Aftermath Labs

Building

[Aftermath Labs @aftermath_labs]

Using BLARE2 for binary instrumentation to guide fuzzing via coverage. Seems to work well, two discord/chromium crasher media files in 30min~

We can instrument arbitrary PE files (no source or debug info needed).

https://t.co/NsjY0iipl3

[Aftermath Labs @aftermath_labs]

Static Devirtualization of Tencent VM. There are many others with similar results to ours, we have had the VM devirtualized for several months now. Others are posting full devirt bins, so we feel it is ok to release our research now.
https://t.co/0Aog04fEvv

[Aftermath Labs @aftermath_labs]

Static Devirtualization of Themida/CodeVirtualizer. The techniques in this article apply to pretty much every virtual machine obfuscator with minor modifications.

https://t.co/RMvPKcv3KB

Original Program & Devirtualized Output

https://t.co/R8hLk9ISRZ

[Aftermath Labs @aftermath_labs]

@belabs_engineer has released a binary polynomial MBA explorer. You can check out the website here: https://t.co/ScOvVQfGBY

[Aftermath Labs @aftermath_labs]

Very impressive independent research into modern software obfuscation used by Anti-Cheats, conducted by @belabs_engineer and @belabs_james

https://t.co/BgIaMamm2R

[Aftermath Labs @aftermath_labs]

We’re releasing our analysis of https://t.co/cAmTrO7mvx, a major game cheat targeted by multiple studios in recent legal actions. We partially deobfuscated several Themida-protected components and document how it hijacks Hyper-V to inject and manipulate game code.

https://t.co/ykGrHdl6ty
https://t.co/LhEXxeIcnF

[RE//verse @REverseConf]

Bas Zweers (@belabs_engineer) and James McGowan (@backengineerlab) bring a look at a real world commercial binary obfuscator to RE//verse 2026. This talk walks through analysis and custom tooling to peel back obfuscation on Windows kernel mode anti cheat and ends with a full taxonomy of its tricks. Get your ticket: https://t.co/mcEALrFHCj

[Aftermath Labs @aftermath_labs]

We released a VirtualBox snapshot that includes a custom ntoskrnl.exe and bootmgfw.efi obfuscated with CodeDefender. The snapshot and the protected binaries are available on our GitHub: https://t.co/CSexrtTycM

[Aftermath Labs @aftermath_labs]

@frizkedblizz @_xeroxz https://t.co/CSexrtTycM

[Aftermath Labs @aftermath_labs]

The next generation of binary obfuscation for the Windows platform is now public. No source code annotations required, full SEH support, CET support, ACG compliant.

Join the Discord: https://t.co/2JDzzbKDB0
Website: https://t.co/hYi7XHizo9

[Aftermath Labs @aftermath_labs]

We have reached a pivotal point in our business journey with CodeDefender. After much consideration we have decided to refocus our attention towards our quickly expanding B2B customer base. Public access to the CodeDefender SaaS will no longer be available after 09/30/2025.

If you have a subscription or keys that last after the aforementioned cutoff date please reach out to us to be reimbursed. You can contact us on this Discord or by email: [email protected].

If you have a CodeDefender subscription and can articulate a legitimate use-case, please reach out by Discord or Email and include a short description for the intended use of CodeDefender.

This only applies to the CodeDefender SaaS, the CodeDefender discord will remain open to the public as a place of technical discussion mainly centered around obfuscation.

[Aftermath Labs @aftermath_labs]

We have recently released a small side project called "Tether" which explores post-compilation extraction of instructions for exclusive server execution.

https://t.co/0viHibG0m4

[Aftermath Labs @aftermath_labs]

❗️ We discovered a bug in Microsoft's driver compliance checks which are used to determine if "Memory Integrity" can be enabled on a system.

❌The function "vsbapi!HvciIsDriverImage" is comparing an RVA against the raw file size.

https://t.co/CoaHNWT3RY

[Aftermath Labs @aftermath_labs]

🧰 CodeDefender API and CLI are live

Protect binaries from the terminal or Rust SDK

Upload → Analyze → Obfuscate → Download

YAML configs give full control over passes, symbols, and transform logic

🔗 https://t.co/aavdmgdPsW
📔 https://t.co/Jo0Zf6vBGT

[Aftermath Labs @aftermath_labs]

🚀 CodeDefender SDK now supports source-level macros!

Obfuscate functions in Rust/C/C++ by tagging them with your pre-defined obfuscation profile.

🦀 #[codedefender("Profile1")]
💻 CODEDEFENDER("Profile1", ...)

Docs + examples 👉 https://t.co/AYm6zcvcTc

#infosec #rustlang #obfuscation

[Aftermath Labs @aftermath_labs]

Our CodeDefender SaaS has received a major update which includes the following:

🛠️Our new and improved compiler framework
💥SSE hardened mutations
🚀New UI/UX interface
💪Custom obfuscation pass configuration
🔗Register now: https://t.co/7xp43sCIwv

#reverseengineering #gamesecurity

[Aftermath Labs @aftermath_labs]

What has BELabs been up to ⁉️
Check out these new SSE based obfuscations. 🫣
We have completely rewritten our compiler from the ground up to pave the way for ARM support. ✅

This has allowed us to make the world's strongest bin2bin obfuscation framework even stronger.💪
The new compiler will roll out on the SaaS for all customers soon. 👀

[GuidedHacking @GuidedHacking]

Can your bin2bin do this and still boot?
https://t.co/hOe9KDXSTf can.

See it in action with a demo at the end!
👉https://t.co/ExRwrQDLW1

[GuidedHacking @GuidedHacking]

🚨 How are the geniuses at @BackEngineerLab revolutionizing binary obfuscation with https://t.co/hOe9KDXSTf?

Learn about the unique challenges & solutions in bin2bin, virtualization & anti-tamper.

See CodeDefender in action with a demo at the end!

👉https://t.co/ExRwrQDLW1

[GuidedHacking @GuidedHacking]

what is CodeDefender and who is the handsome man in the corner?

find out tomorrow when we drop our interview with the @BackEngineerLab team

[Aftermath Labs @aftermath_labs]

Given the recent events with VMPSoft DMCA'ing educational YouTube videos demonstrating how to unpack malware protected with VMProtect, we have decided to release a free to use unpacker which works for all versions of VMP 3.x including the most recent version.

Simply sign up/login here: https://t.co/7xp43sCIwv and then click on "Unpacker" on the top right corner.

For context:
https://t.co/8z6V6232YN https://t.co/kHm3O764FL https://t.co/T9EyF53FEV

[herrcore @herrcore]

lol vmp, really? 🤡