so yeah um I was asked to come do a
keynote here and I was obviously quite
uh appreciative that I was I was asked
to do such a thing
um I've not been to nocon Berlin before
I've been to the Goa Edition quite a few
times and I've always enjoyed it so it's
nice to be here in Berlin in a beautiful
weather that uh Germany's provided for
us
but yeah my keynote is basically uh
about security tooling and the types of
things that I write to make uh my life
as a security researcher just that
little bit easier
but I'd also want it to be sort of more
keynote less technical so of course it's
sort of a call to action kind of
presentation where I'm saying you should
do it too and I think that I do actually
believe that I think I write my tooling
and probably so should you if you do not
already so let's get on with the uh the
presentation
so for the people who don't know me I'm
James I'm a security researcher at
Google project zero
Google project zero if you don't know
who they are is the team at Google who
looks primarily at third-party
applications and tries to find security
vulnerabilities then get some fixed by
the vendor as quickly as possible on the
a 90-day disclosure deadline
and
obviously everyone has their
specialization in Project zero but my
specialization is Windows
and as part of that I write a lot of
tooling my
history in the industry is actually I
started as a developer
and it was only later that I came into
security so I've got a lot of experience
writing computer software and building
tools for various things
now
obviously from a tooling perspective
there's loads of different sort of
variations of it because I'm I primarily
focus on finding logical vulnerabilities
which are obviously not your
run-of-the-mill memory corruption
I don't tend to write fuzzers for
example so you will not see me talking
about how you write a fuzzing tool in
this but you can kind of assume that
this is the kind of thing that you can
also do like if you if you leave these
are the types of books you want to look
for memory correction then fuzzing is
also something you can do but logical
vulnerabilities are always more
interesting they're potentially harder
to find and that's why I find tooling to
be to be so important in my my research
process
[Music]
now of course most people are using
tools if you're a security researcher
especially if you're using uh doing
research on say windows where you do not
have much in the way of source code
regardless of what may be on GitHub at
any moment in time
um you would probably have to use a tool
such as either Pro or githra if you went
to the workshop yesterday maybe you now
know how to use gidra
um
and it's a tool right
um of course it allows you to
disassemble existing binaries and try
and find security vulnerabilities in
them
maybe your hands to do debugging maybe
you're trying to debug an export you're
trying to write it's not not working
quite right so you stick it in win bag
or in dvg depending on your your
preferences and you can debug your
applications and your vulnerabilities
and your exports
um or your writing code so
I actually have a habit of writing code
in notepad and don't criticize me
if them was installed by default I'd
definitely be using that but uh it tends
not to be on Windows but yeah you're
probably using an IDE such as digital CD
or vs code xcode
Etc
now yes all these are tools
but the key thing here is these aren't
really security specialized tools like
yes either Pro is kind of the closest
You could argue to something which is
um very much security related but of
course it's it's really a general
purpose tool for reverse engineering any
binary it doesn't matter if you're using
it for finding security vulnerabilities
so when I'm talking about tooling here
what I'm talking about is domain
specific tooling writing tooling which
is
defined in in the domain that you're
looking for that the security research
space and usually specifically targeted
at a specific particular area of
of your research process
now okay when I say writing tools of
course you may be thinking well
I'm not going to write my own special
customized version of either Pro because
it'd take me forever right it takes
hundreds of people well maybe not
hundreds of people in either Pro's case
but like many many hours of work to to
do even close to a tour of that that
size
so of course
you don't have to start out writing the
sort of Greater Great American novel and
security tooling you can just start
small start at the smallest rung and and
go from there
um so one area that obviously
is really easy to get into just writing
basic tooling is just sort of simple
automation of common tasks you have to
do during your research process
so if you're ever having to research on
Windows you're almost certainly going to
end up encountering Goods or globally
unique identifiers these are 16 byte
unique values which I just use
everywhere on Windows
um they they used to identify things
they'll be using database keys and all
that sort of stuff they're just
everywhere because
Microsoft never saw a problem which
couldn't be solved with a guide of some
kind
now either Pro will kind of do a good
job of like saying okay these are the
parts of that good structure it's
technically not an opaque 16 byte value
it has some structure to it
but most of the time when you don't want
