Miasm

[Miasm @MiasmRe]

@Farenain Great! You will have a second implementation to look at soon in miasm-rs 😉

[ESET Research @ESETresearch]

While there are several frameworks for #reverseengineering that provide features we needed to see
through Wslink’s virtual-machine-based obfuscator, we used @MiasmRe in this project simply because
it’s actively maintained and we’re already familiar and satisfied with it. 4/5

[Miasm @MiasmRe]

@_trou_ It's more and more difficult to "manually" address problems generated by tools : 25 years ago, obfuscation, optimizations or even program size had "human size". Now, most of them are tool generated (even source code). So we also have to use tools to be able to solve them.

[Miasm @MiasmRe]

Little update: based on the great @NCCGroupInfosec blog post (https://t.co/p1yqEKuxiZ), we added color support for IR and ASM graph output: Thank you guys !

[newsoft @newsoft]

@MiasmRe you have a fan :) https://t.co/nlCbzIwzgt

[Miasm @MiasmRe]

@newsoft Great Post!

[Hash Miser @H_Miser]

I finally decided to publish my complete toolset written for Tinynuke analysis

You'll find config and injects grabber, dll extractors, Ghidra deobfuscation scripts and @cea_sec miasm based scripts

https://t.co/p0G9F9VCXC

#Tinynuke #ReverseEngineering #Malware

[Miasm @MiasmRe]

@crackin76726107 Hum, as Miasm is a framework, I would answer "as the user has decided to implement it" :)
To be honest, the picture gives nearly no clue. Is it code flattening?

[Miasm @MiasmRe]

@BincatLady @moyix Yes, the core algorithms are re-coded in Rust to improve speed (Jitter / Lifter / code analysis / ... ) and to clean APIs a bit :)
But bindings allow python scripting currently!

[Miasm @MiasmRe]

@crackin76726107 Yes, you have a nice one there: https://t.co/WU2E5Y7WkI

[Tim Blazytko @mr_phrazer]

Giving the workshop on code deobfuscation was great fun. Thanks for your active participation! #HITB2021AMS

Check out code, slides and samples here: https://t.co/t9Iyowl0Zf

[Miasm @MiasmRe]

@crackin10554874 Hi @crackin10554874, can you be a bit more precise for example on the Miasm gitter ?
https://t.co/PPVWwrUf1n

[Tim Blazytko @mr_phrazer]

Giving the workshop on code deobfuscation was great fun. Thanks for your active participation! #HITB2021AMS

Check out code, slides and samples here: https://t.co/t9Iyowl0Zf

[Miasm @MiasmRe]

Congratulation, you both succeeded in:
- resolving the challenge
- writing a great tutorial on how to add a custom architecture in Miasm & exploit the IR!

[Suraj Malhotra @MrT4ntr4]

Writeup for FCSC CTF 2021 - 'VMV'
"Defeating Nested Virtualization with @MiasmRe"
https://t.co/P6PzwceLDn

I explain how to write a custom architecture in Miasm and then use some pattern detection logic to solve the challenge.

This took most of my time, Hope you guys like it!

[Tim Blazytko @mr_phrazer]

If you want to learn more about control-flow graph construction, analysis and loop detection, check out my slide deck. I also wrote a blog post on how these concepts can be easily explored with @MiasmRe.

https://t.co/JQB9girC7l

[Tim Blazytko @mr_phrazer]

A good example of automatic code deobfuscation based on pattern matching is stadeo by @ESET. They use @MiasmRe to automatically remove control flow flattening for the stantinko malware family.

https://t.co/KbZ2UpR8SC

[Miasm @MiasmRe]

@mr_phrazer @r2gui Great workshop Tim!
Hopefully, IR translation/symbolic execution/z3 translation will be nearly instantaneous in the @rust version of miasm ;)

[Tim Blazytko @mr_phrazer]

Friday, 19:00 GMT+2 at #r2con2020:

In a live coding, I will use @r2gui and @MiasmRe to automatically identify and remove opaque predicates in an APT malware sample.

Check it out: https://t.co/aSfOpbfUCy

[Adrien Guinet @adriengnt]

Emulating the NotPetya bootloader with @MiasmRe, an article by @la_F0uin3 and myself, translated from an article originally published in @MISCRedac :

https://t.co/WDV0ERuaL1

Code available here: https://t.co/FhM3beStY1

[Miasm @MiasmRe]

@0xrepnz @_sudhackar For a real case symbolic execution example, here is (an old) one: https://t.co/mURdRoVW8n

[Miasm @MiasmRe]

@rh0main Thanks a lot to @w4kfu => the solution was in the redirection by *hash* of Apiset!

[Miasm @MiasmRe]

I am missing something here; On windows 10 15063:
- In kernel32, IsProcessCritical is an export redirected to api-ms-win-core-processthreads-l1-1-2.IsProcessCritical
- no ApiSet for this dll
- in this dll, IsProcessCritical is... a redirected export to kernel32.IsProcessCritical

[Miasm @MiasmRe]

@rh0main If I don't mess up, api-ms-win-core-processthreads-l1-1-2 is not present in the ApiSet, and it's present on the disk (in the downlevel sub dir). So I definitively miss something here.