Reversemode
Home
Friday, 03 September 2010
 
 
BYTES & WORDS
Reversemode's 2nd birthday PDF Print
Written by Rubén   
Saturday, 24 November 2007

Today but two years ago, I registered reversemode.com having uncertain purposes in my mind. 24 months later I do "Reversemode" for a living. To be honest I never expected such a situation so I would like to thank those companies that, despite I was ( I am actually ) a completely unknown researcher within the IT security industry, trust in me.

Blah, blah, blah...the paragraph above is enough non-technical content for a post so let's talk about interesting issues.

I've already got in my hands the book titled Advanced Windows Debugging.Below is my brief review.

WinDbg (*d) is the most powerful debugger ever. Nevertheless, under my point of view, there is a lack of a well-structured repository of documentation. You can read commands, tricks ,tutorials...on the web however, there is nothing similar to a centralized reference.
Advanced Windows Debugging addresses (AWD from now on) this issue. This book is a brilliant reference for developers and researchers who use windbg on a daily basis. AWD is mainly oriented towards user-mode debugging rather than kernel, explaining in detail how to identify and deal with common software problems such as memory corruptions, leaks, RPC... It's worth noting that AWD is not a security book strictly speaking. I mean its content are not directly related with exploits or something like that but the book explains pretty well how to correctly debug Windows Core Components, which is important while identifying/elaborating vulnerabilities.


AWD is for an intermediate/advanced public so a decent knowledge of Windows internals is highly recommended.
Perhaps the only thing I've missed is a chapter about kernel debugging :/ . Anyway, a well-written book highly recommended if you are either a researcher or a developer.

Btw, a paper titled "Exploiting Windows Audio Drivers" will be published in the next few days. This paper covers a novel method for elevating privileges by taking advantage of a Windows design weakness in addition to third-party insecure audio drivers. A couple of tools related will be also released. Stay tuned.

On November Apple and Trendmicro fixed some vulnerabilities reported by Reversemode, if you need further information take a look at "Advisories" section.

Last Updated ( Thursday, 17 January 2008 )
< Prev   Next >