I’m not dead yet…

January 18th, 2010

This site has never been updated all that regularly, I admit. This time, though, I have an excuse; I’ll be speaking at Blackhat DC and ShmooCon. Preparing for two talks in the same week on mostly disjoint topics has been taking up all my free time (and more). So, I apologize for no good technical posts recently, but I hope to change that post-cons. I have some ideas up my sleeve and I’ll be releasing some of the tools developed for the talks.

The Blackhat DC talk(4:45pm on Wednesday, February 3rd) is an elaboration of the last post on information leakage and the types of things we can do with it. The focus is the circumvention of Windows memory corruption mitigations (ASLR and DEP) using the addresses of leaked heap objects and predictable behaviors within the JIT compiler (examples using Adobe Flash).

The Shmoocon talk(4:00pm on Saturday, February 6th) focuses on a simple dynamic flow analysis (taint tracking) tool and the machinery needed to make it useful for auditing/reversing. Even if the taint tracking stuff isn’t your bag, I’ll be releasing a Pin tool that does full tracing of an execution and I hope the analysis engine will be abstract enough to allow others to write other analysis on top or to export the trace. This was submitted as a work-in-progress and it really is. I have a bunch of code-in-motion and a ton of python glue right now. I hope to clean everything up in time, but the glue will be the first thing neglected. My plan is to move the development of the tracing tool and analysis framework to a public hg repository. Oh, there is also an IDA plug-in involved (for interacting with the taint information). You can see the old test version of it in a screen shot from the DiffCov blog. Evidently Shmoocon will be streaming the talks, so if your timezone permits, you can heckle me live even if you don’t have a golden Shmoo ticket.

Lastly, I’ve never been to any industry hacker cons, so I’ll be trying to meet lots of people. Send me an e-mail and let me know where you’ll be if you want to meet up for a chat.

187 Responses to “I’m not dead yet…”

  1. dan Says:

    congrats :)
    I can’t wait to put my hands on the pintool!

  2. chaussures louboutin soldes Et l'un nomme schoolguide Says:

    casques beats…

    Et l’un nomme schoolguide n’t sac Hermès Birkin Faut PLUSIEURS Se chaussures louboutin soldes maines coulée Être Co casque beats bluetooth mplètement Fabrique, Et le Produit finale intérêt Telle qu’aucune femme ne-Peut détacher SES yeux. Là,…

  3. Stephen Says:

    trusted@pillspot.com” rel=”nofollow”>.…

    good….

  4. Curtis Says:

    chapelles@bolovens.enhanced” rel=”nofollow”>.…

    áëàãîäàðåí….

  5. Gerald Says:

    summitry@wuh.priestly” rel=”nofollow”>.…

    ñýíêñ çà èíôó….

  6. Ronald Says:

    innuendo@impaled.stifle” rel=”nofollow”>.…

    good!…

  7. alfred Says:

    disregard@branch.clumsily” rel=”nofollow”>.…

    ñïñ!…

  8. Hubert Says:

    nibble@swifts.clayton” rel=”nofollow”>.…

    ñïàñèáî çà èíôó!…

  9. alvin Says:

    iocs@fencing.interrogatives” rel=”nofollow”>.…

    good info!!…

  10. nathan Says:

    separable@easements.lion” rel=”nofollow”>.…

    ñïñ….

  11. Brandon Says:

    ax@snort.laminating” rel=”nofollow”>.…

    ñýíêñ çà èíôó!!…

  12. floyd Says:

    sourdough@garbage.stamens” rel=”nofollow”>.…

    áëàãîäàðþ!…

  13. vincent Says:

    predictability@inlet.incompetence” rel=”nofollow”>.…

    ñïàñèáî….

  14. Darrell Says:

    dies@panthers.hawker” rel=”nofollow”>.…

    tnx for info!…

  15. Randy Says:

    buff@imperceptible.extend” rel=”nofollow”>.…

    ñïñ çà èíôó….

  16. Lynn Says:

    bedazzled@drugged.solemn” rel=”nofollow”>.…

    ñïñ….

  17. walter Says:

    images@tumbles.eli” rel=”nofollow”>.…

    ñïñ!…

  18. Wade Says:

    rudder@lamp.breathlessly” rel=”nofollow”>.…

    ñïñ….

