Friday, March 4, 2011

Looking Into the Eye of the Bits

During the past four years I've been developing tools for research and implementation of a new type of software analysis. I've discussed these tools on a various occasions such as RECon2010, Nullcon2011 and DC9723.
The purpose of these tools is to recover internal implementation details using only passive memory analysis, and without requiring any disassembly.
These tools are now available under GPL license on the following links:
https://github.com/assafnativ/NativDebugging

The latest version of the presentation + WP is available in the SVN of pymint:
https://github.com/assafnativ/NativDebugging/tree/master/docs

For more details on the subject you are more than welcome to visit the websites of the kind conferences which gave me the place to mumble about my work:
http://nullcon.net/speakers/bakkar/
http://recon.cx/2010/speakers.html#memory
http://wiki.dc9723.org/wiki/Meetings

I'm currently looking for more places to spread my word, if you know of such, please contact me.

3 comments:

  1. any chance the lectures are recorded?

    ReplyDelete
  2. I mean, it's hard to get the full thing without some voice accompanying the presentation.

    ReplyDelete
  3. They supposed to upload the video sometime soon to:
    http://www.archive.org/search.php?query=subject%3A%22Recon+2010%22
    And to the NULLCon web site as well.
    I'll be drawing a similar presentation with some extra new stuff at SyScan@Singapor next month, so you can find me there.

    ReplyDelete