Malware analyst and reverse engineer, author of the Binary Analysis Course. DMs are always open. Opinions are my own and not the views of my employer.
The Netherlands
Joined July 2018
- Tweets657
- Following314
- Followers3.2K
- Likes358
My reverse engineering workflows survey is still ongoing! In less than 3 minutes, you can fill it in and help out: docs.google.com/forms/d/e/1F…
Ever ran a script in Ghidra that you wanted to cancel, only to find out that the script would not let you? The TaskMonitor handles the cancellation event, December's Ghidra tip dives into the details: maxkersten.nl/2024/12/31/ghi…
Over the past few months, we @Trellix have kept our eyes open for election related threats with regards to the U.S. presidential elections. We have summarised our findings in a blog: trellix.com/blogs/research/s…
Ghidra can do a lot, but some tasks are best outsourced to (micro)services! How? This month's tip helps you along: maxkersten.nl/2024/11/27/ghi…
Do you want to iterate over all defined strings in a program in Ghidra? This month's tip got you covered: maxkersten.nl/2024/10/31/ghi…
My survey into reverse engineering workflows is still ongoing, if you haven't already, please take 3 minutes of your time, I promise it wont take more!
docs.google.com/forms/d/e/1F…
Ever wanted to handle all files within your Ghidra project, even the ones in subfolders? This month's Ghidra tip got you covered: maxkersten.nl/2024/09/28/ghi…
Reverse engineering workflows can always be improved. I'm running a survey to see how! Please take 3 minutes to anonymously fill in what you think can be improved: forms.gle/3h2CsFhpMdKPssve9
Pushed an update to the @Trellix GhidraScripts repository on GitHub which fixes a few bugs in the Golang function recovery script: github.com/advanced-threat-r…
With my workshops and talk at the @DianaInitiative, @BlackHatEvents, and @defcon two weeks ago while representing @Trellix, I reflect back on my experiences at the conferences: maxkersten.nl/2024/08/18/my-…
The @Trellix blog which dives into the nitty gritty of my @defcon talk can be found here: trellix.com/blogs/research/n…
🧵1/4
The precompiled Golang files can be found here: github.com/advanced-threat-r…
🧵4/4
The Ghidra scripts to create/use the databases can be found here: github.com/advanced-threat-r…
🧵5/4
My DotNet Malware Analysis workshop at @DianaInitiative is today! I'd like to thank @Trellix for letting me do this!
This August's Summer Camp I'll be representing @Trellix while giving a talk on @defcon's main stage and giving workshops at @DianaInitiative, @BlackHatEvents, and @defcon! Details in chronological order in this thread! All times are Las Vegas local times.
🧵1/5
Friday the 9th of August, 1100-1120 @ Track 3, is my @defcon main stage talk about recovering function symbols with Ghidra's FunctionID and BSim, along with an extensive @Trellix blog with all the details: defcon.org/html/defcon-32/dc…
🧵4/5
Also on Friday the 9th, from 1400 - 1800, I'll give a four hour @defcon workshop on how to best use Ghidra, with a focus on real life malware, FunctionID, and BSim: defcon.org/html/defcon-32/dc…
🧵5/5