19 - Alex Ionescu - Keynote

### Overview In this keynote address, Alex Ionescu addresses the misconception that his extensive knowledge of Windows internals and rapid vulnerability research stems from illicit access to proprietary Microsoft source code. Presenting the concept of "reversing without reversing," Ionescu explains how reverse engineering extends far beyond staring at assembly code in tools like IDA Pro or Ghidra. Instead, researchers can dramatically accelerate their work and gain deep architectural insights by gathering context, utilizing publicly released artifacts, tracking incremental updates, and studying foundational materials.

### Key Topics - **Beyond Disassembly:** Moving past standard decompilation to understand the architectural "why" behind operating system design choices rather than just the "how." - **Public and Overlooked Artifacts:** Exploiting debugging symbols, assertion strings in checked builds, header files, and debugger extensions to discover undocumented structures and function prototypes. - **Accidental Disclosures and Official Releases:** Leveraging beta kits, SDK/WDK samples, driver source code, and symbols inadvertently bundled in public tools. - **Binary Diffing and Incremental Research:** Using frequent release cadences, such as the Windows Insider Preview program, to diff small weekly changes rather than tackling monolithic multi-year OS updates. - **Research Ethics and Personal Cost:** Maintaining professional boundaries, avoiding reliance on leaked code, honoring non-disclosure agreements, and acknowledging the severe personal trade-offs and burnout associated with intense research.

### Technical Details - **Assertions in Checked Builds:** Historically (prior to Windows Vista), Windows checked builds included assert statements containing complete source file paths, line numbers, variable names, and comparison macros directly embedded as plaintext strings. - **Debugger Extensions and Support Tools:** Utilities such as WinDbg extensions (e.g., KTX files) often contain explicit `printf` statements formatting kernel structures, revealing offsets, field names, and data types not included in public symbol packages. - **Header Leaks and Cross-Component Symbols:** Internal definitions occasionally leak through build anomalies, such as internal MinWin headers bundled in early Windows 10 WDK releases or kernel structures exposed in private PDBs for COM and UI binaries due to shared precompiled headers. - **Official Sample Code:** Substantial reference implementations exist legally in the public domain, including Microsoft Research projects (e.g., Singularity's hypervisor headers and kernel debugger protocol KD), driver development kits, and sample networking/storage stacks on GitHub. - **Rapid Diffing:** Tools like NT Diff allow researchers to isolate granular modifications between Windows Insider builds, identifying newly introduced system calls or altered behaviors within days.

### Takeaways Reverse engineering efficiency is driven by building a cumulative body of knowledge, consulting foundational literature (such as classic PC architecture and BIOS references), and systematically analyzing peripheral resources. Ionescu emphasizes that high output does not rely on leaked code or unethical behavior, but requires significant time investment, curiosity, and ethical adherence to legal boundaries, while cautioning about the reality of industry burnout.