From: Christoph Egger Date: Wed, 7 Oct 2015 16:24:38 +0000 (+0200) Subject: Moar stuff X-Git-Tag: FAU-2015-10-09~5 X-Git-Url: https://git.siccegge.de//index.cgi?p=talk%2Ffrida.git;a=commitdiff_plain;h=f7a9f6374a19ee0c7e9ee8dbf4e1946d751925f1 Moar stuff --- diff --git a/images/GPLv3.pdf b/images/GPLv3.pdf new file mode 100644 index 0000000..23449b1 Binary files /dev/null and b/images/GPLv3.pdf differ diff --git a/images/GPLv3.svg b/images/GPLv3.svg new file mode 100644 index 0000000..2e9d884 --- /dev/null +++ b/images/GPLv3.svg @@ -0,0 +1,26 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/images/LLVM.pdf b/images/LLVM.pdf new file mode 100644 index 0000000..6cf627a Binary files /dev/null and b/images/LLVM.pdf differ diff --git a/images/LLVM.svg b/images/LLVM.svg new file mode 100644 index 0000000..cbc881d --- /dev/null +++ b/images/LLVM.svg @@ -0,0 +1,1877 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/images/Qt.pdf b/images/Qt.pdf new file mode 100644 index 0000000..07c7e7b Binary files /dev/null and b/images/Qt.pdf differ diff --git a/images/Qt.svg b/images/Qt.svg new file mode 100644 index 0000000..68d4f37 --- /dev/null +++ b/images/Qt.svg @@ -0,0 +1,104 @@ + + + + + + image/svg+xml + + + + + + SVG generated by Lineform + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/images/frida.png b/images/frida.png new file mode 100644 index 0000000..2739a1f Binary files /dev/null and b/images/frida.png differ diff --git a/images/guile.pdf b/images/guile.pdf new file mode 100644 index 0000000..15a78a6 Binary files /dev/null and b/images/guile.pdf differ diff --git a/images/guile.svg b/images/guile.svg new file mode 100644 index 0000000..f4ea545 --- /dev/null +++ b/images/guile.svg @@ -0,0 +1,109 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + image/svg+xml + + + + + + + + + ( + ) + guile + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/vortrag.tex b/vortrag.tex index 4871e1b..a0cbe8c 100644 --- a/vortrag.tex +++ b/vortrag.tex @@ -17,7 +17,7 @@ \documentclass[12pt]{beamer} \usepackage{BeamerColor} - +\usepackage{textcomp} %% Beamer Layout %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% \useoutertheme[subsection=false,shadow]{miniframes} \setbeamertemplate{footline}[frame number] @@ -50,7 +50,7 @@ %\usemintedstyle{trac} %\usemintedstyle{monokai} \setbeamerfont{frametitle}{size=\huge} -\setcounter{tocdepth}{1} +\setcounter{tocdepth}{2} \usepackage{booktabs} \usepackage{multirow} %use biblatex instead of bibtex @@ -62,10 +62,9 @@ %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% \begin{document} -\renewcommand{\inserttotalframenumber}{\pageref{lastslide}} +%\renewcommand{\inserttotalframenumber}{\pageref{lastslide}} %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% -%\section{\scshape Einführung} \begin{frame}[plain] \title{FrIDa} \subtitle{A Free and Interactive Disassembler} @@ -95,26 +94,148 @@ \titlepage \end{frame} +\AtBeginSection[] +{ + \begin{frame} + \frametitle{Table of Contents} + \tableofcontents[currentsection] + \end{frame} +} + +\begin{frame} + \centering + \includegraphics[width=.7\textwidth]{images/frida} +\end{frame} + +\begin{frame}{FrIDa} + \begin{columns}[T] + \begin{column}[T]{5em} + \includegraphics[width=\textwidth]{images/GPLv3} + \end{column} + \begin{column}{23em} + \url{https://www.frida.xyz}\\ + \url{https://doc.frida.xyz}\\ + \url{https://projects.faui2k9.de/tag/frida/} + \end{column} + \end{columns} +\bigskip + \begin{tabular}[ht]{lcr} + \parbox{3.0cm}{ + \centering + \includegraphics[width=3.0cm]{images/LLVM} + } & + \parbox{4.0cm}{ + \centering + \includegraphics[width=3.5cm]{images/guile} + } & + \parbox{3.0cm}{ + \centering + \includegraphics[width=2.5cm]{images/Qt} + } + \end{tabular} +\end{frame} + \begin{frame}{Overview} \tableofcontents{} \end{frame} \section{Current State} +\subsection{Disassembler Core} +\begin{frame}{Disassembler Core} + \begin{itemize} + \item Recursive Disassembler + \item MachO / PE / ELF handling + \item Whatever ISA LLVM supports, frida supports (x86, arm, POWER, + mips, \dots{}) + \item Use Symbols when available, still find \texttt{\_start} if not + \item Assembly dialect suckless\texttrademark{} configurable + \end{itemize} +\end{frame} -\begin{frame} - +\subsection{GUI} +\begin{frame}{GUI} + \begin{itemize} + \item Classical Control-Flow Diagram + \item Hyperlinked references + \item Automagic Layout + \item Grouping for functions + \end{itemize} \end{frame} -\section{Technical Overview} +\subsection{Scripting} +\begin{frame}{Scripting} + \begin{itemize} + \item Plugin Interface, Plug your own! + \item GUILE bindings with access to the core datastructures + \begin{itemize} + \item Full geiser support (Connect your editor to frida when + writing scripts)! + \item Missing: wrapper for nicer interface + \end{itemize} + \item iPython currently explored + \begin{itemize} + \item Qt IPython Widget + \item Alternative socket connection + \end{itemize} + \end{itemize} +\end{frame} -\begin{frame} - +\section{Design Overview} +\subsection{Serialization} +\begin{frame}{Serialization} + \begin{itemize} + \item Storing \emph{Facts} (and later \emph{Patches}) for the Binary + \item ZIP archive with base state and linear sequence of + transactions + \begin{itemize} + \item Each transaction with enough information to reverse-apply it + \item Transactions can not only be written to disk but also + e.\,g. sent over the network to remote viewers + \end{itemize} + \end{itemize} +\end{frame} + +\subsection{QSignals} +\begin{frame}{QSignals} + \begin{itemize} + \item Only option really for the GUI part + \item Properly handles passing messages between + (Q)Threads. Disassembler already runs asyncron to the GUI and the + interpreter + \end{itemize} +\end{frame} + +\subsection{Scripting} +\begin{frame}{Scripting} + \begin{itemize} + \item Keep complex logic out of the core as far as possible + \begin{itemize} + \item finding probably functions in the text section + \item Detecting structure of \texttt{libgcc\_s} \texttt{\_start} + \end{itemize} + \end{itemize} \end{frame} \section{Vision} +\begin{frame}{Vision} + \begin{itemize} + \item LLDB + \item clang-based indexing of \texttt{/usr/include} + \item Calculation of Path-Conditions + \item XMPP PubSub based Multiplayer mode + \end{itemize} +\end{frame} -\begin{frame} - +\begin{frame}{Name Wanted} + \begin{block}{} + Mit der AS/400-Standardsoftware Frida 4.0 \dots + \end{block} + \begin{block}{} + Frida Software: FRamework for Image Dataset Analysis + \end{block} + \begin{block}{} + Frida: Inject JavaScript to explore native apps on Windows, Mac, Linux, iOS and Android + \end{block} \end{frame} \begin{frame}{Questions?} @@ -127,6 +248,4 @@ Download: https://static.siccegge.de/talks/frida-FAU-2015-10-09.pdf\\ https://git.siccegge.de/?p=talk/frida.git \end{frame} - - \end{document}