Jones explained that most ATM's run Microsoft Windows CE on ARM processors and they all tend to have remote updating capabilities. Jones wrote a remote exploitation program called Dilinger to remotely exploit the ATM. Then once the ATM is exploited he has another program called Scrooge which is a root kit for the ATM. With those tools, Jones — much to the delight of the massive Black Hat crowd that gathered to see him — he used his tools to exploit a pair of ATMs on stage — Live.
Any given program will expand to fill available memory.