allthingsida

All things IDA, security, reverse engineering, programming, AI and more. Friend and fan of Hex-Rays but non-official.

[allthingsida @allthingsida]

@kernullist has been doing great releases recently. Keep up the good work!

[kernullist @kernullist]

Released PseudoForge 0.1.0.

An IDA Pro / Hex-Rays plugin built for Windows kernel driver analysis.
It cleans up raw decompiler output with rule-based passes, WDK-backed API profiles, user-defined rules, and optional LLM rename assist that is kept behind deterministic validation.

Current focus:
- DriverEntry reconstruction hints
- IRP / IOCTL dispatcher cleanup
- CTL_CODE and NTSTATUS decoding
- WDK API argument semantics
- pool tag recovery
- LIST_ENTRY traversal
- CONTAINING_RECORD patterns
- callback registration flows
- common kernel cleanup paths

This is still a very early release, so expect rough edges. 😆
repo: https://t.co/BZJfKNfcGX

[eversinc33 🤍🔪⋆｡˚ ⋆ @eversinc33]

Spent the last 2 weeks working on a devirtualizer for VMProtect 3.5 and learning Remill. Idk yet if I will blog about it, but I at least wanted to publish the code:

https://t.co/GLqKWpOOU7

The approach is different from my last blog, as it lifts the whole x86 code of the VM

[allthingsida @allthingsida]

I made a video for the first 30 years. Catch up if you want.

https://t.co/UXIgQj8xUR

[Hex-Rays SA @HexRaysSA]

🎂 IDA Turns 35.
From DOS-era disassembler to one of the most widely used reverse engineering platforms in the world...

To celebrate, we’re launching:
• 35% off new licenses (see eligibility requirements)
• Limited-edition swag giveaway
• “35 Ways to Use IDA” as told by you
• Stories from the past and a few for the future

Read all about it here:
https://t.co/cyC3gUXK1x

[Yibo Liu @34r7hm4n]

Rust reverse engineering is about to get a lot easier. 🦀

I'm thrilled to announce that Oxidizer, the first Rust decompiler, has been officially merged into angr!

Try it out: https://t.co/D9ILIgVH1K

You can also find the paper here: https://t.co/k97qZRvEAm

[allthingsida @allthingsida]

@gerhart_x @Microsoft Indeed. With tools like IDASQL or GhidraSQL you can recover the source code better than the original ;)

[allthingsida @allthingsida]

@matrosov @halvarflake @brucedang @dyn___ That’s the hope to make it more efficient than code snippets or a new set of functions (MCP approach). LLMs know SQL very well on top of that. I have a lot to improve in the (ida|binja|ghidra)sql space and unify them. I am working on it.

[allthingsida @allthingsida]

@matrosov @halvarflake @brucedang @dyn___ Indeed. You can just fully RE with a Ralph loop or equivalent and with the proper connectors. All automated.
Binaries are the new source code ;)

[allthingsida @allthingsida]

@yates82 Then having to fix your clock to compensate for the time you spent in Ctrl-D.
Don’t forget to get the patch to enable ring0 mp3 player too ;)
Good old days.

[allthingsida @allthingsida]

Thanks @Steph3nSims for hosting. I enjoyed showing the capabilities of libghidra and ghidrasql to create AI based reverse engineering workflows.

While the “sql” wording can be confusing, ghidrasql can equally do everything, if not more than your favorite MCP you already use.

[Stephen Sims @Steph3nSims]

Automated Reverse Engineering with LibGhidra, GhidraSQL, and AI Agents https://t.co/OnCpJwznzI

[Stephen Sims @Steph3nSims]

The stream below with @allthingsida is tomorrow (Friday) at 11AM PT!

[Hex-Rays SA @HexRaysSA]

New training updates, plus Spring discounts:
• On-demand Starter → 20% off with code STR20
• AI-powered Intermediate → 40% off (May 12) with code AI-INTER40
• Malware, Decompiler & Programming → 30% off with code SPRING30

Details + course breakdown: https://t.co/S2kbRfxGcJ
*Limited time offer, check blog for expiration dates!

[REcon @reconmtl]

REcon is right around the corner. Early-bird training pricing has been extended, and conference tickets remain at March rates until May 11.

Conference: June 19 to 21 2026
Training: June 15 to 18 2026
Location: Montreal, Canada

Heads up: hotel booking cutoff is next week too.

If you live in IDA, Ghidra, or a debugger, this is your conference. https://t.co/HCSvjRS3aR #REcon #RE #reverseengineering #InfoSec

[eversinc33 🤍🔪⋆｡˚ ⋆ @eversinc33]

Made a little experiment of lifting IDA microcode to z3 to automatically resolve opaque predicates. It works quite well on a few malware families I tested on.

In the gif you can see Lumma stealer's opaque predicates being solved automatically:

[allthingsida @allthingsida]

https://t.co/Okf8njohl8

[allthingsida @allthingsida]

Ok, ida-frustrated 0.0.2 has now some cool animations and scenes. Press Ctrl-Alt-T in any widget to get a random visual. It really would uplift the frustration! ;)

[allthingsida @allthingsida]

Put together a "frustrated" mode for IDA ;p

(Still working out the animation quirks)

[allthingsida @allthingsida]

@takaiAr Ctrl-B too, etc. ;)

[allthingsida @allthingsida]

libghidra was needed for the ghidrasql project which will complement idasql and bnsql.

You can grab the 0.0.1 (alpha) release from here: https://t.co/rzM5KAXcJb. 9/9

[allthingsida @allthingsida]

I've been building libghidra: a typed SDK for automating Ghidra from C++, Python, and Rust (mainly for AI agents). Decompile, rename, comment, inspect symbols/types/xrefs, save, close, and reopen projects from code. Treat Ghidra like infrastructure, not just a GUI.

Under the hood this is a typed API surface over a Ghidra host/extension. The same core workflows exist across C++, Python, and Rust, so you can use it for quick scripts, larger pipelines, or native tooling. 1/n

[allthingsida @allthingsida]

libghidra can run Ghidra’s native decompiler engine from a normal C++ executable: no Java process, no UI, no HTTP server. The build embeds the processor specs, and the app can open a binary, list functions, decompile, rename, type, and inspect data offline. 8/n

[allthingsida @allthingsida]

Have fun, show me your craziest animations! ;p

https://t.co/Okf8njohl8

[allthingsida @allthingsida]

Put together a "frustrated" mode for IDA ;p

(Still working out the animation quirks)

[allthingsida @allthingsida]

Put together a "frustrated" mode for IDA ;p

(Still working out the animation quirks)

[allthingsida @allthingsida]

I did not know Ghidra does that. Sorry, if this is silly, I stumbled upon it by accident.