Decompiling kernel drivers and IDA plugins

Presented at REcon 2011, July 8, 2011, 2 p.m. (60 minutes)

In the practice of reverse engineering, full program decompilation is often seen as an extreme measure. While it is a time consuming process, we believe that it can be instructive and conducive to improving one's analytical skills. For this talk, we will first describe the steps conceptually involved in manual decompilation, and then demonstrate our techniques and experience in manually decompiling user- and kernel-mode code. While at it, we will also discuss relevant IDA tips and tricks and ways to improve Hex-Rays' automatic decompilation output. The targets we decompiled include both malware and standard operating system drivers.

Presenters:

• Tavis Ormandy
• Rolf Rolles
• Bruce Dang

Links:

• https://recon.cx/2011/schedule/events/104.en.html

Similar Presentations:

• DeepSec 2019 „Internet of Facts and Fears“ / RevEngE is a dish served cold: Debug-Oriented Malware Decompilation and Reassembly
• ToorCon: Seattle 2008 / An Introduction to Decompilation and Keygenning
• DEF CON 27 (2019) / Get off the Kernel if you can't Drive