📚 OpenRCE is preserved as a read-only archive. Launched at RECon Montreal in 2005. Registration and posting are disabled.








Flag: Tornado! Hurricane!

 Forums >>  Brainstorms - General  >>  Release - BitBlaze's Vine

Topic created on: September 16, 2009 19:46 CDT by RolfRolles .

It's Christmas, kiddies.  I've had half of a post written from back when BAP was released discussing the prerequisites you need to understand such source code; hopefully I'll get some free time and finish it sometime relatively soon.  In the meantime, at a bare minimum you'll need to know OCaml; I suggest this book if you don't already know it.

  jumpzero     September 17, 2009 01:27.30 CDT
are you a member of bitblaze? i'm interested in bitblaze.. still i made a module that can work with bitblaze

  RolfRolles     September 17, 2009 01:33.27 CDT
I am not a member of BitBlaze, just a fan.  I don't know what you mean by "i made a module that can work with bitblaze".  What does it do?

  jumpzero     September 17, 2009 01:47.48 CDT
oh, sorry for my bad english, i meant that i made something that a part of bitblaze project does -unpacking- , and (theorically) has vice & virtue compared to the one of bitblaze.

i commented 'theorically' cuz i assumed bitblaze uses emulation when unpacking target, which i couldn't confirm, cuz when i threw a packed binary to bitblaze(themida) , it took a month to get a return mail from bitblaze, and i couldn't understand returned mail.

SO. wut i'm trying to say is i am interested in bitblaze's 'documents', but i couldn't try it for any reason it may be... (might be my fault not knowing how to use bitblaze.)

anyway i'm always reading your posts with very much impression, especially ones about reversing modern packers with virtual instructions., thanks for sharing

  RolfRolles     September 17, 2009 02:00.55 CDT
jumpzero:  sounds like you ought to read the Renovo paper thoroughly.

Everyone else:  since I may not have the time to write my blog entry about the prerequisites for reading BAP/VINE soon, here's the abbreviated version:

Be forewarned that reading VINE or BAP requires knowledge of the following; I have suggested reading material inline.

* OCaml (at an advanced level)
* * explicit continuation-passing style
* * the module system
* * labeled/optional arguments
* * polymorphic variants
* * OCaml's weird OOP implementation

Read: "The functional approach to programming", and the OCaml manuals

* compiler theory
* * intermediate languages
* * data flow analysis
* * SSA form

Read: "Modern Compiler Implementation in ML", and "Advanced Compiler Design and Implementation"

* program analysis
* * lattice theory
* * formal semantics
* * weakest preconditions
* * symbolic execution
* * theorem proving
* * abstract interpretation

Read: "Introduction to Lattices and Order (2nd edition)", "Semantics with Applications: An Appetizer", "Principles of Program Analysis", "A Discipline of Programming", and every BitBlaze paper from start to finish.

Note: Registration is required to post to the forums.

There are 31,328 total registered users.


Recently Created Topics
[help] Unpacking VMP...
Mar/12
Reverse Engineering ...
Jul/06
let 'IDAPython' impo...
Sep/24
set 'IDAPython' as t...
Sep/24
GuessType return une...
Sep/20
About retrieving the...
Sep/07
How to find specific...
Aug/15
How to get data depe...
Jul/07
Identify RVA data in...
May/06
Question about memor...
Dec/12


Recent Forum Posts
Finding the procedur...
rolEYder
Question about debbu...
rolEYder
Identify RVA data in...
sohlow
let 'IDAPython' impo...
sohlow
How to find specific...
hackgreti
Problem with ollydbg
sh3dow
How can I write olly...
sh3dow
New LoadMAP plugin v...
mefisto...
Intel pin in loaded ...
djnemo
OOP_RE tool available?
Bl4ckm4n


Recent Blog Entries
halsten
Mar/14
Breaking IonCUBE VM

oleavr
Oct/24
Anatomy of a code tracer

hasherezade
Sep/24
IAT Patcher - new tool for ...

oleavr
Aug/27
CryptoShark: code tracer ba...

oleavr
Jun/25
Build a debugger in 5 minutes

More ...


Recent Blog Comments
nieo on:
Mar/22
IAT Patcher - new tool for ...

djnemo on:
Nov/17
Kernel debugger vs user mod...

acel on:
Nov/14
Kernel debugger vs user mod...

pedram on:
Dec/21
frida.github.io: scriptable...

capadleman on:
Jun/19
Using NtCreateThreadEx for ...

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit