Your Unfair Advantage in Reverse Engineering
Joined February 2026
- Tweets26
- Following6
- Followers18
- Likes14
Many binaries don't tell the whole story in one file.
But most analysis still happens one file at a time.
The overhead of stitching context across DLLs manually is one of the most underappreciated costs in reversing.
Frontier vs. open-source for binary analysis:
Frontier wins on deep reasoning tasks. Open-source wins on speed, cost, and staying inside your network.
Most reversing workflows need both. The skill is knowing which task goes where.
REcon is tomorrow
We'll be there talking about running reversing agents that don't lose the plot halfway through a stripped binary.
Find us. #REcon2026
Zenyard is coming to Binary Ninja. 🥷
Binary Ninja has become home to some of the most innovative researchers in the space and it was just a matter of time before we launched here.
Kyle Martin from @vector35 , Yuval Luria and Ziv Brandstein from Zenyard on June 24th for a live stream.
We'll show the full workflow on a real target: whole-binary analysis, renaming across the entire file, multi-file analysis and asking the agent questions grounded in full-binary understanding.
👉 youtube.com/live/JG15oxrWgp0…
Frontier models are powerful. They're also the wrong tool for most tasks inside a binary analysis workflow.
One 50MB sample, analyzed end to end with a frontier LLM: slow, expensive, and still needs manual verification.
Break it into focused tasks. Route each to the right model. The cost drops by ~10x.
That's how Zenyard works.
Zenyard Agent analyzed a Go-compiled Linux launcher that embeds LinPEAS-ng, decodes it at runtime, and feeds it into a shell over stdin.
The payload runs without a dropped script or temporary second-stage file.
The launcher also adds immediate hostname beaconing to an AWS Lambda endpoint with a fixed User-Agent: linpeas.
Full analysis: zenyard.ai/blog/pipe-fed-lin…
Zenyard Agent analyzed NeTiS beyond propagation.
Old-school botnet logic is easier to recognize.
Cloudflare-aware beaconing is harder to ignore: browser-shaped HTTP behavior that parses and reuses cf_clearance cookies.
Part 2 follows NeTiS into encrypted C2 and Cloudflare-aware beaconing.
Full analysis: zenyard.ai/blog/netis-cloudf…
We gave Zenyard Agent a MIPS ELF with no prior context.
It uncovered how one infected device can stage payloads across 9 architecture families, cycle through fallback downloaders, kill rival processes, masquerade as httpd, and prepare encrypted C2.
NeTiS shows how a MIPS IoT bot can become a launchpad for a mixed-architecture fleet.
Read Part 1: zenyard.ai/blog/netis-iot-bo…
Connecting an LLM to a decompiler can speed up local checks. But tool access alone does not create binary understanding.
The hard part is building and maintaining context across functions, structures, call chains, and missing information.
Full breakdown on where MCP-style reversing workflows break down, and why tool access alone is not enough for reliable binary analysis: zenyard.ai/blog/mcp-reverse-…
Zenyard Agent analyzed the RAT beyond unpacking and into its custom decryption layers and raw TCP protocol.
Every generated session tag ended with the low byte 0x99, giving defenders a stable protocol-level hunting pivot.
The analysis follows the RAT into its decryption layers, C2 protocol, attribution boundaries, and detection opportunities.
Full analysis: zenyard.ai/blog/environmenta…
The key point: changing runtime conditions can change what the malware decrypts.
Full analysis: zenyard.ai/blog/environmenta…
This sample does not rely on one signal. Not one file, not one process, not one network indicator. We focused on what actually persists across execution. Wrapper structure, resource tampering, and protocol behavior.
Full breakdown: zenyard.ai/blog/symbiote-loa…
#MalwareAnalysis
How is Zenyard Agent different from MCP? 🤔
MCP workflows struggle with real binaries. They operate on snippets, lose context, and tend to hallucinate. Zenyard Agent analyzes entire binaries end to end and keeps explanations grounded in full context.
zenyard.ai/why-zenyard
We gave our Agent a PE with no labels and reconstructed the execution flow. What came out was not just a loader, but a propagation system that turns trusted binaries into carriers.
Deep dive: zenyard.ai/blog/symbiote-loa…