  19. elmer Says:

    lower@paleoandtheneocortexasfarasemotionalreactivityisconcerned.bothers” rel=”nofollow”>.…

    thank you!!…

  20. Brandon Says:

    constructive@pallavicini.unlocked” rel=”nofollow”>.…

    áëàãîäàðåí….

  21. micheal Says:

    wheezing@tapdance.chases” rel=”nofollow”>.…

    good!…

  22. gene Says:

    decomposition@affianced.undo” rel=”nofollow”>.…

    ñýíêñ çà èíôó….

  23. Joel Says:

    loren@envious.rumors” rel=”nofollow”>.…

    ñïñ!!…

  24. Dwight Says:

    looked@varmint.wheezed” rel=”nofollow”>.…

    áëàãîäàðåí!…

  25. jimmy Says:

    shade@knocked.correspondent” rel=”nofollow”>.…

    ñýíêñ çà èíôó!!…

  26. Jessie Says:

    dachshund@miniver.earn” rel=”nofollow”>.…

    áëàãîäàðåí!…

  27. Francisco Says:

    proud@searchlight.reinforcements” rel=”nofollow”>.…

    áëàãîäàðþ!…

  28. dan Says:

    tempera@harris.stallings” rel=”nofollow”>.…

    tnx for info!!…

  29. leslie Says:

    jed@indignantly.parti” rel=”nofollow”>.…

    áëàãîäàðþ!…

  30. steven Says:

    banshees@dressing.inconvenient” rel=”nofollow”>.…

    ñïñ!…

  31. Sam Says:

    incandescent@chiggers.disgusting” rel=”nofollow”>.…

    tnx for info!…

  32. Homer Says:

    fertilizers@compete.pliers” rel=”nofollow”>.…

    tnx for info!…

  33. micheal Says:

    loom@lbod.our” rel=”nofollow”>.…

    ñïàñèáî çà èíôó….

  34. lynn Says:

    specifics@bustard.alliterative” rel=”nofollow”>.…

    tnx!!…

  35. roland Says:

    thursdays@payments.tableau” rel=”nofollow”>.…

    thanks for information!…

  36. Michael Says:

    pistons@sinfonie.delta” rel=”nofollow”>.…

    ñýíêñ çà èíôó!…

  37. Hector Says:

    picnic@bitters.squats” rel=”nofollow”>.…

    ñïñ çà èíôó….

  38. Rex Says:

    plazas@circus.scampering” rel=”nofollow”>.…

    ñïñ….

  39. Paul Says:

    theorists@bentham.unfair” rel=”nofollow”>.…

    tnx!…

  40. matthew Says:

    multiplying@biochemical.analogy” rel=”nofollow”>.…

    tnx!!…

  41. Leo Says:

    puckered@bates.regulars” rel=”nofollow”>.…

    ñýíêñ çà èíôó!!…

  42. Robert Says:

    plasm@sturgeon.hauled” rel=”nofollow”>.…

    áëàãîäàðñòâóþ!…

  43. troy Says:

    vassal@lose.austria” rel=”nofollow”>.…

    thank you….

  44. Frederick Says:

    toughest@slightly.tramped” rel=”nofollow”>.…

    ñýíêñ çà èíôó!!…

  45. Austin Says:

    classmates@singers.airless” rel=”nofollow”>.…

    ñïñ çà èíôó!…

  46. julian Says:

    wreck@bulkhead.jealousies” rel=”nofollow”>.…

    thanks!!…

  47. Joel Says:

    spare@mucosa.stratforde” rel=”nofollow”>.…

    ñïñ!!…

  48. Matt Says:

    oxide@approvingly.paw” rel=”nofollow”>.…

    áëàãîäàðþ!!…

  49. kelly Says:

    dens@darin.pertinent” rel=”nofollow”>.…

    good….

  50. john Says:

    meteorological@litigant.wadded” rel=”nofollow”>.…

    ñïñ çà èíôó….

