x86byte (@x86byte) header
x86byte (@x86byte) profile picture

x86byte

@x86byte

Security Software Engineer — Windows vuln research & exploits | Reverse Engineer, Obfuscation & De-Obfuscation Practitioner & Compilers Backend 👾🥤

github.com/x86byte
Joined September 2022
  • Tweets182
  • Following688
  • Followers981
27Media
Photo by x86byte (@x86byte)Photo by x86byte (@x86byte)Photo by x86byte (@x86byte)Photo by x86byte (@x86byte)Photo by x86byte (@x86byte)Photo by x86byte (@x86byte)Photo by x86byte (@x86byte)Photo by x86byte (@x86byte)Photo by x86byte (@x86byte)Photo by x86byte (@x86byte)
Just added native @Droid / @FactoryAI support to our open-source firmware reverse engineering toolkit. 5 skills extraction, static analysis, Ghidra, emulation, and security reporting. github.com/OrbitCurve/firmwa…
Image from Hussein Muhaisen (@husseinmuhaisen)
3
11
757
x86byte retweeted
naci (@_nnaci) profile picture
naci@_nnaciOct 13
Wrote up my attempt at deobfuscating Luraph-protected Lua: lifting Lua to LLVM IR , then using AI + partial evaluation to strip the VM, and checking it against the original. nac-l.github.io/2026/10/12/d…

Deobfuscating Luraph: Lifting Lua to LLVM, Then Letting AI Try

Lifting Lua to LLVM IR, why dynamic table operations survive optimization, and recovering Luraph-protected scripts with AI-assisted tooling.

nac-l.github.io
2
31
2
151
7,332
Today we’re soft launching BitBender, a SaaS for automated binary deobfuscation: unpacking, import fixing, OEP restore, and related prep. IDA and Binja MCP are powerful, but packed or obfuscated samples still bog down LLM analysis. BitBender is meant to clear that layer first. Early beta. If you want access, get in touch: bitbender.io
BitBender — Binary deobfuscation & unpacking

BitBender — Binary deobfuscation & unpacking

Automated unpacking and deobfuscation for malware and game-cheat analysis. Built for IDA and Binary Ninja MCP, with expert analysis and full technical reports.

bitbender.io
9
19
109
6,163
Blogpost acerca de como explotar el CVE-2026-81963 con la explicacion del diff y el codigo de un poc basico funcional que eleva a SYSTEM, que por supuesto mejoramos muchisimo en el exploit que releaseamos para Core Impact, pero servira para entender por donde va la cosa. coresecurity.com/blog/cve-20…
5
28
150
13,615
Using BLARE2 for binary instrumentation to guide fuzzing via coverage. Seems to work well, two discord/chromium crasher media files in 30min~ We can instrument arbitrary PE files (no source or debug info needed). github.com/aftermathlabs/dis…
GitHub - aftermathlabs/discord-crasher: Some bugs found via binary instrumentation and fuzzing

GitHub - aftermathlabs/discord-crasher: Some bugs found via binary instrumentation and fuzzing

Some bugs found via binary instrumentation and fuzzing - aftermathlabs/discord-crasher

