Binary art - funky PoCs & visual docs
0 likes2,314 views
This document discusses binary file formats and creating visual documentation. It notes that specifications are imperfect and there are security consequences. Formats have diverse properties like headers, signatures, offsets. Visual docs should be self-contained, for a defined audience, and remove unnecessary details. The goal is creating useful documentation based on reality. Questions are welcome.
Binary art - funky PoCs & visual docs
- 1. Insomni’hack Geneva, Switzerland Ange Albertini 2014/03/21 funky PoCs & visual docs
- 3. boring? ● file formats were supposed to be safe ○ public specs ○ open-source parsers ● {weirdness} == {exploits} ? ● software = parse, sanitize, recover
- 4. formats’ diversity 1/2 no header ● COM (1982), MBR (1982) magic signature ● none: DOL (2001) ● 2: TIFF, PE ● 4: most standard ● >4: PNG, PDF
- 5. start offset: ● archives ● range: PDF ● mostly 0 special properties ● deprecated header: PE ● variable scanning direction: PDF ● multi-versions: BMP ● scanned chunk: JPEG ● no official names: ZIP formats’ diversity 2/2
- 13. quine (relay)
- 15. polyglot
- 21. schizophren
- 23. misc
- 25. 128, 217, 255, 217, 128, 38, 1, 38
- 29. crypto-tology: for anything crypto, ask @veorq (coz he’s awesome)
- 42. On binary formats ● specs far from perfect ● plenty of fun ● many consequences for infosec ○ unforeseen attack channels
- 45. disclaimer no awards, no studies
- 50. goal create useful documentations based on reality
- 51. posters self-contained ● immediate ‘big picture’ ● no roleplay gamebook
- 52. use common sense and your own eyes
- 54. creativity? give yourself time! to fail!
- 60. define your audience lower and upper limits
- 61. “you should add …” see “setting a upper limit”
- 62. “too simple/simplified”? 1/ teach others, beginners, kids 2/ no more excuses for not knowing
- 63. remove the obvious guessing doesn’t hurt
- 66. left right
- 67. left right
- 68. left right
- 71. no unnecessary extras leave doors closed (to be opened somewhere else)
- 72. requirements
- 73. a computer a transparent tablecloth
- 78. On visual documentations ● it doesn’t hurt ● it’s not so hard ● requires time
- 79. Questions ? thank YOU ! @angealbertini ✉ [email protected]