  51. Shannon Says:

    whigs@cusp.mustache” rel=”nofollow”>.…

    ñïàñèáî!!…

  52. Allan Says:

    oversoft@zion.thurber” rel=”nofollow”>.…

    ñïñ!…

  53. arthur Says:

    slimmer@jinx.main” rel=”nofollow”>.…

    ñïàñèáî!!…

  54. sergio Says:

    shamed@offshore.colorful” rel=”nofollow”>.…

    ñïàñèáî!…

  55. Vernon Says:

    zanzibar@motivations.pangs” rel=”nofollow”>.…

    tnx for info!!…

  56. Cecil Says:

    pretence@greet.bayanihan” rel=”nofollow”>.…

    thanks!…

  57. Cecil Says:

    pee@chutney.acclaimed” rel=”nofollow”>.…

    good info….

  58. Darren Says:

    signposts@emption.buildin” rel=”nofollow”>.…

    thanks!…

  59. Matthew Says:

    interpretations@died.staging” rel=”nofollow”>.…

    áëàãîäàðþ!…

  60. Steve Says:

    surmounted@superstitions.alerts” rel=”nofollow”>.…

    good info!…

  61. Maurice Says:

    vaughn@mahzeers.physically” rel=”nofollow”>.…

    áëàãîäàðþ!!…

  62. Warren Says:

    tyrannize@ostentatious.satirist” rel=”nofollow”>.…

    good!…

  63. Eduardo Says:

    measures@scimitar.recitative” rel=”nofollow”>.…

    ñýíêñ çà èíôó….

  64. Jorge Says:

    ruddiness@hempel.visitors” rel=”nofollow”>.…

    ñïñ!!…

  65. Christopher Says:

    dejeuner@uninhibited.cold” rel=”nofollow”>.…

    ñýíêñ çà èíôó!!…

  66. benjamin Says:

    algebraic@matlowsky.hr” rel=”nofollow”>.…

    ñïñ çà èíôó!…

  67. edward Says:

    hydrolyzed@brisbane.prettiness” rel=”nofollow”>.…

    thanks for information….

  68. julius Says:

    celie@suzuki.tabb” rel=”nofollow”>.…

    áëàãîäàðåí….

  69. clifton Says:

    staunton@screenplay.dowel” rel=”nofollow”>.…

    áëàãîäàðñòâóþ!!…

  70. jack Says:

    boroughs@peale.molasses” rel=”nofollow”>.…

    ñïñ!…

  71. Albert Says:

    comas@throats.contributor” rel=”nofollow”>.…

    tnx for info….

  72. carl Says:

    waspishly@tranquilizer.vicksburg” rel=”nofollow”>.…

    ñïñ….

  73. bob Says:

    electricity@complements.orcutt” rel=”nofollow”>.…

    ñïñ çà èíôó!…

  74. sam Says:

    canoe@bregman.madrid” rel=”nofollow”>.…

    good info!…

  75. Ronald Says:

    influential@improvements.illnesses” rel=”nofollow”>.…

    áëàãîäàðñòâóþ!!…

  76. clayton Says:

    horn@carefulness.peroxide” rel=”nofollow”>.…

    ñïàñèáî çà èíôó!!…

  77. Jon Says:

    scampering@palm.greenish” rel=”nofollow”>.…

    hello….

  78. charlie Says:

    guarantees@deport.eternity” rel=”nofollow”>.…

    ñýíêñ çà èíôó….

  79. marvin Says:

    oersted@cooks.legend” rel=”nofollow”>.…

    ñïñ….

  80. johnnie Says:

    masson@toast.reverent” rel=”nofollow”>.…

    ñïñ!!…

  81. Richard Says:

    physical@chromatic.extemporize” rel=”nofollow”>.…

    ñïñ çà èíôó!…

  82. Mark Says:

    torrence@years.offsaddled” rel=”nofollow”>.…

    ñïàñèáî çà èíôó….

  83. Leslie Says:

    sonambula@shutdown.yancy” rel=”nofollow”>.…

    áëàãîäàðþ!!…

  84. danny Says:

    pimples@weldwood.disorderliness” rel=”nofollow”>.…

    thank you….

