TECHINT Techniques#
The tradecraft applied to TECHINT sources with the operator’s kit. Each technique is a repeatable procedure that turns raw data into intelligence.
Technique |
Description |
|---|---|
Static analysis |
Disassemble, decompile, identify functions and capabilities. |
Dynamic analysis |
Run the sample in a sandbox; observe syscalls, network. |
Firmware extraction |
Pull SPI flash, eMMC, UART debug; binwalk and chip-off. |
Hardware teardown |
X-ray, IC decap, side-channel. |
Memory forensics |
Carve artifacts from RAM captures. |
Diff analysis |
Compare new build against known good to surface changes. |
References#
TECHINT for the discipline overview.
TECHINT Tools for the operator’s kit.
TECHINT Sources for the data sources.
NSA TAO ANT catalog (Snowden documents)