Memory Eye

Presented at REcon 2011, July 10, 2011, 3 p.m. (30 minutes)

Reversing is usually done through code analysis. We propose a complementary approach, based on the analysis of a snapshot of the dynamic heap. This way we are able to reconstruct the major data structures used by the program, and even limited type reconstruc- tion for structures, arrays and linked lists. We illustrate this work on the Dwarf Fortress1 game, a very rich game (albeit with ascii graphics).


Presenters:

Links:

Similar Presentations: