4 ms·
I was really pleased with the vgrep technique he used at the start to figure out what changed the map data. I often forget just how awesome our eyes are at spot
by HCIdivision17 11y ago
I was really pleased with the vgrep technique he used at the start to figure out what changed the map data. I often forget just how awesome our eyes are at spotting changing stuff at a glance and small datasets don't take long to manually look at.
Simply open the working RAM and look at it; lo and behold the thing is right there.
(There's some super spiffy things built on this idea, the one I was really excited to see come out was ..cantor.dust.. [0], which was never released.)
[0] https://sites.google.com/site/xxcantorxdustxx/ https://sites.google.com/site/xxcantorxdustxx/
EDIT: formatting
- fallat 11y agoWhoa. I can't tell if this is a joke, or 100% serious. I'm trying to find a download link because damn this looks cool. Thanks for sharing.
- HCIdivision17 11y agoTotally for real, but a bit of a vaporware. You can get a demo version from this reddit thread: https://www.reddit.com/r/ReverseEngineering/comments/1izity/cantordust_a_binary_visualization_tool https://www.reddit.com/r/ReverseEngineering/comments/1izity/...
- fallat 11y agoNow we reverse engineer the reverse engineering tool and create an open source version that can hook into /proc/mem and other streams instead of just files :)