4 2 1 Christopher Domas The future of RE Dynamic Binary Visualization

You might want to have a look at Bossard's presentation from defcon20 (2012?), "Hardware backdooring is possible": [LINK] He's done a few of these, so I might be getting them mixed up -- but the message is basically that x86 (and by extension amd64) is hopelessly broken due to legacy crap that sort of hides between the cpu, ram and devices (the software running on your cdrom drive, on the network or sound card...). Also related: 4 2 1 Christopher Domas The future of RE Dynamic Binary Visualization [VIDEO] [ed2: Skip to ~14-15 minutes to get to the good stuff, then go back and watch the whole thing :) software home page and demo download (I don't think there's anything new published): [LINK] [LINK] ed: More recent presentation, looks to be the same: [LINK] ] Again related to (but as far as I remember does not reference [edit: I was wrong, he does indeed reference this]): Black Hat USA 2010: Voyage of the Reverser: A Visual Study of Binary Species 1/5 [LINK] #HITB2013AMS D2T1 Sebastien Kaczmarek - Dreamboot - A UEFI Bootkit [LINK]

Like CantorDust by Christopher Domas@Batelle? [VIDEO] really blew my mind when I saw it. Btw. about 8 years later they finally delivered, by releasing it as plug-in for Ghidra! Yay! [LINK]

Also came up with the original ..cantor.dust.. binary visualization tool, which is a tool I never used directly but Chris' presentation of it in 2012 is still one of the coolest talks I've ever seen. [0] [LINK] [1] [VIDEO]

My introduction to his work was "The future of RE Dynamic Binary Visualization"[0] which completely blew me away. It still feels futuristic today, 13 years later. Novel UI/UX paradigms like this are slow to find widespread adoption, even when they're so clearly demonstrated to be such an ideal fit for their purpose. 0: [VIDEO]

This is my favorite version of it: [VIDEO] Some people have taken this concept very far. Batelle's CantorDust (was?) a pretty fully developed 3D visualization software for binary packages utilizing many different views and filters with convenient UX for selecting blocks of code graphically and zooming in on the corresponding hex, or vice-versa. Edit: I looked very hard for this software about 6-12 months ago and couldn't find anything...it appeared to be vaporware. However, 'LargoLasskhyfv posted in this thread tree at the exact same time I did and noted that it was just released about 3 months ago as a plugin for Ghidra. I'm very excited to play around with it.

This demo does a fairly decent job of explaining how you'd use these kinds of visualizations: [VIDEO] Batelle's CantorDust combines the visualization concept with a convenient UX for selecting blocks of code graphically and zooming in on the corresponding hex, or vice-versa. The "devil is in the details" with respect to the UX for these kinds of tools. The visualization or 2D image by itself is somewhat less useful without being able to snap to the corresponding part of the hex or IDA/Ghidra disassembly. I do think adding a 3rd dimension to the visualization probably adds somewhat more utility as well. The recently released open source package for CantorDust seems to omit the 3D visualizations which were shown in the demo linked here.

Your post reminded me of the presentation on cantor.dust: [LINK] [VIDEO] - Christopher Domas The future of RE Dynamic Binary Visualization (very interesting presentation) Looks like there's even been a recently open sourced plugin for Ghidra released by Battelle: [LINK]

Those are trigrams of all 3-byte sequences of binary executables arranged in a cube. Here are some more examples of that type of viz: [LINK] And here is a talk about binary visualization by the legend Christopher Domas, which is where I first saw it used: [VIDEO]