REhints

sharing reverse engineering knowledge

[REhints @REhints]

New #CodeXplorer v2.1 [IDA7 Edition] released! Changelog: multiple bugfixes, added gcc Virtual Tables and RTTI parsing, improved Linux and macOS support. https://t.co/NnIFg376VQ #REhints

[Alex Matrosov @matrosov]

MCP is slow for RE-heavy projects and, in some cases, is unstable.

ghidra-rpc is way faster than MCP and scales more efficiently in a multi-agent setup, since it outputs structured JSON.

[quarkslab @quarkslab]

Practical Android Software Protection in the Wild: An Appetizer

In which @Farenain analyzes 2.5 million Android apps to identify and classify the obfuscators, packers and code protectors they use:

https://t.co/xKQGrK2qxI

[guyru @guyru_]

We're mostly an IDA shop at @CellebriteLabs, but I decided to play around with Ghidra. My main motivation was to experiment with agentic reverse engineering techniques. The result is an agent skill for Ghidra, which we are releasing publicly:
https://t.co/mPrNFR8mOq >>

[Rodrigo Branco @bsdaemon]

That is crazy! I do not believe there are any excuses for the overall behavior. I am extremely disappointed that Microsoft thinks this is acceptable at all and that a (non-)apology suffices @msftsecresponse @MSFTBlueHat @Microsoft

[Stefan Esser @i0n1c]

Looks like @Binary_Gecko has published my blog post about putting a KASAN style MTE tag map into the kernel panic output of macOS. https://t.co/7u0osOQGqo

[Linux Kernel Security @linkersec]

Logic bug in the Linux kernel's __ptrace_may_access() function (CVE-2026-46333)

Article about a logical bug in ptrace implementation that allows getting access to file descriptors of other processes and thus escalating privileges in certain scenarios.

https://t.co/s5jkzBpV36

[Zion Leonahenahe Basque @mahal0z]

Agents need better tools for reversing! I'm releasing declib (previously libbs), with a new CLI today that gives agents CLI access to 4 decompilers (IDA, Ghidra, Binja, angr), parity feature support to most MCP (12 features), and the ability to sync those changes across decs!

[Alex Matrosov @matrosov]

Time-to-Exploit has changed significantly for n-days, especially in OSS projects, where the code changes in the fix can serve as a harness for PoC creation.

There’s effectively zero time to apply updates, the MTTR metric has a negative value nowadays. Defense in depth definitely helps by adding layers to buy some time, but in general, old threat models are becoming irrelevant.

[Xeno Kovah @XenoKovah]

I was going to make this same point: “Is there even such thing as Security Through Obscurity” anymore? “I” (Claude) made short work of some DexProtect-ed Android app the other day to extract info I needed

[Dino A. Dai Zovi @dinodaizovi]

This is a critical point for defenders to get: "Beyond the acceleration in vulnerability research and malware analysis, the same new reality applies to software protection, and security by obscurity, or assuming the attacker is limited in compute and motivation, no longer works."

[solst/ICE of Astarte @IceSolst]

NYC folks: https://t.co/y1GRMOl37x meetup this Thursday @ Etsy, 10+ lightning talks, registration link above! Our biggest one yet!

[Tim Blazytko @mr_phrazer]

I fully agree: even targets such as anti-cheats and gaming DRMs have become significantly easier to analyze with agents, if you know how to guide them and validate their results.

@nicolodev and I will about that at @reconmtl:

https://t.co/SYeix8evn4

[POC_Crew @POC_Crew]

[#POC2026 NOTICE]

Your offensive conference is BACK again in its shape!
and POC2026 begins in a new home.

⏰ Date: November 12–13
📍 New Venue: The Westin Seoul Parnas, Korea 🇰🇷

👨‍🏫 CFT: June 1 – June 26
🎙️ CFP: June 1 – September 30
🎟️ Registration: September 1 – October 31

More info 👉 https://t.co/LP1W4KC4vY

[offensivecon @offensive_con]

Interested in becoming a speaker at Offensivecon Tokyo? You have three months to submit your talk on an innovative offensive security topic.

More information here 👉️ https://t.co/ynVQnUBDrj

[Sanjay Rawat @tosanjayr]

Dyn Taintflow Analysis (DTA) - one of the main components of VUzzer (NDSS 2017) - finally got the re-engineering I'd been postponing for years.
Several ideas had been stuck in my notebook ever since. 1/n

[Calif @calif_io]

RedSun: Exploiting Windows Defender's Remediation Workflow for Local Privilege Escalation

Just showing some appreciation for @ChaoticEclipse0's excellent work. Hopefully this won't get us banned!

https://t.co/Z4zbaa2Jcd

[Marcel Böhme👨‍🔬 @mboehme_]

When the verifier's model of computation is different from the implemented computation.

[Linux Kernel Security @linkersec]

StepStone: LLM-Based GPU Kernel Driver Fuzzing via User-Space Libraries

Paper by @ETenal7 et. al about using LLMs for generating syzkaller descriptions for fuzzing GPU drivers via their userspace libraries APIs.

https://t.co/vhF9E8kY2j

[Alex Matrosov @matrosov]

Previous generations of software protection (DRM perspective) have always relied on code complexity (for RE), compute limitations, and human limitations as the guarantees that kept hacking timelines reasonably long.

That's changed now. Beyond the acceleration in vulnerability research and malware analysis, the same new reality applies to software protection, and security by obscurity, or assuming the attacker is limited in compute and motivation, no longer works.

[chompie @chompie1337]

Security research reporting is kinda the only situation where an individual has any power over a corporation. What goes unsaid: the researcher could easily sell exploits on the grey market and get rich. Most report out of morals, lowk a refusal to contribute to cyberwarfare. Vendors relying on those morals to bully are happily prodding good people until they crack