[HES2013] Frida IRE – a tool for scriptable dynamic instrumentation in userland by Ole André Vadla Ravnås

Frida IRE (Interactive Reverse-engineering Environment) is an open source reversing tool focusing on scriptable dynamic instrumentation in userland. It runs on Windows, Mac, Linux and iOS.
In this talk, I will focus on live demos showing you how to use Frida’s scripting capabilities to explore live processes both locally and remote. I will also show how Frida potentially can be used to do stealthy instrumentation of paranoid processes protected by anti-debugging.

Audio available here : http://2013.hackitoergosum.org/presentations/Day2-02.Frida%20IRE%20-%20a%20tool%20for%20scriptable%20dynamic%20instrumentation%20in%20userland%20and%20evading%20anti-debugging%20techniques%20by%20Ole%20Andr%c3%a9%20Vadla%20Ravn%c3%a5s.mp3
More information about the conference :
https://www.hackitoergosum.org

Transcript

1. Frida  
   h(p://frida.github.io/  
   

   View Slide

2. Demo:  screencast  
   

   View Slide

3. Nomenclature  
   •  Debugger  
   •  Agent  
   •  Target  
   

   View Slide

4. Architecture  
   Python  
   hackito.py  
   hackito.js  
   frida-­‐python  
   frida-­‐core  
   Skype  
   frida-­‐agent  
   frida-­‐gum  
   hackito.js  
   

   View Slide

5. Demo:  a(ach()  
   

   View Slide

6. Demo:  enumerate_modules()  
   

   View Slide

7. Demo:  inspecFng  and  manipulaFng  
   funcFon  calls  
   

   View Slide

8. Demo:  communicaFng  with  a  target  
   process  
   

   View Slide

9. Example:  .NET  binding  
   

   View Slide

10. Example:  browser  plugin  
    

    View Slide

11. QuesFons?  
    

    View Slide

12. Thanks!  
    •  DocumentaFon:  h(p://frida.github.io/  
    •  Code:  h(p://github.com/frida  
    •  Chat:  #frida  @  FreeNode  
    

    View Slide