Review: Gray Hat Python

216 pages, a title of 'Gray Hat Python' and a table of contents with subjects such as 'design and program your own debugger', 'learn how to fuzz windows drivers', 'create powerful fuzzers from scratch', DLL injection, hooking, malware analysis. My first impression was that it must be really niche, hardcore and not for me.

You'd think that the book would appeal to only a subgroup of security professionals or software engineers given the subject matter. The small book also suggests that there would not be much space left to explain the matter to people who are not experts.

First impressions are often wrong.



In my opinion this book is a must for all people who deal with security on a technical level. The book is also interesting for programmers who want to learn more about debuggers and other low level aspects. People who want to learn some new tricks in Python will probably like the book as well. But all these people don't have to be experts to enjoy this book. There are a few ways you can read this book as it was clearly written with a few different levels of perspective in mind.

For example, you can learn about the inner workings of a debugger without actually understanding the Python code. All topics are first clearly explained on a conceptual level. After that Python code is used for implementation. You will get introduced to the Python code gradually, in the beginning each program is short and basic and the most important lines are highlighted and explained. After that more functionality gets added and further explanations follow.

Though the book deals with quite a wide variety of subjects, they all have a low-level debugging aspect. This makes that it is interesting for both security oriented people and developers. It's all about basic, low level techniques. And most of them can be used both for making and breaking stuff.

Given the subject matter and size of the book, clearly some things had to be left out. One of the things this book left out was implementation of the debugger on operating systems other then Windows. I think it was a good choice since Windows is still the platform on which most debugging and reversing takes place. Also, Windows offers a few API functions that make it easier to do debugging. This abstraction was used well to keep things understandable and short while still offering a good picture of what makes a debugger tick. Especially the chapter on debuggers contains loads of references for people who want to explore further. But I missed a few references for debugger implementation on other operating systems.

The only drawback was that there seemed to be some errors in some code listings. Unfortunately, there is no errata section on this book's website yet (24-jun-2009). This can make getting the example code to run a challenge for non Pythonians.

All in all, this is a very cool and unique book for all people who want to take a deeper look.

Review: The Manga Guide to Databases

Most of my friends and colleagues had to laugh when I told about or showed them this manga guide. Though this book is really fun to read and contains many subtle jokes, it's not something to dismiss as some crazy comic book.



Don't fool yourself, under the happy Manga lies a superb learning book on databases. The book deals with the fundamentals in a clear, quick and fun way. It's quite amazing how some conceptually difficult topics are explained in such a short book. The book brought a clear understanding of some things a 4-year bachelor's study on the subject failed to clearly explain. I hated everything Database before I read this book. Mostly because I felt it was a dry and boring subject and this idea was supported by terribly boring, big fat books with a lot of difficult language.

The book tackles all you need to know to be able to design, use and maintain a database. Subjects such as Database normalization, Database design, ERD models, SQL, ACID, locking mechanisms, query and database optimization, security, architecture, stored procedures and database replication are all explained wonderfully. There are exercises on each topic, and answers are provided a few pages further.



One of the strong points of the book is that it succeeds in explaining some very practical things without being implementation dependent. All the knowledge you gain from this book will be applicable to any database system.

The author is a sheer didactic genius! Repetition is cleverly hidden in comics, written out paragraphs, drawings and exercises. You hardly notice you are actually learning Your thought process is guided by the main characters in the book and a few hours later you know all the Database fundamentals.

People who care about the environment can also enjoy this book since it's been printed on some nice quality Sustainable Forestry Initiative paper. A nice way to read responsibly.

This book is by far the best book I have read on the subject. I think this book absolutely rocks and recommend it to anyone working with or just interested in databases.

Everything should have it's own Manga Guide!