Главная
Study mode:
on
1
Introduction
2
About Colin Lee
3
Binary Instrumentation
4
Observing Program Behavior
5
Code Cache
6
Dynamic Binary Instrumentation
7
Popular Tools
8
Transparency
9
Fuzzing
10
Run twice
11
Simple implementation artifacts
12
Checking the parent process
13
More clues
14
Another artifact
15
Summary
16
Quick Example
17
Fancy Examples
18
Simple Example
19
New Example
20
Initial Idea
21
What can we do
22
Developer feedback
23
Robin assays
24
Panning
25
Is it possible
26
The problem
27
Questions
28
Conclusion
Description:
Explore techniques for defeating the transparency feature of Dynamic Binary Instrumentation (DBI) systems in this Black Hat conference talk. Delve into the world of program analysis and malware detection as speakers Kang Li and Xiaoning Li demonstrate methods to break the transparency of popular DBI tools like DynamoRIO and PIN. Learn about specially crafted X86 instruction sequences that expose fundamental limitations of binary instrumentation and translation. Discover position-independent NOP sequences for evading detection and differentiating X86 decoders. Gain insights into the challenges faced by DBI tools, their importance in malware analysis, and the potential implications for program feature collection and virtual machine binary translations. Through various examples and demonstrations, understand the intricacies of binary instrumentation, code caching, and the artifacts that can reveal the presence of DBI systems.

Defeating the Transparency Feature of DBI

Black Hat
Add to list
0:00 / 0:00