to use that good of you need to have it
sort of in a string form
maybe you're trying to search on your
favorite search engine and try and try
and find any uses of this good
especially if it's like just embedded in
a binary somewhere
maybe it's in the registry and generally
you need this as a string
so you can do it you can manually copy
and paste out of either Pro and just go
right here's my here's my string but of
course that's potentially error Pro and
it's a lot of work and if you happen to
do this on a semi-regular basis it's
best to try and automate it so the
beauty is Ida pro has extensibility
mechanisms as does wind debug and visual
studio and in either post case you have
a python integration so you can actually
write a relatively simple python script
to interact with the user so you can
query where the current cursor is in the
the memory space of that disassembled
file
read out 16 bytes of data from that from
that database and just format it using
the standard python libraries as a guide
just print it to the console or do
annotations of the uh of the disassembly
and of course what you get is a really
quick simple string and you can take
that string and you can plug it put it
wherever you like and this really is not
very much work but it saves me obviously
over time if you're doing this a lot
it's going to save you time and it is
while this is still not as domain
specific as I'd like it's obviously very
important for my research to be able to
make my my reverse engineering process
much more streamlined and and realistic
so a common idiom you'll see when
especially when around sort of tooling
and development is you obviously you
work smarter not harder and I personally
feel that that's wrong I realistically
the smartness should allow you to work
harder like you shouldn't just like off
like give away your uh stuff hand to do
any work because you've written this
amazing tool okay the fuzzers in the
audience maybe going well no that's
exactly what I do right like I write my
fuzzer and just let it go to work and I
can go and sit on a beach somewhere and
earn money
um unfortunately for me while my tooling
ends up tending to do is just allowing
me to
be better at targeting the specific
things that I need to actually spend
time on
so obviously in that case what is the
types of things that I try to do with my
tooling to facilitate my ability to work
harder
and one of them is just basic pattern
matching there's low
General Security research is all about
probably finding patterns of behavior
and finding other places where that
behavior also exists and using that to
find your vulnerabilities like if you're
trying to fight cross-eyed scripting
everywhere of course there's usually a
relatively
obvious set of conditions which are
going to occur for that cross-site
scripting vulnerability to be to be to
be evident so of course there's usually
patterns you can Define which allows you
to identify uh particular vulnerable
pieces of code or particular places of
interest to go researching and so
one of my my basic tools of security
research is just to find those patterns
once I've identified them
so to give a very very simple example
I'm not expecting you to really read
this this is just a placeholder to make
it look pretty
um is uh actually trying to um when I
was doing work on.net a long long time
ago I was doing research to.net
serialization attacks this was the time
where you could just run.net in the
browser you could basically host
at one time you could just tell it to
load a dll and it would literally load a
net dll into Internet Explorer which was
amazing from a from an attacker
perspective
um but you also had an XML browser
applications and things like that which
were accessible from Internet Explorer
and Firefox and gave you
sandboxed normally dot net code but you
could just run arbitrary.net code in the
browser
so I found that serialization was an
interesting primitive to escape these
sandboxes and so I needed to find what
classes were serializable and find sort
of interesting behaviors on those
classes because it wasn't just enough to
find Ovis class this data class can be
serialized from an object into a byte
stream and then back from a live stream
to a to an object again it actually has
to do something interesting during
deserialization which allows you to
attack it
and so I spent a bit of time doing the
research and then I thought okay I need
to find these classes
at the time.net didn't tend to have much
in the way of certainly for the base
libraries was not
um
the source code was not direct generally
available so fortunately.net has
reflection apis you can just enumerate
all the types in a particular library
and say okay
is this a serializable type that's one
of the things you can do you can also
say okay is this does this implement
this special interface such as I
serializable which I know through a bit
of research that does something
executes code during the deserialization
process and so my tooling was literally
pretty much this just one function which
went through a library they numerated
all the types filter out anything which
wasn't serializable and then said does
this have this interface if yes print it
to your screen if it has this interface
printed to the screen
and what this allowed me to do was
narrow down from say tens of thousands
