mastodon 4.8.0-alpha.3+glitch
New blog post: Building a Pipeline for Agentic Malware Analysis
Agentic RE + malware analysis with custom skills, MCP tooling, and persistent case state to automate intial triage
Link: https://synthesis.to/2026/03/18/agentic_malware_analysis.html
Github: https://github.com/mrphrazer/agentic-malware-analysis
We at emproof open-sourced a free firmware reverse engineering workshop for self-study.
Topics: ELF analysis, cracking, malware triage, embedded-Linux, bare-metal, crypto-key extraction, anti-analysis. Docker setup and solutions included.
https://github.com/emproof-com/workshop_firmware_reverse_engineering
RE: @mr_phrazer@infosec.exchange
I also published my Ghidra Headless MCP that follows similar design principles: https://github.com/mrphrazer/ghidra-headless-mcp
The recording of my first Binary Cartography webinar is now public:
Agentic Reverse Engineering: How AI Agents Are Changing Binary Analysis
Topics: keygenning, cracking & anti-tamper removal
Recording: https://www.youtube.com/watch?v=DZcDaXTvDeE
Slides/code/samples: https://github.com/mrphrazer/binary-cartography/tree/main/2026-03-agentic_reverse_engineering
Recently my RE workflow moved into sandboxed VMs where agents have full control over the environment. I needed an MCP server that runs headless in the same sandbox and exposes way more of the #BinaryNinja API than others.
Here's the release: https://github.com/mrphrazer/binary-ninja-headless-mcp
Happy to bring my Software Deobfuscation Techniques training back to @recon@infosec.exchange - June 15–18, 2026 in Montreal!
Learn systematic approaches to defeating modern obfuscation found in DRM/anti-tamper & APT malware.
https://recon.cx/2026/en/trainingSoftwareDeobfuscationTechniques.html
The recording of our (CC @nicolodev@infosec.exchange talk "Breaking Mixed Boolean-Arithmetic Obfuscation in Real-World Applications" at @recon@infosec.exchange is now online!
Recording: https://www.youtube.com/watch?v=QxSGWk3MqaQ
Slides: https://synthesis.to/presentations/recon25_mba_obfuscation.pdf
#BinaryNinja Plugin: https://github.com/mrphrazer/obfuscation_analysis
New #BinaryNinja plugin: Obfuscation Analysis
Simplifies arithmetic obfuscation (MBA) directly in the decompiler (see demo below). Also identifies functions with corrupted disassembly.
Co-authored by @nicolodev@infosec.exchange ; available in the plugin manager.
Check it out: https://github.com/mrphrazer/obfuscation_analysis
The new version of my #BinaryNinja plugin Obfuscation Analysis (v1.2) adds recursive function inlining in the decompiler.
It collapses call-heavy code into a single function; analysis, constant propagation, DCE and other analyses work across boundaries.
The slides from our @recon@infosec.exchange talk, "Breaking Mixed Boolean-Arithmetic Obfuscation in Real-World Applications" (CC @nicolodev@infosec.exchange are now online!
Slides: https://synthesis.to/presentations/recon25_mba_obfuscation.pdf
New chapter: I've transitioned to a part-time Chief Scientist role at Emproof.
I’m shifting my focus to my independent work in reverse engineering:
trainings • consulting • tooling • research
Details: https://synthesis.to
Thanks to @elykdeer@bird.makeup and the @binaryninja@infosec.exchange team for having me on the AI vs AI Binary Ninja stream. Great discussion on agentic RE, tooling, and feedback loops.
RE: @mr_phrazer@infosec.exchange
Agentic reverse engineering can do a lot, but obfuscation still breaks many analysis workflows in malware and commercial software.
If you want to learn how to build & steer automation for analyzing protected code, check out my training at @recon@infosec.exchange
https://recon.cx/2026/en/trainingSoftwareDeobfuscationTechniques.html
Tomorrow at 3:30 pm, Nicolò Altamura and I will present our talk “Breaking Mixed Boolean-Arithmetic Obfuscation in Real-World Applications” at @recon@infosec.exchange
Details: https://cfp.recon.cx/recon-2025/talk/BKBQ37/
Plugin release: https://github.com/mrphrazer/obfuscation_analysis
Happy to present "Unleashing AI: The Future of Reverse Engineering with Large Language Models" with @mu00d8@infosec.exchange at
@recon@infosec.exchange We'll cover current & future RE applications, running offline models and enhancing results by merging LLMs with static analysis.
https://recon.cx/2024/presentations.html
#reverseengineering #malwareanalysis #malware #AI #LLM #REcon2024
Happy to share that later today (Friday, Nov 14, at 10:00 PM CET / 16:00 ET), I’ll be live on the #BinaryNinja livestream to talk about (anti-)reverse engineering & code (de)obfuscation. I'll also showcase some of my plugins.
New heuristic in my #BinaryNinja plugin obfuscation_detection:
Duplicated Subgraphs uses iterative context hashing to spot repeated multi-block code. We merge each block’s signature with its successors over multiple rounds for efficiency.
At @recon@infosec.exchange , @nicolodev@infosec.exchange and I discuss the current state of MBA (de)obfuscation and their applications. We’ll also introduce a new #BinaryNinja plugin for simplifying MBAs in the decompiler.
Details: https://cfp.recon.cx/recon-2025/featured/
I'll also give a training: https://recon.cx/2025/trainingSoftwareDeobfuscationTechniques.html
My class on code deobfuscation at REcon Montreal (June 24-27) is now open for registration! Learn how to analyze obfuscated code and break it by writing custom tools using symbolic execution, SMT solving, and program synthesis.
Details & Register: https://recon.cx/2025/trainingSoftwareDeobfuscationTechniques.html
Excited to teach my class on software deobfuscation in Paris at @hexacon_fr@bird.makeup Oct 6–9, 2025!
Learn advanced techniques to defeat state-of-the-art obfuscation in DRMs & APT malware.
https://www.hexacon.fr/trainer/blazytko/
#reverseengineering #malware #malwareanalysis #softwaresecurity