RECON 2017 (Montreal) SLIDES (and other ARCHIVED slides)

[sh3dow]

Originally Posted by deepzero

Can anyone speculate why he used bochs over qemu for this?

from j00ru blog
"We decided to use Bochs because it is by far easier to write instrumentation for, i.e. it has a very intuitive and simple instrumentation API, documentation and examples you can use to cleanly and elegantly implement the desired logic. As far as we are concerned, hacking on qemu is much more difficult because of lacking instrumentation support and horribly written code."