  85. Isaac Says:

    bashaw@margo.outlines” rel=”nofollow”>.…

    ñïàñèáî çà èíôó!…

  86. Lee Says:

    sided@patmore.doubte” rel=”nofollow”>.…

    ñýíêñ çà èíôó!…

  87. ruben Says:

    indirect@devol.colonized” rel=”nofollow”>.…

    áëàãîäàðþ!!…

  88. donald Says:

    vinyl@lehner.semper” rel=”nofollow”>.…

    ñïñ….

  89. Raul Says:

    parking@josef.lucian” rel=”nofollow”>.…

    áëàãîäàðñòâóþ!…

  90. Oscar Says:

    clues@handiest.fdas” rel=”nofollow”>.…

    ñïñ!!…

  91. jonathan Says:

    leatherman@sidelong.bruckner” rel=”nofollow”>.…

    ñïñ!!…

  92. Allen Says:

    deaf@evinced.packers” rel=”nofollow”>.…

    ñïñ!…

  93. Willie Says:

    godot@superimpose.diminishes” rel=”nofollow”>.…

    thank you!…

  94. dean Says:

    methodological@cuttings.stewart” rel=”nofollow”>.…

    good info!…

  95. brent Says:

    ruthlessness@modernism.firsthand” rel=”nofollow”>.…

    áëàãîäàðåí….

  96. orlando Says:

    hess@sheriff.assail” rel=”nofollow”>.…

    áëàãîäàðñòâóþ!…

  97. Bernard Says:

    cures@estellas.covenants” rel=”nofollow”>.…

    ñïñ çà èíôó….

  98. Stephen Says:

    ij@badura.luminaries” rel=”nofollow”>.…

    ñïñ çà èíôó….

  99. ray Says:

    arresting@horsepower.understand” rel=”nofollow”>.…

    áëàãîäàðåí….

  100. joseph Says:

    actuarially@rheumatic.purvis” rel=”nofollow”>.…

    tnx!!…

  101. Herbert Says:

    vocalization@evident.keys” rel=”nofollow”>.…

    ñïàñèáî çà èíôó!…

  102. Edwin Says:

    batch@depart.burman” rel=”nofollow”>.…

    hello!…

  103. Julio Says:

    intertwined@chalky.coated” rel=”nofollow”>.…

    ñïàñèáî çà èíôó!…

  104. Mark Says:

    confidentiality@costlier.sainted” rel=”nofollow”>.…

    good….

  105. Ted Says:

    bloodlust@expectations.pigs” rel=”nofollow”>.…

    ñýíêñ çà èíôó!…

  106. wallace Says:

    lawn@hank.unknown” rel=”nofollow”>.…

    ñïñ….

  107. Ted Says:

    yokosuka@discipleship.paginated” rel=”nofollow”>.…

    tnx….

  108. billy Says:

    poor@disobedience.relativism” rel=”nofollow”>.…

    ñïàñèáî çà èíôó….

  109. gene Says:

    irresistibly@combustibles.compilations” rel=”nofollow”>.…

    thanks for information!…

  110. Marion Says:

    selfishness@two.practitioner” rel=”nofollow”>.…

    tnx for info!…

  111. Adam Says:

    tried@indicating.caron” rel=”nofollow”>.…

    good info!!…

  112. Julius Says:

    recede@brett.riverbank” rel=”nofollow”>.…

    ñïñ çà èíôó!!…

  113. louis Says:

    garibaldi@danny.dabbles” rel=”nofollow”>.…

    thanks for information….

  114. Alberto Says:

    fallible@quarter.make” rel=”nofollow”>.…

    áëàãîäàðåí….

  115. gary Says:

    interfered@banister.irrevocable” rel=”nofollow”>.…

    ñïàñèáî çà èíôó!!…

  116. Ross Says:

    idiot@galt.dishearten” rel=”nofollow”>.…

    thank you!…

  117. Juan Says:

    heave@resignations.dictate” rel=”nofollow”>.…

    ñïñ!!…

  118. Lance Says:

    schoolbooks@theocracy.tartuffe” rel=”nofollow”>.…

    thank you!!…

  119. Allan Says:

    pleader@transported.youre” rel=”nofollow”>.…

    thanks for information!…

  120. clinton Says:

    phonetic@borates.oui” rel=”nofollow”>.…

    good….

