reverse engineering

Alex Ionescu's OffensiveCon 2019 keynote on how reverse engineering is done on Windows without conventional reversing. It covers legal ways to obtain names of variables, exported functions and structures.

Christopher Domas's REcon 2013 talk on dynamic binary visualization for reverse engineering. He shows how rendering binary data as interactive visual maps and trigraphs reveals structure that hex dumps hide, leading to his Cantor.dust tool.

A 36C3 talk on the AMD Platform Security Processor, an undocumented ARM core inside AMD CPUs that runs before the main processor. The speakers present their reverse engineering of its internals.

Glenn Vanderburg asks whether software development can be real engineering, surveying other engineering disciplines and decades of programming experience. He envisions what a software engineering worthy of the name might look like.

Glenn Vanderburg argues at the O'Reilly Software Architecture Conference that software development is an engineering discipline, even if immature. He contends the discredited body of knowledge called software engineering has led people to wrongly reject the label.

Christopher Domas presents his Cantor Dust tool at Derbycon 2012, a 3D visual approach to reverse engineering binaries by visualizing their structure dynamically.

Glenn Vanderburg argues at Lone Star Ruby Conference 2010 that university-style software engineering does not work, and asks what real software engineering would look like. He revisits the waterfall model and what engineering means in other fields.

Christopher Domas's Derbycon 2015 talk on the M/o/Vfuscator, a compiler that emits only x86 mov instructions, showing mov is Turing complete. It explains how a full machine is built from mov and why the output is a nightmare to reverse engineer.

Bryan Cantrill's Craft 2019 talk on the ethical dilemmas software engineers face as software eats the world. He explores cases where engineering thinking conflicts with the law or personal morals, including Facebook's news feed experiments.

Bruce Dang of Microsoft gives a 27C3 talk on how the Stuxnet vulnerabilities were found and analyzed. He walks through the techniques used to triage them and the details of each zero-day exploit, down to the opcode level.

Christopher Domas presents research at DEF CON 26 showing a hidden alternate instruction set and undocumented hardware backdoor in some x86 processors, found on a third-party CPU. He uses it to ask how feasible wider hardware backdoors are.

A DEF CON 21 talk by Adam Laurie and Zac Franken on decapping chips, covering how to remove chip packaging and image the die to read out contents such as ROM.

Christopher Domas's DEF CON 26 talk on secret processor registers that vendors reserve for third parties holding trusted keys. He examines how users are locked out of parts of their own CPUs.

A 32C3 talk dissecting Red Star OS, North Korea's state-built operating system. The speakers explain its internals and how it invades users' privacy, including file watermarking.

The fail0verflow team (bushing, marcan, sven) present console hacking at 27C3, covering Wii, Xbox 360 and PS3 exploits. They explain how the PS3 was cracked after Sony removed Other OS.

The fail0verflow 27C3 talk on breaking PS3 security, covering how Sony's implementation failed, including its ECDSA mistakes.

A Plogue developer shows the custom electronic test rigs built to measure the Sega Mega Drive/Genesis sound chip (YM2612) for the chipsynth MD emulation. It covers the years of testing and reverse engineering needed to reproduce the chip's quirks accurately.

An episode of Plogue's chipresearch series on emulating the Yamaha DX7 from the hardware up. It covers the sub CPU and main CPU, address map investigation, cartridges, firmware analysis and a skeleton MAME driver.

Greg Wilson surveys what empirical research actually shows about software development, why we believe it, and how to share that knowledge more widely. It covers evidence on practices such as TDD and design patterns.

JPL's David Cummings presents at the 2025 Flight Software Workshop how the team diagnosed and fixed the 2023 Voyager 1 anomaly from billions of miles away. It walks through the flight computer and the memory fix.

Stuart Armstrong of the Future of Humanity Institute gives an Oxford physics talk on what exploratory engineering suggests about the Fermi paradox. He argues that von Neumann probes and Dyson spheres are plausibly buildable and asks what traces advanced civilizations would leave.

A Rubber Duck Engineering episode on the years before Flutter, covering web projects and three JavaScript frameworks that influenced it, and the early DOM-based, network-loaded Flutter.

Bryan Cantrill's Monktoberfest 2016 talk on how software engineers pass knowledge down through oral tradition, from folk rhymes to programmer lore and stories like why C lacks a logical XOR. He argues for writing software with future generations in mind.

Hillel Wayne reports on interviews with 17 people who have worked as both software and traditional engineers. He argues the fields are fundamentally the same and have much to learn from each other.

John Sotos, a physician and former Intel chief medical officer, argues at DEF CON 25 that genetic diseases are exploitable vulnerabilities in the genome. He warns that CRISPR and related tools will make malicious genome hacks and targeted bioweapons feasible.

Karla Burnett presents real phishing campaigns run against a Bay Area tech company, including conversion rates and how existing protections were bypassed. She argues for evidence-based techniques to prevent credential phishing, not just mitigate it.

Tanya Reilly's LeadDev talk on glue work, the invisible coordination and support tasks engineers do that keep teams successful but can hurt careers.

A clip of Sandy Munro, a veteran automotive engineer, describing his visit to a SpaceX Starship design review and meeting Elon Musk. He says he was struck by how deeply Musk is involved in engineering.

An AdaCore webinar in which NVIDIA engineers explain why and how they adopted Ada and SPARK for security-critical firmware. It covers the business case and the engineering experience of the transition.

Historian and journalist Gwynne Dyer gives a long UBC talk on how climate change will reshape international politics. He covers food, borders, refugees and the possibility of unilateral geoengineering by affected nations.

Joran Dirk Greef's Systems Distributed '23 talk on TigerStyle, the engineering methodology behind TigerBeetle. It covers designing safer systems in less time through up-front design, assertions, and deterministic simulation.

The trailer for Tim Hunkin's series The Secret Life of Components, eight guides to mechanical and electromechanical parts for designers and makers.

Bryan Cantrill's Monktoberfest 2023 talk takes on AI doomerism, weighing the theoretical existential risks against the reality on the ground. He takes a skeptical but thoughtful view of how to balance AI's potential against its risks.

Moxie Marlinspike's DEF CON 18 talk on changing threats to privacy argues that surveillance arrived through convenient services and network effects, so opting out is not a real solution. It also includes his framing of getting social democracy rather than the fascism people feared.

Meredith Patterson and Sergey Bratus argue that networked software stays insecure because protocols and inputs are too complex to recognize safely. They propose using formal language theory and grammars to build secure, verifiable input handling.

Moxie Marlinspike's BlackHat 2011 talk examines weaknesses of SSL and the certificate authority system and proposes Convergence, a decentralized notary approach with trust agility.

Microsoft's Tony Chen explains how the Xbox One was designed to resist physical attacks, including secure boot, encrypted memory, a security processor and a hypervisor. The goal was to make any hardware attack cost more than the price of many games.

Dan Geer's Black Hat 2014 keynote argues that cybersecurity is a matter of power and policy rather than wishful thinking. He covers surveillance, the vulnerability market, software liability and privacy as the capacity to misrepresent yourself.

A Google Tech Talk by Steve Weis that introduces modern cryptography and its use in practice and at Google. It covers proofs of security and security definitions and a special topic. HN commenters treat it as a talk on verifiable electronic voting.

Bryan Cantrill's Papers We Love talk on FreeBSD Jails and Solaris Zones, tracing how OS-level virtualization grew out of chroot and the limits of the traditional UNIX security model.