WOOT '14 - An Experience Report on Extracting and Viewing Memory Events via Wireshark

An Experience Report on Extracting and Viewing Memory Events via Wireshark

Sarah Laing, Michael E. Locasto, and John Aycock, University of Calgary

Modern program analysis environments lack a principled method of monitoring low-level memory events. Such monitoring is of great value to activities like debugging, reverse engineering, vulnerability analysis, and security policy enforcement. Although current systems can be coerced to produce streams of memory events, most such techniques are inefficient or overly invasive and offer an unconstrained control over memory, …

analysis debugging environments events experience great john low memory michael monitoring program program analysis report reverse university value wireshark