Ghost in the Shellcode 2015: Cloudfs writeup

Category: Forensics Points: 200

The file we were given if a pcapng file. To be able to read'it with scapy we need to convert it to pcap. The easiest way is to use tcpdump as so:

tcpdump -r cloudfs-31c938df3531611b82fddf0685784a2b67373305ec689015f193a555b756beb2 -w cloudfs.pcap

Use scapy to extract all icmp packets:

Augmenting Binary Analysis with Python and Pin

Reverse engineering typically involves activities ranging from reading disassembly output to playing with debuggers. However, an often overlooked technique is making use of dynamic binary analysis frameworks.

In this talk, we will be looking at Intel's solution, PIN, and walk through how just about anyone can make great use of it. We will discuss reasons why more people should use these tools, some novel uses (including finding bugs and solving ctf challenges automatically), and even introduce our own python bindings for Pin which will make writing pin tools a breeze. Automated binary analysis is an extremely useful technique and we feel that the use of Python and Pin will making jumping in less intimidating.

We will also demonstrate the ease of use by showing some real world examples and tackling some commonly seen issues when dealing with binary analysis.