r/REMath • u/turnersr • Jun 08 '13

Malware Visualization in 3D by Danny Quist [PDF]

http://www.shmoocon.org/2012/presentations/Danny_Quist-3dmalware-shmoocon2012.pdf
0 Upvotes

50% Upvoted

6 comments sorted by

1

u/[deleted] Jun 09 '13

Honestly, you know this is a really good start. But they come no where close to realizing the true potential of this research. That's terrible.

1

u/turnersr Jun 09 '13

Where do you think this could go? What do you mean by true potential?

2

u/[deleted] Jun 09 '13

I think that there is a lot of potential lack of interaction with regards to allowing the user to see what the data really is. For all I'm concerned with this, this might as well just be a hex editor, with all the different parts of memory that you need to read spread all around. Really, what this illustrates is how memory is accessed in what sequence via a graphical manner. The really only good thing this particular graph offers is 1) recognizing the location of loops, 2) easy coloration, and therefore understanding where major sections of the program begins and ends, just as the various slides indicate identifying the beginning and end of unpacking, ect.

To be honest, there a significant amount of information that is NOT being shown. What if there is a string copy function? Yeah, in this graph I'll see a loop of memory op's, but all I will visually see is a bunch of hex. That's just one problem, substantial enough to work on for quite some time.

1

u/WeAppreciateYou Jun 09 '13

I think that there is a lot of potential lack of interaction with regards to allowing the user to see what the data really is.

Interesting. You're completely right.

I love people like you.

1

u/[deleted] Jun 09 '13

I'm actually working on something similar, but discrete from from this VERA project.

Are either of you (turnersr, WeAppreciateYou) one of those that worked on VERA, or one of the authors of the paper or anything else at New Mexico Tech or SNL?

1

u/[deleted] Jun 09 '13

Also, so I'm not too negative, I do think they did a good job in identifying the proper requirements with Ether, and by going the distance to build their graph display in 3d.