Malware analyst. Cofounder of @p4_team. No independent thought: ALL opinions belong to my employers, cats. and friends. [email protected] https://xitter.cf/t.co/AeZd6IJwQe
Joined February 2016
- Tweets139
- Following67
- Followers1.7K
- Likes376
Ghidralib development continues: py3 support, binary/asm patching, and symbolic propagation: github.com/msm-code/ghidrali…. I also write docs for people who want to try it. Newest chapter: emulation msm-code.github.io/ghidralib…
#ghidra #reverseengineering
RULECOMPILE - Undocumented Ghidra decompiler rule language. A blog post about how frustration with poor decompilation led me to dive deep into Ghidra's decompiler to discover (and reverse-engineer) - an obscure, undocumented DSL
msm.lt/re/ghidra/rulecompile…
#reverseengineering #ghidra
ALT A image that shows a piece of code. On top there is an expression (param_1 & 1) * 2 + (param_1 ^ 1). On the bottom is a deobfuscated version, param_1 + 1. In the middle there is a custom Ghidra DSL, explained in the post.
🚀Excited to announce ghidralib - a library that makes #Ghidra scripts drastically shorter and easier to write. I've been using it daily for #reverseengineering and decided it’s time to share! Check it out: github.com/msm-code/ghidrali… And the docs: msm-code.github.io/ghidralib… #infosec
Hi #Ghidra users. I've created a quick search/command palette/launcher plugin called "Ctrl+P". You can search for functions, labels, data, bookmarks, focus windows, launch scripts and trigger available action.
github.com/msm-code/GhidraCt…
#reversing #reverseengineering #infosec
Slides (PL) from my yesterday's presentation at @OMHconf
#ohmyhack are here: tailcall.net/static/talks/om…. I've talked a bit about my recent research about stealers in a - hopefully - approachable way.
I had the pleasure to conduct a 1.5 day #workshop about Threat Intel Pipelines and CTI to a room full of security experts during the #ITU Interregional #Cyberdrill for Europe and Asia-Pacific. I hope everyone had fun and maybe see you at the next Cyberdrill.
Finished my #flareon10 today! Fun fact: I used #Ghidra exclusively (no Ida) to solve almost all challenges (two exceptions: Android and PDP-11 Forth). It works great.
Fell in love with typed-config github.com/bwindsor/typed-co…. It's a tiny Python library for reading config from ini files/environment/anywhere, used by mwdb (and maybe mquery soon). Typed, extensible, dependency free. How does it only have 14 stars on GH?!
My theoretical collision attack (and a practical partial collision attack) on StreamHash5 (alternative cryptographic hash function): tailcall.net/posts/streamhas…. 2**90 times faster than the generic birthday attack.
