Binary Ninja Developer Demonstrates WinDbg Time Travel Debugging Integration
· 1:06:28 · Watch on YouTube ↗
Summary
A Binary Ninja developer demonstrates recording and replaying WinDbg traces for reverse engineering and previews unreleased memory-query and code-coverage features.
Key points
- Time travel debugging lets analysts move backward and forward through a recorded execution without restarting the program.
- The speakers recommend recording suspected malware in a sandbox because tracing does not itself isolate the executable.
- Binary Ninja supports recording traces from newly launched processes, but the developer says attaching to an existing process is not yet supported.
- An unreleased memory-query widget shows execution and memory accesses; the developer says it could help locate malware string-decryption routines.
- A prototype code-coverage view highlights executed instructions, while a call-query demonstration supports filtering but encountered a crash.
- Broad queries can take a long time and cannot easily be interrupted; the developer recommends disassembly for heavily obfuscated samples because high-level stepping is not always accurate.
Article Details
- Topics
- [07:24] Time travel debugging for reverse engineering and malware analysis
- [16:06] Recording and replaying WinDbg traces in Binary Ninja
- [19:25] Sandbox precautions for tracing malicious executables
- [27:30] Trace memory queries and an unreleased query widget
- [37:48] Function-call queries and filtering
- [48:01] Prototype trace-based code coverage
- [53:59] Query performance and replay limitations
- [01:00:45] High-level stepping accuracy and disassembly