loading...
Emulated Breakpoint Debugger and Data Mining Using Detours
Vancouver, BC, Canada October 28-October 31
DOI Bookmark: http://doi.ieeecomputersociety.org/10.1109/WCRE.2007.2514th Working Conference on Reverse En ...
 This Article 
 
PDF
HTML
 
 Share 
   
 Bibliographic References 
   
 Add to: 
 
Digg
Furl
Spurl
Blink
Simpy
Google
Del.icio.us
Y!MyWeb
 
 Search 
   
The ability to do dynamic analysis is a powerful tool in the arsenal of a reverse engineer. Sometimes a piece of code such as malware can employ anti- debugging or packing measures to make dynamic analysis difficult. We have instrumented Microsoft Detours into a stealthy debugger to emulate a breakpoint rather than using "INT 3" or DR0-DR7 hardware registers. Understanding code and data flow at a functional level can now be achieved by using an IDA Pro plug-in and the data mining feature that has been extended to Detours. `IF' is the tool that incorporates the emulated breakpoints and data mining capabilities.
Citation:
Jason Raber, Eric Laspe, "Emulated Breakpoint Debugger and Data Mining Using Detours," wcre, pp.271-272, 14th Working Conference on Reverse Engineering (WCRE 2007), 2007
Usage of this product signifies your acceptance of the Terms of Use.