Christopher Domas presents his Cantor Dust tool at Derbycon 2012, a 3D visual approach to reverse engineering binaries by visualizing their structure dynamically.
Why Hacker News points people here: Regarded as one of the coolest talks ever, with a futuristic binary visualization demo that has inspired later tools.
“Skip to ~14-15 minutes to get to the good stuff, then go back and watch the whole thing :)”
Domas on dynamic binary visualization for reverse engineering
Full comment
You might want to have a look at Bossard's presentation from defcon20 (2012?), "Hardware backdooring is possible": link He's done a few of these, so I might be getting them mixed up -- but the message is basically that x86 (and by extension amd64) is hopelessly broken due to legacy crap that sort of hides between the cpu, ram and devices (the software running on your cdrom drive, on the network or sound card...). Also related: 4 2 1 Christopher Domas The future of RE Dynamic Binary Visualization this video [ed2: Skip to ~14-15 minutes to get to the good stuff, then go back and watch the whole thing :) software home page and demo download (I don't think there's anything new published): linklink ed: More recent presentation, looks to be the same: link ] Again related to (but as far as I remember does not reference [edit: I was wrong, he does indeed reference this]): Black Hat USA 2010: Voyage of the Reverser: A Visual Study of Binary Species 1/5 link #HITB2013AMS D2T1 Sebastien Kaczmarek - Dreamboot - A UEFI Bootkit link
Strongly recommendsLargoLasskhyfvOct 2020
“really blew my mind when I saw it.”
Cantor Dust 3D binary visualization demo
Full comment
Like CantorDust by Christopher Domas@Batelle? this video really blew my mind when I saw it. Btw. about 8 years later they finally delivered, by releasing it as plug-in for Ghidra! Yay! link
Strongly recommendsvanderZwanAug 2026
“Chris' presentation of it in 2012 is still one of the coolest talks I've ever seen.”
Domas's cantor.dust presentation, one of the coolest talks
Full comment
Also came up with the original ..cantor.dust.. binary visualization tool, which is a tool I never used directly but Chris' presentation of it in 2012 is still one of the coolest talks I've ever seen. [0] link [1] this video
Strongly recommendsnerdsniperAug 2026
“which completely blew me away. It still feels futuristic today, 13 years later.”
Futuristic binary visualization UI still ahead of its time
Full comment
My introduction to his work was "The future of RE Dynamic Binary Visualization"[0] which completely blew me away. It still feels futuristic today, 13 years later. Novel UI/UX paradigms like this are slow to find widespread adoption, even when they're so clearly demonstrated to be such an ideal fit for their purpose. 0: this video
RecommendsrckoepkeOct 2020
“This is my favorite version of it”
Favorite version of 3D binary visualization concept
Full comment
This is my favorite version of it: this video Some people have taken this concept very far. Batelle's CantorDust (was?) a pretty fully developed 3D visualization software for binary packages utilizing many different views and filters with convenient UX for selecting blocks of code graphically and zooming in on the corresponding hex, or vice-versa. Edit: I looked very hard for this software about 6-12 months ago and couldn't find anything...it appeared to be vaporware. However, 'LargoLasskhyfv posted in this thread tree at the exact same time I did and noted that it was just released about 3 months ago as a plugin for Ghidra. I'm very excited to play around with it.
RecommendsrckoepkeOct 2020
“This demo does a fairly decent job of explaining how you'd use these kinds of visualizations”
Demo explaining how to use binary visualizations
Full comment
This demo does a fairly decent job of explaining how you'd use these kinds of visualizations: this video Batelle's CantorDust combines the visualization concept with a convenient UX for selecting blocks of code graphically and zooming in on the corresponding hex, or vice-versa. The "devil is in the details" with respect to the UX for these kinds of tools. The visualization or 2D image by itself is somewhat less useful without being able to snap to the corresponding part of the hex or IDA/Ghidra disassembly. I do think adding a 3rd dimension to the visualization probably adds somewhat more utility as well. The recently released open source package for CantorDust seems to omit the 3D visualizations which were shown in the demo linked here.
