Part 3

Reverse Engineering for Security Investigations

GDB: observe security-relevant behavior

Catch a program decrypting its configuration, processing an unexpected input, accessing sensitive data or corrupting memory. Build a detailed understanding of debugging, execution state and observation effects. Distinguish behavior demonstrated in a controlled run from behavior established during the original incident.