of classes within the The Base Class
library of dot net and narrow it down to
sort of in the low hundreds and from
there I could I was able to either sort
of improve my tooling just to sort of
have a determine if there was anything
particularly interesting or just literal
manual analysis running it in again at
the time reflect the sort of reflector
which is a net decompiler
decompatit classes have a look see does
this do anything interesting
it's a really simple tooling and again
like you don't have to write an Epic
tool like thousands of thousands of
lines of code it can be sort of of the
order of of 20 or 30 lines of code to
find to just automate away some of the
the difficulty of writing um doing the
security research process
but one of the things that um that work
also demonstrated quite clearly is that
you can use that as a sort of iterative
cycle so obviously I would run that tool
it would print out a load of classes and
I could then do the analysis of those
classes and find if they have any
interesting Behavior
but it may be the case that during that
analysis process something else
interesting came out like maybe this
class implements an interface I never
realized existed and therefore maybe I
should be looking for that as well so
you can of course feed that back into
your tooling
and run it again find more targets
inspect more targets and just keep going
around the loop until you you run out of
things to do so again you don't need to
you can start small and just sort of
build up from there and improve your
tooling over time and it doesn't have to
be a One-Shot thing where you write your
tool and and get it all over and done
with
um
so uh obviously uh PowerPoints decided
to reformat this wrongly there we go
again the the the the the uh code itself
is not that interesting
um but one of the things I found this
was about 10 years later actually like
um another time where I found I needed
to do.net serialization
attacks there was this at this point you
couldn't just run object code anymore
Intel Explorer is mostly gone and
Microsoft had blocked things like XML
browser applications for a long long
time without a prompt at least so
running rpg.net code is no longer an
option
um so I actually found some
serialization attacks in dot in the.net
framework and I needed some serializable
class which would actually do something
during the desolization process which
was directly exploitable it was no
longer possible to just maybe get these
classes back and then I could manipulate
them I actually had to have it all run
completely automated within the Duke
serializations via useful attack and I I
realized that
um there's obviously various classes
that I knew to be serializable which
probably shouldn't be one of them being
in.net this delegate class so a delegate
class you can think of it as like a
function pointer and it can be assigned
to point to say process.start and if you
run that delegate it would start a
process as the name might suggest and it
turns out for some bizarre reason I'm
sure the original designers have.net had
a reason for this that class is
serializable
so of course if you can find a class
which potentially has a serializable
delegate inside it and does something
interesting with that maybe you could
get that to deserialize and then get it
to run this arbitrary function pointer
effectively
um so that's what I did I just modified
my my serialization code I literally
sort of dug out the code I wrote 10
years ago and just write okay let's add
a new condition this serializable
delegate condition
um I found one I found a perfect class I
think this is actually introduced in dot
at 4.5 which considering
um that's many many years after the
original.net was introduced and many
many years after serialization was
considered a very bad thing and you
shouldn't be serializing delegates at
the very least this new class was
written and no one ever seems to have
cared like it was this has never been
fixed
um and it's a comparison class it
Compares two objects together and
returns like is it
normally above or below or equal and it
has inside a serializable delegate which
we can point to process.stat
so I was able to use that you can embed
it inside a hash table which is like a
dictionary and during the
deserialization process of the hash
table it would actually run this
comparer to try and rebuild its Key
State
and so you could just uh get it to run
object code during the deserialization
process and if you want you can go on
the project zero blog if you search for
export.net manage dcom you'll find my
whole write-up about this and the
process I went through to try and find
these serializable classes and it's kind
of interesting so again it's kind of I
needed I that tooling was what allowed
me to find those research targets so
actually see if I could exploit them
[Music]
now another
degree sort of automating away some of
the drudgery of of the research process
now another thing I I write tooling for
is to allow me to do manual analysis of
of attack surfaces and UI or API
Services primarily
so obviously there's a there's an
impedance mismatch between humans and
win32 API cores that you need some sort
of bridge in between like a computer
program to bridge that that Gap and
that's one of the sets of tools I write
I write a tool to bridge the gap between
those two domains
and it allows me to play with things I
can just go oh wonder what would happen
if I sent this
this parameter to this function does it
do anything interesting and I can sit
there and type away on my computer and
try and find security vulnerabilities
that way
um
so the thing I come back to when it
comes to like sort of complex systems
which really benefit from having sort of
tooling to to improve a sort of analysis
at the manual analysis and inspection of
it is com so this is my simplified
diagram of com activation
um
obviously the fact that it's extremely
complicated this is trust me a
simplified version of this diagram and
com has loads of places so you have a
say a user process which wants to create
a com object it has to go to the
registry and goes okay is this com
object exists is it registered anywhere
yes it is okay well actually it's out of
process it runs not on a dll but in an
execute sport oh okay I need to talk to
a system service who knows about this
the system service then goes back to the
registry and has to do access checking
and pull more data out of the registry
which creates a new executable which
also does some weird stuff and looks to
the registry and all manner of crazy
stuff just to run out executable and
connect to it it seems a bit absurd but
that's what it what it's designed to do
and the trouble is
inspecting a lot of this is is quite
difficult Windows does not generally
provide much in the way of tooling
itself to give you an idea of what's
going on when a com object is activated
and what that com object actually does
the registry is all sort of disparate
areas which have to be correlated
against each other so like app IDs which
reflect like sort of like a a set of
classes isn't like directly correlated
because there's no sort of direct link
you have to sort of manually take the
guide of the app ID and try and match
that to the class ID and all that sort
of stuff it's it's a bit of a nightmare
so of course I write tooling for this
sort of thing so the tool I came up with
in this case was earlyview.net if you
ever use the SDK tool Ola view
um
it's similar I stole the name basically
and stuck dot net on the end in the the
good tradition of writing.net tooling
and what this allowed me to do was
enumerate all the sort of registry
artifacts and and file artifacts for com
uh store that in a database where you've
all got a nice object model and
everything links to each other and you
can sort of go between app IDs and class
IDs and interfaces you can create new uh
instances of com objects you can say
what interfaces does this object
supports from that interface you can
even go what sort of functions does this
support what parameters does it take and
you can sort of play around and and try
and find interesting vulnerabilities
using that that tooling
um
so to give an example of the types of
vulnerabilities that I found using this
sort of tooling
um Windows has this concept of user
sessions where you have
you can have multiple users logged on to
the same machine at the same time with
different desktops and in order to keep
them separate Windows creates you a new
session which is just usually referred
using a number of some kind like just an
incrementing number and that is in
theory isolated between users so a
normal user can't access some other user
on the same machine because that would
be a security vulnerability if that was
possible
uh unless you're an administrator of
course if you're an administrator or
bets are off with regarding these sort
of things but of course
Microsoft don't tend to like to fix bugs
which require you to be an administrator
they generally don't consider them
security vulnerabilities
however it turns out com itself has this
mechanism using this session moniker to
instantiate com objects on different
desktops
and the interesting thing about this is
it doesn't require you to be an admin to
do so that doesn't sound quite right
that sounds like a misfeature of some
kind however fortunately or maybe the
reason they never really fixed it there
are some preconditions to what com
objects you can create so a commodit has
to run out of process obviously it has
to not run in a dll in in the current
process because that's kind of hard to
achieve otherwise it also has to be
accessible so there's like a set of
security requirements associated with
that which say can this user access this
this object or not
but of course
it's it's possible to find classes which
do meet these criteria the trouble is
there's no invoke tooling to find those
classes and it'd be it'd be interesting
to know if even Microsoft have such
tooling to do this sort of analysis
so my tooling was able to actually just
go through the list of registered
classes and say okay does this meet the
criteria which would allow me to X to
exploit this cross-session once I'd
found the list of classes which protect
were potential targets I was then able
to do the analysis I could create
instances of them see what interfaces
they support because it wasn't just
enough that I could create a com object
I also had to have say a function on it
which did something useful and it turns
out I found like a perfect one it
allowed me to do it cross-session this
this com object could be created
cross-session from a normal user and