github.com
1
11
1
74
6,023
x86byte retweeted
Stefan (@schteppe) profile picture
Stefan@schteppeSep 15
Select all the squares with Undefined Behavior
Image from Stefan (@schteppe)
13
24
1
289
13,556
Compiled #V8 bytecode is still a niche #malware format, but it highlights a broader analysis problem: what happens when a payload falls between established toolchains? At #BlackHat2026, I’ll walk through the #JSCeal case study and the static deobfuscation toolkit I built to recover readable code. If you’ll be at #BlackHat, I’d be glad to see you there! blackhat.com/us-26/briefings…
Image from hasherezade (@hasherezade)
7
31
127
9,944
Static Devirtualization of Tencent VM. There are many others with similar results to ours, we have had the VM devirtualized for several months now. Others are posting full devirt bins, so we feel it is ok to release our research now. back.engineering/blog/31/07/…
Image from Aftermath Labs (@aftermath_labs)
3
94
1
506
27,859
Compiled V8 bytecode malware is a blind spot for defenders. At #BHUSA, @hasherezade shows how Check Point Research broke down JSCeal and built an open source toolkit that decoded 15/15 payloads, offering a repeatable approach to bytecode threats. blackhat.com/us-26/briefings…
Image from Michael Gazzano (@michael_gazzano)
2
6
2
60
5,482
This stuff needs to be fixed pronto. @X @nikitabier @elonmusk Security research is not a violation, there's a reason this place is heavily used and has been heavily used for the security industry to promote defense and offense. If X continues to ban legitimate security professionals, researchers, I'm out of this place for sure.
Steve S. (@0xTriboulet) profile pictureSteve S.
@0xTribouletJul 7
Replying to @X
@X @nikitabier @elonmusk I am once again asking you to review your policies and procedures around offensive security research.
Image from Steve S. (@0xTriboulet)
24
68
10
404
40,366
x86byte retweeted
Smukx.E (@5mukx) profile picture
Smukx.E
@5mukxJul 4
Replying to @github
@github Can you take a look at this? It's been 2 weeks. Either respond or cancel the request and issue a refund for my GitHub Pro subscription. ID => #4474854
3
1
38
4,047
Static Devirtualization of Themida/CodeVirtualizer. The techniques in this article apply to pretty much every virtual machine obfuscator with minor modifications. back.engineering/blog/09/05/… Original Program & Devirtualized Output github.com/backengineering/t…
Image from Aftermath Labs (@aftermath_labs)
Image from Aftermath Labs (@aftermath_labs)
8
96
2
413
26,287
Always happy to see more people get into LLVM-based deobfuscation!
Image from Duncan Ogilvie 🍍 (@mrexodia)
eversinc33 🤍🔪 (@eversinc33) profile pictureeversinc33 🤍🔪@eversinc33May 8
When practicing on a VM crackme recently, I created a devirtualizer which lifts the virtual machine to LLVM to defeat the protection. LLVM-based devirtualisation is a lot of fun and I wrote down my experience and lessons learned on my blog: eversinc33.com/2026/05/07/ll…
1
5
112
7,129
Someone just dropped a pre-built, fully jailbroken IOS 26 virtual machine. You can test tweaks and exploits without ever risking your real Iphone. It comes ready-to-run with rootless, Sileo, Filza, and TrollStore vibes. 100% Open Source.
Image from Simplifying AI (@simplifyinAI)
11
107
7
1,064
73,751
Replying to @belabs_engineer
@belabs_engineer has released a binary polynomial MBA explorer. You can check out the website here: tools.codedefender.io/
Image from Aftermath Labs (@aftermath_labs)
Image from Aftermath Labs (@aftermath_labs)
12
69
5,073
Unlocking Modern CPU Power - Next-Gen C++ Optimization Techniques - Fedor G Pikus - C++Now 2024: (video) youtube.com/watch?v=wGSSUSea… (slides) github.com/boostcon/cppnow_p… #cybersecurity #optimization #cpu #cpp #informationsecurity #processor
Image from Alexandre Borges (@ale_sp_brazil)
34
217
8,605
#APT36 Letter to BEL by Def Secy.xlam Letter to Indian Coast Guards by Def Secy.xlam db1b11b63d631e2d0cebdefb322c2e7a cisf[.]ink /mod.pptx /mysite .zip (Password@2025) #HiBit.exe #Golang 53.85MB 2ad4d0a366a51f3c0b70c7967994909f #C2 85.137.249[.]243:8080 CN=shareef @500mk500
Image from Sathwik Ram Prakki (@PrakkiSathwik)
Image from Sathwik Ram Prakki (@PrakkiSathwik)
Image from Sathwik Ram Prakki (@PrakkiSathwik)
Sathwik Ram Prakki (@PrakkiSathwik) profile pictureSathwik Ram Prakki@PrakkiSathwikJan 22
#APT36 #TransparentTribe #Phishing #APT 1/ ppt regarding DRDO-Larsen & Toubro (L&T) Projects Details.ppam f1b6c9239fc1eb4f777d9cd13d01fc12 defenceindia[.]site BRO_India_Projects_Details.7z ebda2b7bb07893b2315e38cacad352bd VRDE-LandT-Strategic-Collaboration.pptx (gamma decoy)
Image from Sathwik Ram Prakki (@PrakkiSathwik)
1
8
1
28
7,053
3
51
2,666
-> zerodaycommission.com/rop-on…
3
10
780
x86byte retweeted
matteyeux (@matteyeux) profile picture
matteyeux@matteyeuxMar 4
The repo I am sharing contains JS files, shellcode blobs and mach-o files containing the implants github.com/matteyeux/coruna
2
36
1
180
17,394
Load more