u/ezrakhin r/ReverseEngineering • Recommends
Christopher Domas The future of RE, Dynamic Binary Visualization
0:00 / 0:00
#cantordust#binaryvisualization#reverseengineering
4 2 1 Christopher Domas The future of RE Dynamic Binary Visualization
Adrian Crenshaw
40K subscribers • 9 videos on Hallway
- Recommended by 8 people: 7 on Hacker News and 1 in engineering communities.
- A classic. People kept recommending it from 2013 to 2026.
- Presented by Christopher Domas, security researcher
Intermediate. Assumes working knowledge.
58K views14 years ago8 recommendations
SecurityGraphics and audioReverse engineeringData visualization
Christopher Domas presents Cantor Dust, a tool that uses three-dimensional visualization to aid in the reverse engineering of binary files.
Video from Derbycon 2012. All videos, with downloads, can be found at this link shortly: irongeek.com/i.php?page=videos/derbycon2/mainlistWhy it's here
8 people recommend thisWhat people say. Recommended as a mind-blowing and futuristic demonstration of binary visualization that inspired several modern security and analysis tools.
e12eon Hacker News • Recommends
On “Introducing Ring -3 Rootkits: BIOS rootkit targeting vPro chipsets (2009) [pdf]”
…might be getting them mixed up -- but the message is basically that x86 (and by extension amd64) is hopelessly broken due to legacy crap that sort of hides between the cpu, ram and devices (the software running on your cdrom drive, on the network or sound card...). Also related: 4 2 1 Christopher Domas The future of RE Dynamic Binary Visualization link to this video [ed2: Skip to ~14-15 minutes to get to the good stuff, then go back and watch the whole thing :) software home page and demo download (I don't think there's anything new published): link link ed: More recent presentation, looks to be the same: link ] Again related to (but as far as I remember does not reference [edit: I was wrong, he…
LargoLasskhyfvon Hacker News • Recommends
On “Reverse Engineer Amazon's Whispersync”
Like CantorDust by Christopher Domas@Batelle? link to this video really blew my mind when I saw it. Btw. about 8 years later they finally delivered, by releasing it as plug-in for Ghidra! Yay! link
vanderZwanon Hacker News • Recommends
On “Assembly Hall of Shame”
Also came up with the original ..cantor.dust.. binary visualization tool, which is a tool I never used directly but Chris' presentation of it in 2012 is still one of the coolest talks I've ever seen. 0 link 1 link to this video
nerdsniperon Hacker News • Recommends
On “Spaghettifying DRAM”
My introduction to his work was "The future of RE Dynamic Binary Visualization"0 which completely blew me away. It still feels futuristic today, 13 years later. Novel UI/UX paradigms like this are slow to find widespread adoption, even when they're so clearly demonstrated to be such an ideal fit for their purpose. 0: link to this video
rckoepkeon Hacker News • Recommends
On “Reverse Engineer Amazon's Whispersync”
This is my favorite version of it: link to this video Some people have taken this concept very far. Batelle's CantorDust (was?) a pretty fully developed 3D visualization software for binary packages utilizing many different views and filters with convenient UX for selecting blocks of code graphically and zooming in on the corresponding hex, or vice-versa. Edit: I looked very hard for this software about 6-12 months ago and couldn't find anything...it appeared to be vaporware. However, 'LargoLasskhyfv posted in this thread tree at the exact same time I did and noted that it was just released about 3 months ago as a plugin for Ghidra. I'm very excited to play around with it.
