Erwan Grelet

The slides and the code for my @reconmtl talk “Seeing Through Themida’s Code Mutation” are available: - Slides: github.com/ergrelet/themi… - Deobfuscator Code: github.com/ergrelet/themi…

We released a few more video of Recon 2024. @oliverlavery @_revng @ergrelet @lauriewired @allthingsida @buherator @reconmtl" target="_blank" rel="nofollow noopener">youtube.com/@reconmtl recon.cx #reverseengineering #cybersecurity Have a good weekend!

Canada avoided Economic war with USA. Recon 20th year anniversary will be announced in the next few days. June 23-29 2025. #recon #reverseengineering #re #Security #cyberpunk

Curious about the inner workings of the ADB server-to-device protocol? Check out our second blogpost about ADB internals. synacktiv.com/publications/d…

🚨 NEW 🚨 In late October, Kamala Harris' security team had evidence of spyware on at least two staff iPhones. They asked Apple for help getting deeper access to the iPhones. Apple declined. Harris and her team still have no idea if they were hacked. forbes.com/sites/thomasbr…

My blog post is now live alongside @amnesty 's joint release, providing remarkable insight into an ITW exploitation campaign! googleprojectzero.blogspot.com/2024/12/qualco… Turns out that you can find out quite a bit with just some kernel stacktraces ;) From Amnesty: securitylab.amnesty.org/latest/2024/12…

New: Cellebrite is being used as doorway to install malware. Amnesty finds multiple cases where police used Cellebrite to unlock phone; cops then used that access to infect with spyware which takes screenshots, turns on mic, etc, give phone back to target 404media.co/cellebrite-unl…

Important news: Microsoft is working to bring SMAP into Windows

The library ofc github.com/microsoft/mark…

I have a little X-mass gift for you all... #PEsieve 0.4.0 is out: github.com/hasherezade/pe…

What happens when Random() isn’t random? Here’s how popular projects, including Proton Wallet and the Dart SDK were all affected by the same underlying weakness we uncovered in the Dart/Flutter ecosystem. All issues found were responsibly disclosed with the vendors. Let’s go 🧵👇

There are some new MBA obfuscation papers: Poster: E-Graphs and Equality Saturation for Term-Rewriting in MBA Deobfuscation: An Empirical Study (dl.acm.org/doi/pdf/10.114…) X-MBA: Towards Heterogeneous Mixed Boolean-Arithmetic Deobfuscation (doi.org/10.1109/MILCOM…)

Updated #TinyTracer (v2.9) is out: github.com/hasherezade/ti… ! Now you can trace indirect #syscalls, and dump context before each logged instruction.

🔬NEW: efiXplorer v6.1 [#BHEU Edition] - [plugin] annotations/quality of pseudocode - [plugin] detection of variables based on Hex-Rays - [loader] UEFI firmware unpacking - [loader] updated deps.json and images.json formats - support for IDA SDK v9.0 github.com/binarly-io/efi…

#ESETResearch is hiring a senior malware researcher for our 🇨🇦office. If you’d like to track some of the most impactful APTs/cybercrime campaigns, don’t wait and apply here 👇 jobs.eset.com/int/job-offer/… 1/3

HyperDbg v0.11 is released! ✨ This version comes with bug fixes, improvements, and two new commands for viewing Local APIC (XAPIC/X2APIC) and IO APIC. Big shoutout to @0Xiphorus for joining the team for bringing PCIe support to HyperDbg! github.com/HyperDbg/Hyper…

Special thanks to @_nnaci who last Friday gave a presentation at the rev.ng hour (our weekly technical meeting) about Mergen, its LLVM-based deobfuscation project. Interesting stuff, check it out! github.com/NaC-L/Mergen

Excellent series on Qemu and TCG internals, by @AirbusSecLab airbus-seclab.github.io/qemu_blog/

We're deep diving on vulnerabilities in ClipSp, the driver at the core of Windows' Client License Platform. Read the latest research here: cs.co/6016tOpB8

7-Zip Zstandard Decompression Integer Underflow Remote Code Execution Vulnerability : zerodayinitiative.com/advisories/ZDI…