{"id":322,"date":"2006-08-28T19:29:11","date_gmt":"2006-08-29T02:29:11","guid":{"rendered":"http:\/\/multimedia.cx\/eggs\/black-box-re\/"},"modified":"2006-10-28T14:00:09","modified_gmt":"2006-10-28T21:00:09","slug":"black-box-re","status":"publish","type":"post","link":"https:\/\/multimedia.cx\/eggs\/black-box-re\/","title":{"rendered":"Black Box Reverse Engineering"},"content":{"rendered":"

Reverse engineering an algorithm from binary code is tough enough. However, there is a larger issue of validation. One idea I have been thinking about for awhile is some method of hooking into an RE target during runtime and trapping data as it goes in and out of a particular function. The collected data would later be used as test vectors for the new implementation. However, it also occurred to me that this method could also be the RE tool itself. For example, if you are pretty sure that a particular piece of binary code operates as an inverse DCT, use the previously described method to observe data coming in and out. This can save you some trouble of tracing through a tedious stretch of code to determine that it actually is an IDCT. Plus, you can figure out if it is identical to, e.g., the standard MPEG\/JPEG IDCT.<\/p>\n

Colleague Benjamin Larsson noted that this would be referred to as black box reverse engineering.<\/p>\n


\n\"Black
\n<\/center><\/p>\n

Another basic application of this technique would be to monitor the bitstream parsing function for a given input bitstream. Many multimedia decoders delegate all of their bitstream parsing duties to a small number of functions and this would be a great way to validate that a new decoder is chopping up a bitstream in the correct manner.<\/p>\n

How to accomplish this? I recently sat down and actually read through<\/em> the entire GNU Debugger<\/a> manual to see what interesting features I might have been missing all these years. I discovered tracepoints. These apparently let you gather data about a program without stopping the program periodically. Unfortunately, I don’t think the facility is flexible enough to do what I outline above.<\/p>\n

Are there tools that can already do what is described here? Or will it take some custom tools? If it takes custom tools, I already have a head start with some of my experiments.<\/p>\n","protected":false},"excerpt":{"rendered":"

Reverse engineering an algorithm from binary code is tough enough. However, there is a larger issue of validation. One idea I have been thinking about for awhile is some method of hooking into an RE target during runtime and trapping data as it goes in and out of a particular function. The collected data would […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[],"class_list":["post-322","post","type-post","status-publish","format-standard","hentry","category-reverse-engineering"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t