RECON 2017 (Montreal) SLIDES (and other ARCHIVED slides)

[deepzero]

Bochspwn Reloaded: Detecting Kernel Memory Disclosure with x86 Emulation and Taint Tracking - Mateusz “j00ru” Jurczyk

recommended

Yes, great talk indeed. Can anyone speculate why he used bochs over qemu for this?

[sh3dow]

Originally Posted by deepzero

Can anyone speculate why he used bochs over qemu for this?

from j00ru blog
"We decided to use Bochs because it is by far easier to write instrumentation for, i.e. it has a very intuitive and simple instrumentation API, documentation and examples you can use to cleanly and elegantly implement the desired logic. As far as we are concerned, hacking on qemu is much more difficult because of lacking instrumentation support and horribly written code."