Reverse Engineering Microsoft Binaries - orkspace.net

More documents

Recommendations

Info

Reverse Engineering Microsoft Binaries Alexander Sotirov asotirov@determina.com CanSecWest / core06
Overview In the next one hour, we will cover: • Setting up a scalable reverse engineering environment ○ getting binaries and symbols ○ reverse engineering tools • Common features of Microsoft binaries ○ compiler optimizations ○ hotpatching ○ exception handling • Improving your tools ○ IDA autoanalysis problems ○ loading debugging symbols ○ improving the analysis with IDA plugins
Page 1: esreveR gnireenignE tfosorciM seira
Page 5 and 6: Why Microsoft Binaries? Most revers
Page 7 and 8: Part I Scalable Reverse Engineering
Page 9 and 10: Scalable Reverse Engineering Revers
Page 11 and 12: Extracting the Binaries • CAB and
Page 13 and 14: Binary Database Current size of our
Page 15 and 16: Getting Symbols Microsoft provides
Page 17 and 18: Reverse Engineering Tools • IDA P
Page 19 and 20: BinDiff Demo MS05-039 Plug and Play
Page 21 and 22: Common Features of Microsoft Binari
Page 23 and 24: Reuse of Stack Frame Slots In non-o
Page 25 and 26: SBB Comparison Optimization The SBB
Page 27 and 28: Non-optimized code : Switch Optimiz
Page 29 and 30: Microsoft Hotpatching The Microsoft
Page 31 and 32: Part III Improving Your Tools
Page 33 and 34: Autoanalysis Algorithm The autoanal
Page 35 and 36: Autoanalysis Problems Code outside
Page 37 and 38: Data Disassembled as Code Solutions
Page 39 and 40: Stack Pointer Tracking Problems IDA
Page 41 and 42: IDA PDB Plugin • Source code incl
Page 43 and 44: Determina PDB Plugin Demo

Reverse Engineering Microsoft Binaries - orkspace.net

Create successful ePaper yourself

Delete template?

Save as template?