Win at Reversing Tracing and Sandboxing Through Inline Hooking
Nick Harbour explores win at reversing tracing and sandboxing through inline hooking at DEF CON 17, examining malware-analysis and practical defenses.
Summary
Architecture and Background
Win at Reversing: Tracing and Sandboxing through Inline Hooking Nick Harbour Principal Consultant, Mandiant This presentation will discuss a new free tool for Reverse Engineering called API Thief, the "I Win" button for malware analysis. The unique way the tool operates will be explored as well as how it is able to provide better quality data than other tracing tools currently available.
Vulnerability Analysis
Advanced usage of the tool for malware analysis will be demonstrated such as Sandboxing functionality and a new technique for automated unpacking. Nick Harbour is a Principal Consultant with Mandiant.
Exploitation and Demonstrations
He specializes in Malware Analysis and Incident Response as well as both offensive and defensive research and development. He also teaches malware analysis and reverse engineering.
Remediation and Defensive Strategies
Nick's ten year history in the security industry began as a researcher and forensic examiner at the DoD Computer Forensics Lab (DCFL) where he helped pioneer the field of computer forensics. Nick is a developer of both free software including most notably dcfldd, the popular forensic disk imaging tool, tcpxtract, a tool for carving files out of network traffic and Mandiant Red Curtain and FindEvil, tools for identifying malicious binaries. He is also an expert in anti-reverse engineering technologies and has developed binary hardening tools such as PE-Scrambler. Nick is also a trained chef! For copies of the slides and additional materials please see the DEF CON 17 Archive here:
Related talks
Main Stage·20 min
Summit Siddharth
Summit Siddharth explores the making of the second sql injection worm at DEF CON 17, examining malware-analysis and practical defenses.
Main Stage·43 min
Sean Taylor
Sean Taylor explores binary obfuscation from the top down at DEF CON 17, examining malware-analysis and practical defenses.
Main Stage·20 min
Marion Marschalek
Marion Marschalek explores a thorny piece of malware and me at DEF CON 21, examining malware-analysis and practical defenses.