CommSec D2 - PyREBox: Making Dynamic Instrumentation Great Again
summary
PyREBox is an open-source, Python-scriptable reverse engineering sandbox that instruments and debugs whole QEMU virtual machines using Volatility-style VM introspection without modifying the guest OS. The talk covers PyREBox’s architecture and internal workings, contrasts it with other tools, discusses challenges and solutions for Python-based fine-grained instrumentation, and demonstrates malware-analysis use cases (API call tracing, code coverage, IPC monitoring, unpacking) plus a set of newly released PyREBox and IDA Pro scripts.
AI-written summary · about
chapters (13)
- 0:00Start
- 3:37Frameworks based on emulation
- 5:03QEMU
- 6:14Some shortcomings...
- 9:50Some principles...
- 14:23Triggers
- 16:02Easy to compile, install
- 17:28PyREBox shell
- 31:18Script life-cycle
- 32:38Scripting
- 34:56Agent
- 36:10Malware Monitor
- 58:56What's next?
related talks
23mThe Convergence Of EBPF, Buildroot, And QEMU For Automated Linux Malware Analysis
02h 05mOvercoming Fear: Reversing With Radare2
45mFinding Vulnerabilities through Static Analysis and Scripting
01h 46mTutorial: Introduction to Reverse Engineering
39mShadow-Box v2: The Practical and Omnipotent Sandbox for ARM
01h 00mCode emulation ... radare2's ESIL
32mA new safe external debugger interface for CPython
40mMalware Reverse Engineering with PE Tree—OSS Inspired by COVID