Automation Techniques in C++ Reverse Engineering
summary
Method hooks malloc/free/realloc via DLL injection and records allocation metadata, then logs accesses either with DBI or with a custom page-fault tracking system that marks pages non-present and single-steps to capture reads/writes. Uses a fixed-size slab allocator to limit faults, a small x86 emulator/JIT and guard-page optimizations to reach millions of accesses per minute. Reports about 200 recovered structures, ~6,000 variable types set in IDA/Hex-Rays and tens of thousands of applied offsets.
AI-written summary · about
chapters (7)
- 0:00Start
- 24:26Focus on the Memory, not the Instructions
- 26:48Virtual Memory and Demand Paging
- 29:20Memory Tracing via Presence
- 36:39Target Specific Allocation Sites
- 41:45Dynamic Resolution of Argument Types
- 47:32Challenges
related talks
10mBacktraces in the mirror: mad science by secrets of elves & dwarves!!
44mHands Off and Putting SLAB/SLUB Feng Shui in a Blackbox
57mModern Linux C++ debugging tools - under the covers
01h 05mHow to Write a Heap Memory Profiler
35mDeep-Kernel Treasure Hunt: Finding exploitable structures in the Linux kernel
54mCatching Real-time Safety Violations in C++
37mHeap Layout Optimisation for Exploitation
58mMemory and C++ debugging at Electronic Arts