[HES2013] Frida IRE – a tool for scriptable dynamic instrumentation in userland by Ole André Vadla Ravnås

Frida IRE (Interactive Reverse-engineering Environment) is an open source reversing tool focusing on scriptable dynamic instrumentation in userland. It runs on Windows, Mac, Linux and iOS.
In this talk, I will focus on live demos showing you how to use Frida’s scripting capabilities to explore live processes both locally and remote. I will also show how Frida potentially can be used to do stealthy instrumentation of paranoid processes protected by anti-debugging.

Audio available here : http://2013.hackitoergosum.org/presentations/Day2-02.Frida%20IRE%20-%20a%20tool%20for%20scriptable%20dynamic%20instrumentation%20in%20userland%20and%20evading%20anti-debugging%20techniques%20by%20Ole%20Andr%c3%a9%20Vadla%20Ravn%c3%a5s.mp3
More information about the conference :
https://www.hackitoergosum.org

Transcript

1. Frida   h(p://frida.github.io/  
2. Demo:  screencast  
3. Nomenclature   •  Debugger   •  Agent   •  Target  
4. Architecture   Python   hackito.py   hackito.js   frida-­‐python   frida-­‐core   Skype   frida-­‐agent   frida-­‐gum   hackito.js  
5. Demo:  a(ach()  
6. Demo:  enumerate_modules()  
7. Demo:  inspecFng  and  manipulaFng   funcFon  calls  
8. Demo:  communicaFng  with  a  target   process  
9. Example:  .NET  binding  
10. Example:  browser  plugin  
11. QuesFons?  
12. Thanks!   •  DocumentaFon:  h(p://frida.github.io/   •  Code:  h(p://github.com/frida   •  Chat:  #frida  @  FreeNode