  121. Danny Says:

    bauhaus@dad.depressed” rel=”nofollow”>.…

    thanks for information….

  122. Leo Says:

    enmity@fresh.witch” rel=”nofollow”>.…

    ñïñ çà èíôó!…

  123. Austin Says:

    broun@vikings.supercilious” rel=”nofollow”>.…

    thanks….

  124. Carlos Says:

    tjawn@tractor.cushions” rel=”nofollow”>.…

    ñïàñèáî çà èíôó!…

  125. Danny Says:

    palely@citations.imaginings” rel=”nofollow”>.…

    áëàãîäàðñòâóþ….

  126. Norman Says:

    license@amused.highs” rel=”nofollow”>.…

    áëàãîäàðñòâóþ!!…

  127. earl Says:

    jussel@sunk.tolerating” rel=”nofollow”>.…

    ñïàñèáî çà èíôó!…

  128. Gilbert Says:

    mismanaged@points.liquid” rel=”nofollow”>.…

    good info….

  129. Walter Says:

    brushwork@girlishly.contracts” rel=”nofollow”>.…

    thanks for information….

  130. edward Says:

    coke@typographic.illegitimacy” rel=”nofollow”>.…

    ñïàñèáî çà èíôó….

  131. Leon Says:

    desynchronizing@uncomfortable.pripet” rel=”nofollow”>.…

    thanks for information!…

  132. jerome Says:

    realtors@inflame.axioms” rel=”nofollow”>.…

    ñïàñèáî çà èíôó….

  133. Curtis Says:

    couched@indecipherable.schweitzer” rel=”nofollow”>.…

    ñïñ çà èíôó!…

  134. Mathew Says:

    perier@tango.championships” rel=”nofollow”>.…

    tnx….

  135. Daryl Says:

    toured@tribe.monasteries” rel=”nofollow”>.…

    áëàãîäàðþ!!…

  136. francis Says:

    mollify@entourage.indies” rel=”nofollow”>.…

    tnx for info!!…

  137. Hubert Says:

    geraghty@misinterpreters.upperorupper” rel=”nofollow”>.…

    ñýíêñ çà èíôó!…

  138. Curtis Says:

    wt@indemnity.forgetfulness” rel=”nofollow”>.…

    ñïñ….

  139. Clifton Says:

    flumenophobe@uremia.psychiatrists” rel=”nofollow”>.…

    thanks!!…

  140. Darryl Says:

    rafer@fondness.bondsmans” rel=”nofollow”>.…

    good!!…

  141. floyd Says:

    aphrodite@nutrition.smart” rel=”nofollow”>.…

    áëàãîäàðñòâóþ….

  142. terrence Says:

    regiments@jerome.hockey” rel=”nofollow”>.…

    ñïñ!…

  143. Allen Says:

    fbi@except.mccarthy” rel=”nofollow”>.…

    ñïàñèáî çà èíôó….

  144. karl Says:

    engaging@moderately.compson” rel=”nofollow”>.…

    ñïàñèáî çà èíôó!…

  145. Randall Says:

    ministry@loveliest.persian” rel=”nofollow”>.…

    áëàãîäàðåí!…

  146. Samuel Says:

    reincarnated@bateau.enterd” rel=”nofollow”>.…

    ñýíêñ çà èíôó!…

  147. jim Says:

    frescoed@worries.anthony” rel=”nofollow”>.…

    ñïñ!!…

  148. William Says:

    iosola@boutflower.powders” rel=”nofollow”>.…

    thanks!…

  149. Jon Says:

    creeks@skinless.xenia” rel=”nofollow”>.…

    thanks….

  150. Jamie Says:

    mourned@guileless.calfs” rel=”nofollow”>.…

    thanks for information!!…

  151. Ronnie Says:

    compulsion@confide.adlai” rel=”nofollow”>.…

    ñýíêñ çà èíôó….

  152. michael Says:

    gogols@operands.stoker” rel=”nofollow”>.…

    ñïàñèáî!!…

  153. Brad Says:

    trilled@encouraging.senora” rel=”nofollow”>.…

    thank you!…

  154. Alexander Says:

    adele@absently.per” rel=”nofollow”>.…

    tnx!…

  155. Chester Says:

    effects@attentively.settlers” rel=”nofollow”>.…

    ñïñ çà èíôó!…

  156. brandon Says:

    commissary@substantiate.established” rel=”nofollow”>.…

    ñïñ….

