Pinned Tweet
The slides and the code for my @reconmtl talk “Seeing Through Themida’s Code Mutation” are available:
- Slides: github.com/ergrelet/themida-…
- Deobfuscator Code: github.com/ergrelet/themida-…
Took some time to improve a few things on WinDiff (added permalinks, filtered out empty results) and added a Claude skill to use WinDiff to produce quick security-oriented diff analyses between binary/OS versions. Feel free to try!
github.com/ergrelet/windiff
Erwan Grelet retweeted
We released a few more video of Recon 2024. @oliverlavery @_revng @ergrelet @lauriewired @allthingsida @buherator youtube.com/@reconmtl recon.cx #reverseengineering #cybersecurity
Have a good weekend!
Erwan Grelet retweeted
Canada avoided Economic war with USA. Recon 20th year anniversary will be announced in the next few days. June 23-29 2025. #recon #reverseengineering #re #Security #cyberpunk
Erwan Grelet retweeted
Curious about the inner workings of the ADB server-to-device protocol? Check out our second blogpost about ADB internals.
synacktiv.com/publications/d…
Erwan Grelet retweeted
🚨 NEW 🚨 In late October, Kamala Harris' security team had evidence of spyware on at least two staff iPhones.
They asked Apple for help getting deeper access to the iPhones.
Apple declined.
Harris and her team still have no idea if they were hacked.
forbes.com/sites/thomasbrews…
Erwan Grelet retweeted
My blog post is now live alongside @amnesty 's joint release, providing remarkable insight into an ITW exploitation campaign!
googleprojectzero.blogspot.c…
Turns out that you can find out quite a bit with just some kernel stacktraces ;)
From Amnesty:
securitylab.amnesty.org/late…
Erwan Grelet retweeted
New: Cellebrite is being used as doorway to install malware. Amnesty finds multiple cases where police used Cellebrite to unlock phone; cops then used that access to infect with spyware which takes screenshots, turns on mic, etc, give phone back to target 404media.co/cellebrite-unloc…
Erwan Grelet retweeted
Important news: Microsoft is working to bring SMAP into Windows
Good and interesting presentation by Joe Bialek:
Pointer Problems – Why We’re Refactoring the Windows Kernel:
youtube.com/watch?v=-3jxVIFG…
#microsoft #windows #kernelsecurity #programming
Erwan Grelet retweeted
I have a little X-mass gift for you all... #PEsieve 0.4.0 is out: github.com/hasherezade/pe-si…
Erwan Grelet retweeted
What happens when Random() isn’t random?
Here’s how popular projects, including Proton Wallet and the Dart SDK were all affected by the same underlying weakness we uncovered in the Dart/Flutter ecosystem.
All issues found were responsibly disclosed with the vendors.
Let’s go 🧵👇
Erwan Grelet retweeted
There are some new MBA obfuscation papers:
Poster: E-Graphs and Equality Saturation for Term-Rewriting in MBA Deobfuscation: An Empirical Study (dl.acm.org/doi/pdf/10.1145/3…)
X-MBA: Towards Heterogeneous Mixed Boolean-Arithmetic Deobfuscation (doi.org/10.1109/MILCOM61039.…)
Erwan Grelet retweeted
Updated #TinyTracer (v2.9) is out: github.com/hasherezade/tiny_… ! Now you can trace indirect #syscalls, and dump context before each logged instruction.
Erwan Grelet retweeted
🔬NEW: efiXplorer v6.1 [#BHEU Edition]
- [plugin] annotations/quality of pseudocode
- [plugin] detection of variables based on Hex-Rays
- [loader] UEFI firmware unpacking
- [loader] updated deps.json and images.json formats
- support for IDA SDK v9.0
github.com/binarly-io/efiXpl…
Erwan Grelet retweeted
We recently decided to share hrtng IDA Pro plugin with the community and published its source code on GitHub – in this article we want to demonstrate how our plugin makes it easier for a malware analyst to reverse engineer complex samples securelist.com/hrtng-ida-pro…
Erwan Grelet retweeted
#ESETResearch is hiring a senior malware researcher for our 🇨🇦office. If you’d like to track some of the most impactful APTs/cybercrime campaigns, don’t wait and apply here 👇
jobs.eset.com/int/job-offer/… 1/3
Erwan Grelet retweeted
HyperDbg v0.11 is released! ✨
This version comes with bug fixes, improvements, and two new commands for viewing Local APIC (XAPIC/X2APIC) and IO APIC.
Big shoutout to @0Xiphorus for joining the team for bringing PCIe support to HyperDbg!
github.com/HyperDbg/HyperDbg…
Erwan Grelet retweeted
Special thanks to @_nnaci who last Friday gave a presentation at the rev.ng hour (our weekly technical meeting) about Mergen, its LLVM-based deobfuscation project.
Interesting stuff, check it out!
github.com/NaC-L/Mergen
Erwan Grelet retweeted
Excellent series on Qemu and TCG internals, by @AirbusSecLab
airbus-seclab.github.io/qemu…
Erwan Grelet retweeted
We're deep diving on vulnerabilities in ClipSp, the driver at the core of Windows' Client License Platform. Read the latest research here: cs.co/6016tOpB8