rckoepkeon Hacker News • Recommends
On “Visualizing binaries with space-filling curves (2011)”
This demo does a fairly decent job of explaining how you'd use these kinds of visualizations: link to this video Batelle's CantorDust combines the visualization concept with a convenient UX for selecting blocks of code graphically and zooming in on the corresponding hex, or vice-versa. The "devil is in the details" with respect to the UX for these kinds of tools. The visualization or 2D image by itself is somewhat less useful without being able to snap to the corresponding part of the hex or IDA/Ghidra disassembly. I do think adding a 3rd dimension to the visualization probably adds somewhat more utility as well. The recently released open source package for CantorDust seems to omit the 3D visualizatio…
stack_underflowon Hacker News • Recommends
On “Plain Text Protocols”
Your post reminded me of the presentation on cantor.dust: link link to this video - Christopher Domas The future of RE Dynamic Binary Visualization (very interesting presentation) Looks like there's even been a recently open sourced plugin for Ghidra released by Battelle: link
mk_stjameson Hacker News • Recommends
On “Sci-Fi Interfaces: Hackers (1995)”
Those are trigrams of all 3-byte sequences of binary executables arranged in a cube. Here are some more examples of that type of viz: link And here is a talk about binary visualization by the legend Christopher Domas, which is where I first saw it used: link to this video
u/galarisin r/ReverseEngineering • Mentions
Cantor.dust. - a binary visualization tool
I'm surprised that this was not posted here before.
From their site :
>cantor.dust.. is an interactive binary visualization tool, a radical evolution of the traditional hex editor. By translating >binary information to a visual abstraction, reverse engineers and forensic analysts can sift through mountains of >arbitrary data in seconds. Even previously unseen instruction sets and data formats can be easily located and >understood through their visual fingerprint.
Presentation video @ Derbycon
Official site
Pics.
Download demo.
e12eon Hacker News • Mentions
On “Google confirms Java and OpenSSL crypto PRNG on Android are broken”
I realized that you probably did have a product -- unfortunately that doesn't mean that the product works (not trying to imply anything about your product/company here; it's just (as you probably know) there many companies selling security solutions; and very few that seem to be selling security solutions that work...). Are you aware of: "Overcoming TPM by exploiting EFI overflow" link to this video and: "Coreboot/bios malware": link It's an interesting use of TPM -- and sounds like a sound approach, assuming there aren't any bugs in the TPM software... which might be too big an assumption. I don't suppose any of your software is available as open source? Where can I/we learn more?
fenollpon Hacker News • Mentions
On “Visualizing Entropy in Binary Files”
Have a look at Cantor Dust 1, a visual reverse-engineering program that is promising. The author says in a presentation 2 that CD is based on Cortesi's work. 1 link 2 link to this video Here is a demo: link
luchon Hacker News • Mentions
On “I wrote a display server, a desktop environment, and a debugging/reversing tool”
Senseye really looks like "Cantor.Dust" ( link to this video ). I wonder if c.d. has been an inspiration for it.
tekacson Hacker News • Mentions
On “Binary data visualization”
Yes. If you follow the link at the top of the page to the explanation post1, it says at the bottom: > Veles visualizations were inspired by Christopher Domas’ talk from Derbycon 2012. > Check out the video of his presentation link to this video . 1: link
LargoLasskhyfvon Hacker News • Mentions
On “Ask HN: Why isn’t visual programming a bigger thing?”
…e mapped? Able to encapsulate other modules/nodes, folding large graphs into one, popping into an link only on demand? Turnable/viewable from any direction you like, but usually snapping to some virtual 3D-grid, in say steps of 45° ? Zoomable? This is even usable the other way around for reasoning about stuff you have NO source code for. Like in link to this video (skip to about 14m30sec, the show starts there) and link (same guy) and others, but similar link and even more so link That looks messy, but that is because it is in reverse, with no known sources. Now imagine how tidy it could look when done originally, from first principles. Your own cybernetic Zettelkasten/Memex/Dynabook/whatever i…
LargoLasskhyfvon Hacker News • Mentions
On “Ergonomics of the Symbolics Lisp Machine (2014)”
…CLIM on steroids be better for SBCL and Clozure? Who knows? I for my part like to look deep into such things, to see how I can adapt the concepts(not necessarily code) into my dabblings on FPGAs. Sometimes I had my mind blown, by things I haven't seen before, didn't even know the possibility thereof. Learning new concepts, applying them. Like this link to this video (not related to topic) Anyway, I like to go back into the roads not taken, to at least partially re-branch from there. There is much to learn from. From that what we have now, not so much.…