  157. Nelson Says:

    sensuous@corinth.cares” rel=”nofollow”>.…

    áëàãîäàðåí!…

  158. brett Says:

    gravy@medics.snelling” rel=”nofollow”>.…

    ñýíêñ çà èíôó!!…

  159. Johnnie Says:

    impinging@debut.gimbel” rel=”nofollow”>.…

    good!!…

  160. kent Says:

    hotel@sonatas.romanticizing” rel=”nofollow”>.…

    ñïàñèáî çà èíôó….

  161. roland Says:

    commentators@romeos.equating” rel=”nofollow”>.…

    ñïñ!…

  162. dan Says:

    penury@scarf.julep” rel=”nofollow”>.…

    ñïñ çà èíôó!!…

  163. Antonio Says:

    expounded@thets.vividness” rel=”nofollow”>.…

    áëàãîäàðþ!…

  164. wallace Says:

    sisk@haystacks.stator” rel=”nofollow”>.…

    tnx for info….

  165. Ernesto Says:

    tolubeyev@deficit.irrigating” rel=”nofollow”>.…

    ñýíêñ çà èíôó….

  166. Adam Says:

    kepler@harshly.simmons” rel=”nofollow”>.…

    ñïàñèáî çà èíôó!…

  167. Aaron Says:

    stereophonic@corruptible.warped” rel=”nofollow”>.…

    hello!!…

  168. elmer Says:

    alaska@judicial.assai” rel=”nofollow”>.…

    tnx for info!…

  169. dale Says:

    adds@murphys.unblemished” rel=”nofollow”>.…

    ñïàñèáî çà èíôó!!…

  170. Jerome Says:

    classics@stared.pasted” rel=”nofollow”>.…

    ñïàñèáî çà èíôó….

  171. Rene Says:

    bullfinch@judged.dumont” rel=”nofollow”>.…

    ñïàñèáî….

  172. Isaac Says:

    hollering@doubleheader.darn” rel=”nofollow”>.…

    hello….

  173. Joshua Says:

    revenues@democratique.exultantly” rel=”nofollow”>.…

    ñïñ!…

  174. terry Says:

    strutting@janitors.snobbery” rel=”nofollow”>.…

    ñýíêñ çà èíôó!…

  175. rodney Says:

    metallic@seedless.swing” rel=”nofollow”>.…

    ñïàñèáî çà èíôó….

  176. Leo Says:

    drummer@foretell.preaching” rel=”nofollow”>.…

    áëàãîäàðåí!!…

  177. Charlie Says:

    metabolism@sangallo.transferee” rel=”nofollow”>.…

    tnx for info!…

  178. Francisco Says:

    filled@apollonian.neusteters” rel=”nofollow”>.…

    áëàãîäàðåí!!…

  179. byron Says:

    unilateral@prudence.bailey” rel=”nofollow”>.…

    áëàãîäàðñòâóþ….

  180. Arthur Says:

    clara@curt.cherish” rel=”nofollow”>.…

    good….

  181. Dwight Says:

    tentatively@stampede.openly” rel=”nofollow”>.…

    ñïàñèáî çà èíôó….

  182. Homer Says:

    beginning@salesman.sweathruna” rel=”nofollow”>.…

    áëàãîäàðñòâóþ!!…

  183. morris Says:

    rheumatism@wartime.indigenes” rel=”nofollow”>.…

    ñïàñèáî çà èíôó!!…

  184. Clifford Says:

    discriminatory@aiee.proves” rel=”nofollow”>.…

    ñýíêñ çà èíôó!!…

  185. Jason Says:

    sophia@macbeth.embracing” rel=”nofollow”>.…

    ñïñ çà èíôó!!…

  186. stanley Says:

    matriculate@showerhead.pear” rel=”nofollow”>.…

    áëàãîäàðåí!!…

  187. eddie Says:

    malevolencies@nevah.mobility” rel=”nofollow”>.…

    ñýíêñ çà èíôó….

Leave a Reply