Recommendsstack_underflowFeb 2021
“(very interesting presentation)”
Domas presentation on cantor.dust binary visualization
Full comment
Your post reminded me of the presentation on cantor.dust: linkthis video - Christopher Domas The future of RE Dynamic Binary Visualization (very interesting presentation) Looks like there's even been a recently open sourced plugin for Ghidra released by Battelle: link
Recommendsmk_stjamesDec 2023
“a talk about binary visualization by the legend Christopher Domas”
Talk on binary visualization by its originator
Full comment
Those are trigrams of all 3-byte sequences of binary executables arranged in a cube. Here are some more examples of that type of viz: link And here is a talk about binary visualization by the legend Christopher Domas, which is where I first saw it used: this video
Cites ite12eAug 2013Full comment
I realized that you probably did have a product -- unfortunately that doesn't mean that the product works (not trying to imply anything about your product/company here; it's just (as you probably know) there many companies selling security solutions; and very few that seem to be selling security solutions that work...). Are you aware of: "Overcoming TPM by exploiting EFI overflow" this video and: "Coreboot/bios malware": link It's an interesting use of TPM -- and sounds like a sound approach, assuming there aren't any bugs in the TPM software... which might be too big an assumption. I don't suppose any of your software is available as open source? Where can I/we learn more?
Cites itfenollpNov 2014
“Have a look at Cantor Dust [1], a visual reverse-engineering program that is promising.”
Presentation of Cantor Dust visual reverse-engineering tool
Full comment
Have a look at Cantor Dust [1], a visual reverse-engineering program that is promising. The author says in a presentation [2] that CD is based on Cortesi's work. [1] link [2] this video Here is a demo: link
Cites itluchMay 2016
“Senseye really looks like "Cantor.Dust”
Full comment
Senseye really looks like "Cantor.Dust" ( this video ). I wonder if c.d. has been an inspiration for it.
Cites ittekacsSep 2017
“Veles visualizations were inspired by Christopher Domas’ talk from Derbycon 2012.”
Talk that inspired Veles visualizations
Full comment
Yes. If you follow the link at the top of the page to the explanation post[1], it says at the bottom: > Veles visualizations were inspired by Christopher Domas’ talk from Derbycon 2012. > Check out the video of his presentation this video . [1]: link
Cites itLargoLasskhyfvMay 2020
“(skip to about 14m30sec, the show starts there)”
3D visualization of binaries with no source
Full comment
Most visual programming is two-dimensional. What if it were three-dimensional instead, arranged in some sort of link with link 's representing your modules/nodes, chosen according to the amount of connections they have with other modules/nodes, the connections styled and color coded, maybe even unobtrusive/discreetly animated to show the direction/speed/volume of signals/dataflow, width of datatypes/buses, all in an abstract fashion similar to the way large metro/rapid-transit systems are mapped? Able to encapsulate other modules/nodes, folding large graphs into one, popping into an link only on demand? Turnable/viewable from any direction you like, but usually snapping to some virtual 3D-grid, in say steps of 45° ? Zoomable? This is even usable the other way around for reasoning about stuff you have NO source code for. Like in this video (skip to about 14m30sec, the show starts there) and link (same guy) and others, but similar link and even more so link That looks messy, but that is because it is in reverse, with no known sources. Now imagine how tidy it could look when done originally, from first principles. Your own cybernetic Zettelkasten/Memex/Dynabook/whatever in a world of common and open (architecture neutral) data & document formats, automagically tagging, indexing and sorting all your stuff. OFFLINE if you like to. Usable on conventional desktops, tablets, large surfaces, overlaid onto some augmented reality, VR, holographics, i don't care. With the end go
Cites itLargoLasskhyfvNov 2021Full comment
Thank you for the explanation. But initially I posted that in answer to link where someone asked about if it would make sense to clone/reimplement somthing like Genera. And I pointed out that maybe the next best thing would be link With the intent to not having to start from scratch, not necessarily using it as is, but to take inspiration from. Or not, and really pushing it forward instead, but that depends on so many factors. However, it is possible. Besides that, did you really have the impression 'innocent people' had to be warned of the consequences, wasted time, whatever? ;-) Furthermore, either Common Lisp is Common Lisp, or not. So what does it matter, if only few people ever used that? As soon as it's getting graphical there is nothing besides the two commercial vendors(so proprietary), and old McCLIM. So who really cares? There is Movitz and Mezzano, why should there be no effort to make Medley modern? Would McCLIM on steroids be better for SBCL and Clozure? Who knows? I for my part like to look deep into such things, to see how I can adapt the concepts(not necessarily code) into my dabblings on FPGAs. Sometimes I had my mind blown, by things I haven't seen before, didn't even know the possibility thereof. Learning new concepts, applying them. Like this this video (not related to topic) Anyway, I like to go back into the roads not taken, to at least partially re-branch from there. There is much to learn from. From that what we have now, not so much.
