In this presentation, we will introduce the new Linux Trace Toolkit Next Generation (LTTng) kernel tracer and its analysis counterpart, Linux Trace Toolkit Viewer (LTTV), a fully extensible text and graphical trace viewer. We will focus on how these tools can be used in the security field, particularly for reverse engineering.
It can be very useful to reverse engineer a software "black box". It can be a driver, a library or a multithreaded application : the tracer can log every interaction between the operating system and the "black box". It can help eluding sandboxes and debugger detectors due to its small performance impact compared to library wrappers and debuggers. It can collect every system call made by every program which can be later used for fuzzing.
It is not, however, limited to process examination : one could use the kernel instrumentation to reverse engineer a driver controlling a piece of hardware. This tracer should be seen as a system wide monitor for your system : It gives you the opportunity to monitor the hardware, the OS, the libraries and the programs and analyse the information with integrated plugins.
This presentation will explain how you can use LTTng and LTTV for reverse engineering and how you can extend it further.