estrellas
@CryptDeriveKey
Followers
361
Following
4K
Media
50
Statuses
547
Reverse engineer mostly interested in SAT/SMT solvers, Program Analysis, and Obfuscation. Views are my own.
Joined March 2020
Lately I've been working in my very own binary lifter... As part of the documentation process, I decided to write a few words about my implementation of static recovery of a given function's control flow graph. Hope you enjoy it! https://t.co/4e1tBzWlYv
2
11
46
Additional info on the Fancy Bear kit being reported on. Cheers to @Laughing_Mantis for writing backdoors so good that APTs plagiarize it. https://t.co/4mBI2jNY34
kroll.com
Kroll has observed GONEPOSTAL malware used in an espionage campaign attributed to KTA007 (Fancy Bear, APT28). Read more
0
11
28
My latest analysis of #XWORM's new delivery method just got published! You can read it at: https://t.co/FboSytSQS5
kroll.com
A known cyber threat called XWORM is using a new method using Ghost Crypt to infect computers, hiding inside a seemingly harmless but fake PDF reader app. Read More.
0
1
8
Our ongoing research about a drive-by compromise that affects even pre-installed versions of the application just had its first part released! You can read it at:
kroll.com
Beginning in early April 2025, Kroll has observed a large wave of malicious activity surrounding "PDFast" software. It is highly recommended to remove installations of PDFast and block the domains...
0
1
7
Graph Theory for Reverse Engineers Or “everything actually is a nail, you just need a bigger hammer”
remyhax.xyz
Or “everything actually is a nail, you just need a bigger hammer” Graph Theory is a really neat subject matter relating to the modeling of pairwise relations between objects. When you understand...
4
53
230
CAPE Sandbox exposes an HTTP endpoint ( http://localhost:8000/browser_extension) used to log HTTP trafifc. You can detect CAPE by sending a dummy HTTP request to this endpoint and checking the response. You can then craft fake HTTP data and it’ll show up on VirusTotal.
1
6
55
SE resulting in substantial crypto theft. Initial payload was a very large (700mb+) .msi. Two new samples named, some oleview.exe sideloading fun as well. Little shoutout to @C5pider 's HavocFramework project. https://t.co/hYZwfwmEVk
kroll.com
During the investigation of a large-scale crypto currency theft, Kroll researchers discovered two new pieces of malware. These pieces of malware ultimately lead to the deployment of Havoc C2’s agent...
1
3
16
Spent the last week working on a tool to help the process of manually deobfuscating https://t.co/cGGEZvmPEp's output... https://t.co/2JGuJaytQ7
github.com
Rename variables previously renamed by "obfuscator.io", that is, renaming "_0x1234" into "v1", for example. This process helps the manual deobf...
2
8
39
Here are the details about the AMD Signature verification vulnerability we worked on, Enjoy! https://t.co/b9CPWqIEzO
bughunters.google.com
This blog post covers the full details of EntrySign, the AMD Zen microcode signature validation vulnerability recently discovered by the Google Security team.
2
56
232
https://t.co/JE68XbHamM Our newest research project is finally public! We can load malicious microcode on Zen1-Zen4 CPUs!
github.com
### Summary Google Security Team has identified a security vulnerability in some AMD Zen-based CPUs. This vulnerability allows an adversary with local administrator privileges (ring 0 from outside...
13
282
811
Disassembly algorithms are often a trade-off. My new blog post analyzes linear sweep and recursive traversal, exploring their strengths and weaknesses in a self-built disassemblers. https://t.co/sUbGyyKFOY
nicolo.dev
Building your own set of analysis tools is a great exercise for those who already have some basics and allows you to later move on to implement more targeted analyses in reverse engineering. Even...
3
51
230
I discuss the creation of Mergen, VM based obfuscations, and explore how compiler techniques are used for reverse engineering and deobfuscation. https://t.co/gAdlXoiX2J
nac-l.github.io
Table Of Contents
2
69
276
We are making a new language to write specifications of an ISA called Mya. Based on the Mya specification, we will automatically generate an assembler and disassembler for the ISA. See:
github.com
[WIP] Mya language specification. Contribute to mya-project/mya-spec development by creating an account on GitHub.
0
3
7