Reverse Engineering Microsoft Binaries - orkspace.net

More documents

Recommendations

Info

Why Me? The security research team at Determina reverse engineers most Microsoft patches, especially when vulnerability details are not publicly available. I have been reversing patches every month for the last 9 months, including a lot of patches for older vulnerabilities. The main challenge we've encountered is how to deal with the large volume of the patches and produce results quickly with limited resources.
Part I Scalable Reverse Engineering
Page 1 and 2: esreveR gnireenignE tfosorciM seira
Page 3 and 4: Overview In the next one hour, we w
Page 5: Why Microsoft Binaries? Most revers
Page 9 and 10: Scalable Reverse Engineering Revers
Page 11 and 12: Extracting the Binaries • CAB and
Page 13 and 14: Binary Database Current size of our
Page 15 and 16: Getting Symbols Microsoft provides
Page 17 and 18: Reverse Engineering Tools • IDA P
Page 19 and 20: BinDiff Demo MS05-039 Plug and Play
Page 21 and 22: Common Features of Microsoft Binari
Page 23 and 24: Reuse of Stack Frame Slots In non-o
Page 25 and 26: SBB Comparison Optimization The SBB
Page 27 and 28: Non-optimized code : Switch Optimiz
Page 29 and 30: Microsoft Hotpatching The Microsoft
Page 31 and 32: Part III Improving Your Tools
Page 33 and 34: Autoanalysis Algorithm The autoanal
Page 35 and 36: Autoanalysis Problems Code outside
Page 37 and 38: Data Disassembled as Code Solutions
Page 39 and 40: Stack Pointer Tracking Problems IDA
Page 41 and 42: IDA PDB Plugin • Source code incl
Page 43 and 44: Determina PDB Plugin Demo

Reverse Engineering Microsoft Binaries - orkspace.net

Create successful ePaper yourself

Delete template?

Save as template?