Tetrane's BLOG
Finding uses of cryptographic functions and the data encrypted by an application
How to find cryptography implemented by an application in a REVEN trace? Let’s explore two ways of doing so! Looking for known symbol calls REVEN provides several features related to symbol calls: The symbol search feature allows you to look throughout the entire trace to find calls to a specific...
HITBCyberWeek 2020 REVEN Lab replay
In November 2020, Tetrane presented a remote technical hands-on lab at HITB CyberWeek about timeless debugging and analysis. We are sharing the recording of the lab as it’s a good opportunity to discover the dynamic approach of REVEN: the type of questions a trace can provide answers to, how to...
Announcing REVEN version 2.7
Tetrane is pleased to announce the release of REVEN Enterprise and REVEN Professional 2.7. REVEN is an automated Reverse Engineering Platform designed to go x10 faster & x10 deeper using Timeless Analysis. Technically, REVEN captures a time slice of a full system execution (CPU, Memory, Hardware events) to provide unique...
Detecting Use-After-Free vulnerabilities using REVEN
15 Dec 2020
by
Louis
,Quentin
and Benoit
-
REVEN
-
Reverse Engineering
Vulnerability Detection
Analysis API
Taint
Reven
Tetrane’s Timeless Debugging and Analysis (TDnA) allows to capture a time slice of the execution of a system (CPU, Memory, Hardware Events) and provides some powerful analysis features that speed up and scale the reverse engineering process. It can be combined with various fuzzing approaches that will drive the discovery...
Profiling Windows execution with system timeless analysis
An unused system is not a suspended system! Discover in this article how we measured some Windows 10 background activity with timeless analysis in various configurations. The multiple applications of system-wide timeless analysis range from the obvious, like “a debugger you don’t have to restart all the time”, the less...
Buffer overflow exploitation in Quick Player 1.3 (unicode & SEH)
In this article, we will talk about the exploitation of a buffer overflow in Quick Player 1.3 leading to an arbitrary code execution, and how we fixed an already existing exploit using REVEN. We will first present the exploit, then explain why it did not work at first, and how...
Announcing REVEN version 2.6
Tetrane is pleased to announce that the release of REVEN 2.6 Enterprise and Professional is available. REVEN is an automated Reverse Engineering Platform designed to go x10 faster & x10 deeper using Timeless Analysis. Technically, REVEN captures a time slice of a full system execution (CPU, Memory, Hardware events) to...
Interactive write-ups with REVEN and Jupyter
OK, so you just recorded this nice trace of the latest malware-of-the-week, great! You went around the timeline in Axion, did some symbol search, it all looks very promising. Time to dive into the depths of the analysis… What was the name of that function again? The one that’s probably...
Timeless Full-System analysis with REVEN and WinDbg
REVEN 2.5 introduced a new integration between REVEN and Microsoft WinDbg. This integration brings WinDbg and REVEN closer together, allowing you to access a REVEN trace as if it were a live VM and benefit from REVEN’s full-system timeless analysis and full-fledged scripting API, together with WinDbg’s familiar debugger interface....
Getting ready for analysis with REVEN (3/3): Finalizing the Workflow
This video article is part of a series on virtual machine configuration for use with REVEN: Importing a VM Lightening the VM for more efficient scenario recording Finalizing the configuration workflow (this article) Today’s video contains the last, but not least steps required in the configuration of a VM for...
Older Posts
