The original idea for hunter-seeker (HS) framework was based on research into fuzzing, instrumentation, automation, binning crashes and taint analysis that was lead I belive by Charlie Miller and/ir Ben Nagy (can't remember exactly now, apologies). It involved qemu variant hacked for propagating taint (temu/bitblaze (?)).

Let's start from the end :). The goal of the bug hunting process is a weaponized exploit ready for submission in a vuln aquisition program. In order to produce a weaponized exploit, exploitable crash must be available and a toolset for engineering the shellcode and a payload. I belive the best tool for this should rely on taint analysis. In order to produce an exploitable crash, a number of ordinary crashes should be generated and binned In order to produce a number of crashes, analysis sunject needs to be instrumented for exception detection and repeated processing of a mutated sample should be performed In roder to produce mutated samples, core samples need to be chosen based on the code coverage (code of new features and code working on input data (processing files, serving protocol requests) has high potential)

‍

[ C/C++ ] [ Python ] [ Qemu ] [ Assembly ]

TProbe is created to enable and support work of RE analysts in their analyses of software (i.e. cyber weapons) used in cyber operations. I've created it with my colleague back in 2017, it started even earlier, as part of our project within the polish chapter of the Honeynet Project. I think it was one of the first if not THE first introspective debugger that was in it's entirety outside the debugged OS.

TProbe significantly reduces analysis time by lowering barriers and delivering more data for analysis. Withdrawing from debugged environment increases the chance of evading anti-debugging techniques. It's almost impossible that software sample will alter it's behaviour in response to detecting your analysis.

Providing memory view from perspective of kernel and other processes means that you need only one tool to analyse all the operations performed in the analysis environment. You can change perspective from one process to another or to kernel perspective with a single click.Delivering ready-to-use data structures allows you to interpret memory easily and rapidly.

I wrote a series of introductory articles:

• TProbe - installation
• TProbe - functionality
• TProbe - tracking injected code
• TProbe - crossing the userspace / kernelspace border

‍

[ C ] [ Python ] [ Qemu ] [ Volatility ]