SecDocs Feed for author Jason Raber

[Slides] Reverse Engineering with Hardware Debuggers

Tue, 20 Sep 2011 20:26:13 +0200

Authors: Jason Cheatham Jason Raber
Tags: reverse engineering debugger debugging
Event: Black Hat USA 2010
Abstract: This is a brief tutorial of one of the reverse engineering tools (Hardware Emulator) used by the Air Force Research Laboratory to analyze application and driver code on x86 systems. It’s also a neat way to debug hypervisors!

[Video] QuietRIATT: Rebuilding the Import Address Table Using Hooked DLL Calls

Tue, 17 Aug 2010 06:17:51 +0200

Authors: Jason Raber Brian Krumheuer
Tags: reverse engineering
Event: Black Hat DC 2009

[Slides] QuietRIATT: Rebuilding the Import Address Table Using Hooked DLL Calls

Tue, 17 Aug 2010 06:17:50 +0200

Authors: Jason Raber Brian Krumheuer
Tags: reverse engineering
Event: Black Hat DC 2009

[Audio] QuietRIATT: Rebuilding the Import Address Table Using Hooked DLL Calls

Tue, 17 Aug 2010 06:17:49 +0200

Authors: Jason Raber Brian Krumheuer
Tags: reverse engineering
Event: Black Hat DC 2009

[Slides] Helikaon Linux Debuger

Tue, 21 Apr 2009 23:34:00 +0200

Authors: Jason Raber
Tags: debugger
Event: REcon 2008
Abstract: The Linux OS is not immune to malware and viruses. The reverse engineer is faced with fighting though anti-debugging protections when trying to understand these binaries. This can be a tedious and time consuming process. COTS debuggers, such as GDB and IDA Pro, are detected in Linux utilizing a variety of anti-debugging techniques. I have developed a stealthy Linux-driver-based debugger named "Helikaon" that will aid the reverse engineer in debugging a running executables without being detected. Guest Helikaon injects a jump at runtime from kernel land into a user mode running process rather than using standard debugger breakpoints like "INT 3" or DR0-DR7 hardware registers. Find out alternate techniques for dynamic analysis in the Linux environment.

[Video] Helikaon Linux Debuger

Tue, 21 Apr 2009 23:34:00 +0200