Giovanni Lagorio

I was watching a presentation [1] on @REverseConf 2026 and I learned an anti-emulation trick that uses x87 FPU quirks. It is used by an anti-cheat engine (as part of an MBA). Here you go, it detects Unicorn: github.com/packmad/fprem-… [1] youtube.com/watch?v=3LtwqJ…

RE//verse 2026 talks are live on YouTube! Want to revisit a talk or catch the ones you missed? The full playlist is now available: youtube.com/playlist?list=…

pagedout.institute ← we've just released Paged Out! zine Issue #7 pagedout.institute/download/Paged… ← direct link lulu.com/search?page=1&… ← prints for zine collectors pagedout.institute/download/Paged… ← issue wallpaper Enjoy! Please please please RT to spread the news - thank you!

So, these threat actors successfully phished an author of multiple open source NPM packages with a total of 2 billion weekly downloads – including debug, chalk, and ansi-styles. Since most companies run at least one React or Angular app, they had the opportunity to execute code on millions of systems across thousands of orgs. And they used it to drop an amateurishly obfuscated crypto stealer, got caught by basic detection rules, and the issue was remediated after 2 hours. I hope everyone understands how close this was – and can imagine what would’ve happened if someone with real skills had done it. #NPM #Compromise #SupplyChain

New #TinyTracer (v3.0) is out - with many cool features: github.com/hasherezade/ti… - check them!

Big news: Windows Subsystem for Linux is now Open Source! 🎉 Download WSL, build from source, contribute fixes & features, and join its active development. Learn more: msft.it/6018SjYoE

Hello hackers! Another @pwncollege semester ends, continuing @ASU's @ace_inst's never-ending quest to revolutionize the way hackers learn to become productive members of the cybersecurity community. Read on to learn what this means for students and Capture the Flag! 🧵

My new article, "Writing a Full Windows ARM64 Debugger for Reverse Engineering," covers the topic in detail, including its internals and the core differences between Windows on Intel and ARM64: keowu.re/posts/Writing-…

"dos-like" is a mini-engine/framework I made a couple of years ago. It makes it easy to make games and other things with a 90s MS-DOS look and feel, but using a modern C compiler and running on Windows, Linux, macOS and in the browser using WebAssembler.

Learn to write a WinDbg extension: youtu.be/ly-nZjuLNkw

"A calculator app? Anyone could make that." Not true. A calculator should show you the result of the mathematical expression you entered. That's much, much harder than it sounds. What I'm about to tell you is the greatest calculator app development story ever told.

It's finally here! Ghidra 11.3 dropped with built-in support for Python 3 through Pyhidra. Let's go! #pyghidra" target="_blank" rel="nofollow noopener">github.com/NationalSecuri…

Last Thursday, I gave a webinar on anti-reverse engineering techniques like obfuscation, anti-debug, anti-tamper etc, including practical examples. Recording, slides and examples are now available. youtube.com/watch?v=Ie1eZS… github.com/emproof-com/we…

DataExplorer is a plugin for @x64dbg that integrates the pattern language from @WerWolv's ImHex. You can quickly visualize data structures in memory!

The last release of #TinyTracer for this year: v2.9.5 : github.com/hasherezade/ti… . Added ability to follow child processes (thanks to @red5heep). Improved tracing of #VMProtect - protected executables.

New #HollowsHunter (v0.4.0) is out: github.com/hasherezade/ho…. Now you can use it in the classic mode, as well as in ETW mode - as a multi-threaded listener. The watched events can be defined by a simple profile - but it is just a beginning...

FLARE is releasing a tool today that I've been working on over this year that helps break down binaries into smaller functional clusters and uses Gemini to describe their relationships, behavior and the overall malware functionality. It's called XRefer and it is out for you to read about and try out. Check out the write up here, and look below for some examples: cloud.google.com/blog/topics/th…

Releasing full 2+hr video of my browser exploitation workshop from VXCON 2024: youtube.com/live/b9OhamkAY… In which I show what goes inside the mind of a skilled hacker while exploiting a highly non-trivial vulnerability in v8, from zero to exploit concept. Especially this workflow requires advanced abstract thinking, thereby emphasize the role of theoretical modeling in attacking hard zeroday research targets, which is a part of why it's fun. @zerodaytraining

New #TinyTracer (2.8) is out: github.com/hasherezade/ti… - including some new AntiVm/AntiDebug bypasses, and other useful features 😊

For the first time in ages, new challenges are being added to CryptoHack. To make up for lost time we're adding 50 new challenges including two whole new sections dedicated to zero-knowledge proofs and isogenies. blog.cryptohack.org/new-challenges…