DTrace: The Reverse Engineer’s Unexpected Swiss Army Knife

Disclaimer: David Weston is no longer an employee of SAIC and his statements do not reflect the views of or an endorsement by the company.

In this video, made at Black Hat Europe, security engineer David Weston illustrates his research related to DTrace. Created by SUN and originally intended for performance monitoring, DTrace is one of the most exciting additions to OS X Leopard and is being ported to Linux and BSD. It offers an unprecedented view of both user and kernel space, which has many interesting implications for security researchers. Many of the features of DTrace can be leveraged to discover new exploits, unobtrusively monitor malware and even protect against buffer overflow attacks.