When analyzing large binary objects such as process memory dumps, proprietary data files, container file formats, and network flow payloads, security researchers are limited by the tiny textual window a hex editor and common command line utilities typically provide.
To the uninitiated, these objects may appear to be homogeneous, but -- as reverse engineers know -- in reality they consist of many diverse parts: text, images, compressed data, encrypted regions, audio
samples, data structures, and much more. Some of these parts are instantly recognizable to a seasoned reverser, and the nature of others (e.g., compressed data) may be guessed when suitably depicted. Yet, visual classification remains arcane and unaided by convenient tools that would both present objects at a glance and help segment them.
The authors of this talk attempt to remedy this. The authors have laboriously gathered, cataloged, and studied forms of binary structure and will present a (concise) "visual dictionaries" of the binary structures you find in the wild and in the lab. You will see and understand the constituent parts found within binary objects, essential knowledge for the reverser, forensic analyst, and security researcher. You will be far better prepared to dissect proprietary data files, conduct memory forensics and
deeply analyze any large binary object you may encounter.
Sergey Bratus is a Research Assistant Professor at Dartmouth College, affiliated with Dartmouth's Institute for Security, Technology, and Society. His research interests include designing new operating system and hardware-based features to support more expressive and developer-friendly debugging, secure programming and reverse engineering primitives; Linux kernel security (kernel exploits, LKM rootkits, and hardening patches); data organization and other AI techniques for better log and traffic analysis; and various kinds of wired and wireless network hacking. Before coming to Dartmouth, he worked on statistical learning methods for natural text processing and information extraction at BBN Technologies. He has a Ph.D. in Mathematics from Northeastern University.