This document discusses binary file formats and creating visual documentation. It notes that specifications are imperfect and there are security consequences. Formats have diverse properties like headers, signatures, offsets. Visual docs should be self-contained, for a defined audience, and remove unnecessary details. The goal is creating useful documentation based on reality. Questions are welcome.

1. Insomni’hack
Geneva, Switzerland
Ange Albertini
2014/03/21
funky PoCs & visual docs

2. http://corkami.com
reverse engineering
&
visual documentations

3. boring?
● file formats were supposed to be safe
○ public specs
○ open-source parsers
● {weirdness} == {exploits} ?
● software = parse, sanitize, recover

4. formats’ diversity 1/2
no header
● COM (1982), MBR (1982)
magic signature
● none: DOL (2001)
● 2: TIFF, PE
● 4: most standard
● >4: PNG, PDF

5. start offset:
● archives
● range: PDF
● mostly 0
special properties
● deprecated header: PE
● variable scanning direction: PDF
● multi-versions: BMP
● scanned chunk: JPEG
● no official names: ZIP
formats’ diversity 2/2

13. quine (relay)

15. polyglot

21. schizophren

23. misc

25. 128, 217, 255, 217,
128, 38, 1, 38

29. crypto-tology:
for anything crypto, ask @veorq
(coz he’s awesome)

41. conclusion
on binary formats

42. On binary formats
● specs far from perfect
● plenty of fun
● many consequences for infosec
○ unforeseen attack channels

44. on visual docs
http://pics.corkami.com
http://prints.corkami.com

45. disclaimer
no awards, no studies

50. goal
create useful
documentations
based on reality

51. posters
self-contained
● immediate ‘big picture’
● no roleplay gamebook

52. use common sense
and your own eyes

54. creativity?
give yourself time!
to fail!

60. define your audience
lower and upper limits

61. “you should add …”
see “setting a upper limit”

62. “too simple/simplified”?
1/ teach others, beginners, kids
2/ no more excuses for not knowing

63. remove the obvious
guessing doesn’t hurt

65. space
optimal separator

66. left right

67. left right

68. left right

71. no unnecessary extras
leave doors closed
(to be opened somewhere else)

72. requirements

73. a computer
a transparent tablecloth

75. http://src.corkami.com

76. @jaredcatkinson’s prefetch101

77. conclusion
on visual docs

78. On visual documentations
● it doesn’t hurt
● it’s not so hard
● requires time

79. Questions ?
thank YOU !
@angealbertini
✉ ange@corkami.com