DEFCON 17: Reverse Engineering By Crayon: Hypervisor Based Malware Analysis and Visualization

Danny Quist and Lorie M. Liebrock present VERA, a hypervisor-based tool for malware analysis, code visualization, and unpacking armored code.

Speakers: Danny Quist CEO, Offensive Computing Lorie M. Liebrock New Mexico Tech Computer Science Department Recent advances in hypervisor based application profilers have changed the game of reverse engineering. These powerful tools have made it orders of magnitude easier to reverse engineer and enabled the next generation of analysis techniques. We will also present and release our tool VERA, which is an advanced code visualization and profiling tool that integrates with the Ether Xen extensions. VERA allows for high-level program monitoring, as well as low-level code analysis. Using VERA, we'll show how easy the process of unpacking armored code is, as well as identifying relevant and interesting portions of executables. VERA integrates with IDA Pro easily and helps you to annotate the executable before looking at a single assembly instruction. Initial testing with inexperienced reversers has shown that this tool provides an order of magnitude speedup compared to traditional techniques. For more information visit: bit.ly/defcon17_information To download the video visit: bit.ly/defcon17_videos