4 2 1 Christopher Domas The future of RE Dynamic Binary Visualization

I realized that you probably did have a product -- unfortunately that doesn't mean that the product works (not trying to imply anything about your product/company here; it's just (as you probably know) there many companies selling security solutions; and very few that seem to be selling security solutions that work...). Are you aware of: "Overcoming TPM by exploiting EFI overflow" [VIDEO] and: "Coreboot/bios malware": [LINK] It's an interesting use of TPM -- and sounds like a sound approach, assuming there aren't any bugs in the TPM software... which might be too big an assumption. I don't suppose any of your software is available as open source? Where can I/we learn more?

You might want to have a look at Bossard's presentation from defcon20 (2012?), "Hardware backdooring is possible": [LINK] He's done a few of these, so I might be getting them mixed up -- but the message is basically that x86 (and by extension amd64) is hopelessly broken due to legacy crap that sort of hides between the cpu, ram and devices (the software running on your cdrom drive, on the network or sound card...). Also related: 4 2 1 Christopher Domas The future of RE Dynamic Binary Visualization [VIDEO] [ed2: Skip to ~14-15 minutes to get to the good stuff, then go back and watch the whole thing :) software home page and demo download (I don't think there's anything new published): [LINK] [LINK] ed: More recent presentation, looks to be the same: [LINK] ] Again related to (but as far as I remember does not reference [edit: I was wrong, he does indeed reference this]): Black Hat USA 2010: Voyage of the Reverser: A Visual Study of Binary Species 1/5 [LINK] #HITB2013AMS D2T1 Sebastien Kaczmarek - Dreamboot - A UEFI Bootkit [LINK]

Have a look at Cantor Dust [1], a visual reverse-engineering program that is promising. The author says in a presentation [2] that CD is based on Cortesi's work. [1] [LINK] [2] [VIDEO] Here is a demo: [LINK]

Senseye really looks like "Cantor.Dust" ( [VIDEO] ). I wonder if c.d. has been an inspiration for it.

Yes. If you follow the link at the top of the page to the explanation post[1], it says at the bottom: > Veles visualizations were inspired by Christopher Domas’ talk from Derbycon 2012. > Check out the video of his presentation [VIDEO] . [1]: [LINK]

Most visual programming is two-dimensional. What if it were three-dimensional instead, arranged in some sort of [LINK] with [LINK] 's representing your modules/nodes, chosen according to the amount of connections they have with other modules/nodes, the connections styled and color coded, maybe even unobtrusive/discreetly animated to show the direction/speed/volume of signals/dataflow, width of datatypes/buses, all in an abstract fashion similar to the way large metro/rapid-transit systems are mapped? Able to encapsulate other modules/nodes, folding large graphs into one, popping into an [LINK] only on demand? Turnable/viewable from any direction you like, but usually snapping to some virtual 3D-grid, in say steps of 45° ? Zoomable? This is even usable the other way around for reasoning about stuff you have NO source code for. Like in [VIDEO] (skip to about 14m30sec, the show starts there) and [LINK] (same guy) and others, but similar [LINK] and even more so [LINK] That looks messy, but that is because it is in reverse, with no known sources. Now imagine how tidy it could look when done originally, from first principles. Your own cybernetic Zettelkasten/Memex/Dynabook/whatever in a world of common and open (architecture neutral) data & document formats, automagically tagging, indexing and sorting all your stuff. OFFLINE if you like to. Usable on conventional desktops, tablets, large surfaces, overlaid onto some augmented reality, VR, holographics, i don't care. With the end go

Like CantorDust by Christopher Domas@Batelle? [VIDEO] really blew my mind when I saw it. Btw. about 8 years later they finally delivered, by releasing it as plug-in for Ghidra! Yay! [LINK]

This is my favorite version of it: [VIDEO] Some people have taken this concept very far. Batelle's CantorDust (was?) a pretty fully developed 3D visualization software for binary packages utilizing many different views and filters with convenient UX for selecting blocks of code graphically and zooming in on the corresponding hex, or vice-versa. Edit: I looked very hard for this software about 6-12 months ago and couldn't find anything...it appeared to be vaporware. However, 'LargoLasskhyfv posted in this thread tree at the exact same time I did and noted that it was just released about 3 months ago as a plugin for Ghidra. I'm very excited to play around with it.

This demo does a fairly decent job of explaining how you'd use these kinds of visualizations: [VIDEO] Batelle's CantorDust combines the visualization concept with a convenient UX for selecting blocks of code graphically and zooming in on the corresponding hex, or vice-versa. The "devil is in the details" with respect to the UX for these kinds of tools. The visualization or 2D image by itself is somewhat less useful without being able to snap to the corresponding part of the hex or IDA/Ghidra disassembly. I do think adding a 3rd dimension to the visualization probably adds somewhat more utility as well. The recently released open source package for CantorDust seems to omit the 3D visualizations which were shown in the demo linked here.

Your post reminded me of the presentation on cantor.dust: [LINK] [VIDEO] - Christopher Domas The future of RE Dynamic Binary Visualization (very interesting presentation) Looks like there's even been a recently open sourced plugin for Ghidra released by Battelle: [LINK]

Thank you for the explanation. But initially I posted that in answer to [LINK] where someone asked about if it would make sense to clone/reimplement somthing like Genera. And I pointed out that maybe the next best thing would be [LINK] With the intent to not having to start from scratch, not necessarily using it as is, but to take inspiration from. Or not, and really pushing it forward instead, but that depends on so many factors. However, it is possible. Besides that, did you really have the impression 'innocent people' had to be warned of the consequences, wasted time, whatever? ;-) Furthermore, either Common Lisp is Common Lisp, or not. So what does it matter, if only few people ever used that? As soon as it's getting graphical there is nothing besides the two commercial vendors(so proprietary), and old McCLIM. So who really cares? There is Movitz and Mezzano, why should there be no effort to make Medley modern? Would McCLIM on steroids be better for SBCL and Clozure? Who knows? I for my part like to look deep into such things, to see how I can adapt the concepts(not necessarily code) into my dabblings on FPGAs. Sometimes I had my mind blown, by things I haven't seen before, didn't even know the possibility thereof. Learning new concepts, applying them. Like this [VIDEO] (not related to topic) Anyway, I like to go back into the roads not taken, to at least partially re-branch from there. There is much to learn from. From that what we have now, not so much.

Those are trigrams of all 3-byte sequences of binary executables arranged in a cube. Here are some more examples of that type of viz: [LINK] And here is a talk about binary visualization by the legend Christopher Domas, which is where I first saw it used: [VIDEO]

Also came up with the original ..cantor.dust.. binary visualization tool, which is a tool I never used directly but Chris' presentation of it in 2012 is still one of the coolest talks I've ever seen. [0] [LINK] [1] [VIDEO]

My introduction to his work was "The future of RE Dynamic Binary Visualization"[0] which completely blew me away. It still feels futuristic today, 13 years later. Novel UI/UX paradigms like this are slow to find widespread adoption, even when they're so clearly demonstrated to be such an ideal fit for their purpose. 0: [VIDEO]