crucially it had a function on it which
was basically create process just spawn
a new process for me awesome for all you
do create it cross session
uh obviously hoping that the domain
administrator is logged onto your server
at the same time spawner spawner process
in their their session and compromise
the domain right easy simple solution so
of course Microsoft fixed this by not
fixing the conversation Monica craziness
they just fixed the individual class
that I I reported to them so I did six
months later send them a new one so hey
still not fixed you can do it with this
other class and they still didn't fit
anyway
[Music]
okay so that sort of my use for tooling
for analysis purposes right like
the ability to simplify and look for
areas of interest in in my research
topics
but another thing I find tooling really
useful for is if I'm writing that tool
to say exercise in API or interact with
a particular area of of My Chosen domain
which causes 10 10c windows it can act
as a mechanism to make me remember how
things work like I'd like to believe I
have a good memory but if anyone's ever
spoken to me my ability to remember
people's names is pretty pretty limited
and the same is with random Easter
terica in Windows I can probably recall
quite a lot of crazy stuff in Windows
but there's always limits to my my
ability to remember things
um so tooling is a very good Aid Memoir
um and
to give an example of where I use this
literally is like three weeks ago
is
uh I was trying to dump all the symbolic
links on a on a Windows File system I
wanted like okay I need to see if
there's anything any interesting
symbolic links on this drive on this
volume
show me more and I've previously
researched that hey I I can do this is a
there's an API call which basically says
get me all the siblings or in Windows
terms repos points
um and I'd written this into a tool I'd
written like a function to call query
repath points which would dump all your
repass points awesome however every time
I try to use it
I would just get an error and not even
like a nice specific error of like this
is the reason you're an idiot no it was
an invalid parameter was passed to the
service what all function well thank you
in this that's very generous of you for
uh really helping me Define why why I'm
messing up
um fortunately
future future James had written a nice
comment in his in his code which
basically says oh yeah yeah if you're if
you're doing this you need to open this
very specific magic file name
and if you don't open this magic file
name you will not be able to enumerate
this repulse Point database so of course
I plug that into my my script and now
magically it started working and this of
course is is a comment in this case but
sometimes say an API call can be quite
complicated to call like it might have a
weird Behavior like the way you allocate
the structure you pass in might have to
be very specifically done like so
writing code which exercises those apis
can also help you remember how to call
certain esoteric and obscure functions
in encode bases
[Music]
so the sort of final main thing I find
tooling really useful for is
disseminating information
so again as I said like things like
calling how to call a particular API
the best way to sort of disseminate that
if is is not reading Microsoft
documentation because you generally find
it's not not fantastic
um is to share implementations of that
and this of course works for everything
like yes okay it seems a bit ironic that
I'm telling you to write your own
tooling and now I'm telling you actually
share it so other people don't have to
write their own tooling I I understand
that but
one of the end goals of your writing
tooling is not just to necessarily keep
it to yourself is to share with share it
with the world and and hope that
everyone benefits from your your Insight
and your and the time you spent writing
it
so pretty much all my tooling I write at
project zero ends up in GitHub
um this this is the tooling which
um I showed the the snippet of code from
a couple of slides back
um you could even potentially track my
current research topic by seeing what
I'm committing to this project at any
one time
um sort of a side Channel attack against
my research
um now I I do find that that sharing
tooling is is a net benefit and most of
my tooling is just is analysis tooling
as as the name suggests this is analysis
tools
um unfortunately some AV companies
generally get it the different idea
about my tooling and
I can't stop
uh an a um I can't stop malicious users
necessarily taking my code and re
repurposing it because
while my tools are not malicious
inherently they can be repurposed
because they're just a generic library
or generic set of tooling and even
sometimes you get the dreaded hacker
tool marking in an AV like PS exec is a
hacker tool even though it's clearly not
right
um so yeah currently if the compiled
version of that source code that
analysis tooling triggers uh 43 out of
65 AVS on virus total and they're all
like if you could if you can just about
see the text it's like generic generic
KD some random generic detections right
it's not detecting anything specific
it's not saying I'm malicious it's just
like
it looks kind of malicious like we've
seen it maybe one person using a
maliciously somewhere and therefore it
