for internal use and is now making it available to the malware reverse engineering community.
“The cyber security threat landscape continues to evolve and cyber attacks are getting more sophisticated with potential to cause greater damage,” said Eric Milam, Vice President of Research Operations, BlackBerry.
“As cyber criminals up their game, the cyber security community needs new tools in their arsenal to defend and protect organisations and people. We’ve created this solution to help the cyber security community in this fight, where there are now more than 1 billion pieces of malware with that number continuing to grow by upwards of 100 million pieces each year.”
The PE Tree enables reverse engineers to view Portable Executable (PE) files in a tree-view using pefile and PyQt5, thereby lowering the bar for dumping and reconstructing malware from memory while providing an open-source PE viewer code-base that the community can build upon.
The tool also integrates with Hex-Rays’ IDA Pro decompiler to allow for easy navigation of PE structures, as well as dumping in-memory PE files and performing import reconstruction; critical in the fight to identify and stop various strains of malware. PE Tree was developed in Python and supports the Windows, Linux, and Mac operating systems. It can be installed and run as either a standalone application or an IDAPython plugin, allowing users to examine any executable Windows file and see what its composition is.
Also this week at Black Hat USA 2020, Kevin Livelli, BlackBerry’s Director of Threat Intelligence will be presenting on Decade of the RATs on 5th August at 7-7:40pm BST. BlackBerry will also be presenting a sponsored webinar about its partnership with Intel to stop cryptojacking malware, and drill down into BlackBerry Optics AI-based EDR technology for Linux.