must be immediately malicious right
and this of course frustrates me no end
because it means that I can can't easily
use my tooling anymore because on a
default system with Defender I install
my tools from from the Powershell
Gallery saying to Powershell and it
won't let me install it because it says
no there's a virus in this because
Defender said it's a virus I even had
libraries removed from nuget which is
Microsoft's package manager for
libraries when you're developing and
they just removed it because it said
well no Defender says your your binaries
are malicious and they were detecting a
file which contains 50 lines of code and
it's not a single malicious line of code
in that but but Defender says it's
malicious and you try and at that point
you're hitting a brick wall in terms of
trying to get people to fix it
um obviously with the sponsor of
Kaspersky here like my best anecdote for
Kaspersky is for a while people could
not read my blog post uh my my personal
blog which tended to have Snippets of
using this tooling because it would
detect the snip bits of my Powershell
code in the HTML going to the internet
cache and would delete the internet
cache before you could actually read the
web page
um so firstly protecting you from the
the real threats in life right
[Music]
so I thought I just have a very quick
set of demos like um I don't have uh too
much time because obviously I need to
relinquish uh to uh
the next speakers
um but
this is like my my contouring of course
it can be just uh
it's all one big user interface
um obviously it has its red its database
all stored in on in memory and of course
you can do
you can just sort of look for
interesting classes oh this looks
interesting run it and it will dump like
okay what interface is it the sports and
you can start playing with that and do
do fun stuff with that tooling and you
can also
um interact with it using Powershell so
um
you can now just
say get com class and of course you can
now use Powershell for
um doing maybe more complex analysis you
can write scripts to say okay does this
have this particular interface and also
has this particular property and this is
all of course
the one of the bcs.net is of course
these are all just reflectable objects
so you can just inspect them inspect
their properties and and manipulate them
um
this one is is obviously my uh my
tooling uh for
um interacting with the windows apis and
if we can remember how to type
um
[Music]
yeah I think that actually said like
because the file contains a virus
[Music]
the perfect demonstration like I did not
plan that one
needless to say
um
sometimes it works
um
and another tool which I didn't I didn't
really talk about this one is probably
one of my oldest public tools and I
don't know how many people have actually
ever seen canape
um and this is a tool I wrote when I was
um less of a security researcher more of
a
um
a consultant doing
um
work and I wanted a tool which was kind
of burp but for arbitrary Network
protocols
um and so you can in here
um just set up things like
um TCP UDP proxies and write scripts to
manipulate traffic it's kind of like
there's a few different tooling but like
the whole idea is this this is very much
a tool to allow you to
inspect Network protocols and write
tooling for those binary protocols
without ever having to
um
with minimizing the amount of coding you
have to write so you don't have to
rewrite a new property every time you're
on site somewhere as long as you've got
a tool like this installed you can do it
all through the GUI it's a slightly more
easier to use than a
um just writing Python scripts whatever
or maybe you prefer just to write Python
scripts and of course this requires
windows so no one no one really is
likely to be using it on site of course
anyway
um
so in terms of takeaways or
recommendations
um the key one really is like you can
start small because you can always
iterate on your on your tool you don't
have to write
that entire copy of either Pro in one go
because it's never going to happen
however you can just start small and as
you're going along in your research
process
trying to make your tooling better it's
always a good idea
now
the second point is
I've I've met some
great coders and I met some pretty
chunky characters in the security
Community
um if you can follow the good
development practices because future
self will will be happy about it when
you have to come back to the code 10
years later and work out what what the I
wonder if you were trying to do with
that code so if possible try and write
write your code maybe even put unit
tests in
you never know crazy crazy stuff have
happened
um
and regardless of the fact that AV likes
to likes to detect my tooling I still
vow I think I value
um sharing my results with the community
because the community can take those
results find stuff that I never even
thought about looking for like a very
good example of that is the tooling I
wrote to attack symbolic links on
Windows
that was used that effectually ended up
being used you could almost consider a
pressure campaign on Microsoft to do
something about symbolic link attacks on
Windows because people were just they
could take my tool and quickly exploit
almost any symbolic link vulnerability
on Windows and it was just super easy
and at the time they were also making
bank because Microsoft were paying bug
bounties for this right I've heard
rumors that just on symbolic link uh
sort of file planting attacks alone
Microsoft spent multiple millions of
dollars in bug bounties on that
particular area before he finally went
hang on a minute
um so yeah like it I'm only one person
of course like there's only so much time
I could spend researching any particular
topic so if I can write and share my the
results of and my tooling hopefully
people can can pick that up and and take
that further and do something with that
so thanks very much for listening to my
to my Keynotes of course uh we probably
have a a few minutes for uh for
questions or I'll be around for the rest
of the day and can always uh answer
questions or give a better demonstration
of my tooling if you sell like so
um thank you very much
foreign
questions
thank you very much as a person that
used your tools in the past they are
great and I want to ask you how often
you find yourself looking for a tool for
other tools that you do not use and
namely please two favorite tools
um I I do try and look for pre-existing
tools like a couple of tools I'd
probably I quite value which one of them
like obviously I'm biased on because of
I have contributions and it is why so
cereal.net using that to build
serialization payloads for dotna exports
and of course
things like this internal tools are
again they're you can argue they're
generic but the number of security
vulnerabilities I've found with process
monitor alone is crazy yeah
um and pres and any of those I what I
tend to look for are tooling that sort
of more generic tooling which allows me
to do stuff but of course like rubious
for example I I've played a lot with on
when I was doing my Kerberos research
was very useful for uh understanding how
certain things work so yeah thank you
I have a question so um it sounds like a
lot of these problems are domain
specific assuming you would have a sane
system where you wouldn't need to copy
like good it's all wrong because you
have symbols or strings or you already
had the tools which for example could do
crazy things like enumerate Sim links
yeah will you still write your own tools
a lot of problems in the world were
solved then then I wouldn't need to but
I think there's always what you
recommend still writing your own yeah I
I I think so because unless it is
correct somehow that every single Niche
is I think
one of the things I think I probably
didn't didn't make clear on that is
another benefit of writing tooling it's
just understanding the behavior of a
system so yes I can take for example
rubius which is a tool to manipulate
Kerberos on Windows
does only mean you understand the Kurt
boss and how it works however writing
your a full Kerberos Library including a
KDC to to implement Kerberos in your own
code gives you a far greater
understanding and it's amazing how many
bugs have dropped out just from that
process of
understanding how it how it actually
works because you think you implement
something and something doesn't go quite
right and you go why is that not working
and it's because there's a vulnerability
there which you you didn't realize so
yeah and yes or if all the if all the
use cases run away there would still be
Advantage just for that benefit of of
understanding how something works that's
a very good point thank you
um hi
when uh you know what I find is when
writing tools it's one thing to write
the tools
but another thing to kind of publish
them
um you know you need to maintain the
tools you need to polish them because
you know document them for yourself you
know you don't really need to do that so
much yes you need to maybe write a read
me for your colleagues but yeah so where
do you stand on that you know how do you
decide do I publish this or not or do
you publish everything I don't think so
but I I don't publish everything like
there's usually has to be a bar to
especially in Google like the difficulty
of writing things in Google is of course
you need to go through the open source
agreement they're pretty flexible you
have to go through the process of like
does this in impact on Google's
underlying businesses for example if I
wrote a new search engine you probably
wouldn't like allow me to publish that
GitHub right
um
so you have to go through a relatively
trivial but but still a quite a high bar
so anything under a certain size is just
not worth the time
um documentation wise yes my tooling
should could do with better
documentation and better better always
always
but I I I I am someone who ascribes to
the sort of documentation this code
theory that as long as it's open source
if you're just writing if you're
releasing binaries to the world then yes
I think you that needs better
documentation better
um
for a better deployment processes and
all that sort of stuff whereas if you're
releasing open source code I think the
barrier to the bar is a bit lower the
source code is the documentation
essentially yeah
um and there's blog posts and there's
informal documentation and there's
presenting to people at conferences like
orders trading courses you can make a
mint out of out of telling people how to
use your amazing tool because you
refused to document it in an easy way
thank you no problems
rtfc I think okay I think we're done
thank you
we're gonna have five minutes