Takahiro Haruyama

唇亡歯寒

[Takahiro Haruyama @cci_forensics]

Due to some missing links on the conference web pages, I uploaded my conference talk pdfs for 10 years. Time flies. https://t.co/XENk1SC1lJ

[Takahiro Haruyama @cci_forensics]

Finalized my submission. Fingers crossed

[eversinc33 🤍🔪⋆｡˚ ⋆ @eversinc33]

Spent the last 2 weeks working on a devirtualizer for VMProtect 3.5 and learning Remill. Idk yet if I will blog about it, but I at least wanted to publish the code:

https://t.co/GLqKWpOOU7

The approach is different from my last blog, as it lifts the whole x86 code of the VM

[kernullist @kernullist]

I’ve tried a few plugins that use LLMs to clean up Hex-Rays pseudocode, but none of them really fit my workflow, so I started building my own.
My main focus is Windows kernel driver analysis, so this one is tuned for that use case.

Left: raw Hex-Rays output
Right: output from my plugin

Current features:
- Uses a WDK-header-based kernel API profile for functions, enums, structs, and macros
- Reconstructs common kernel patterns like LIST_ENTRY traversal, CONTAINING_RECORD, critical regions, and pool alloc/free
- Converts numeric literals into symbolic names for NTSTATUS, pool flags, pool tags, etc.
- Simplifies noisy Hex-Rays casts and pointer arithmetic into struct fields and kernel macros
- Renames cleanup, failfast, and error labels into meaningful control-flow targets
- Combines deterministic rules with LLM assistance instead of relying only on the model

If there’s interest, I’ll share more soon.

[lukas seidel @pr0me]

the nice thing about symbolic execution is that every potential bug site comes with an input reaching it, but building harnesses is laborious.

with SAILOR, a new paper combines static analysis with LLMs to automate this process

[Yibo Liu @34r7hm4n]

Rust reverse engineering is about to get a lot easier. 🦀

I'm thrilled to announce that Oxidizer, the first Rust decompiler, has been officially merged into angr!

Try it out: https://t.co/D9ILIgVH1K

You can also find the paper here: https://t.co/k97qZRvEAm

[Zion Leonahenahe Basque @mahal0z]

For years, Rust binaries made reversing a nightmare. Modern decompilers only support C, lacking meaningful types, constructs, and language-specific functions. Led by @34r7hm4n, we're releasing our S&P work Oxidizer, the first deep Rust decompiler, built on angr!

Interested? 🧵👇

[Satoshi Tanda @standa_t]

@LxlxIxlxlxL @Oppenheim3r In the spirit of helping others learn and enjoy this fascinating technology, I have been working on free materials. Hopefully, I can start the beta this year, and you will find it helpful.
https://t.co/ibJhawki8C

[lukas seidel @pr0me]

so claude mythos seems to be solving context collapse and vulnerability validation for source code but I wonder if that will hold true for binary analysis, too.

a recent paper looks to improve dynamic reasoning<->tool interaction cycles with feedback-driven analysis:

[MachineHunter @InfPCTechStack]

BIOS 周りの研究でよくキーワードとして上がる SMM (ring -2), S3 BootScript, SMM Deprivileging などを全体的に繋げて解説しました。

「SMM の脆弱性が見つかった」と報告があった場合、自分は影響あるのか、どう被害が出るのか がわかるようになるかと思います

[Eric Hartford @QuixiAI]

Last week, Anthropic announced Project Glasswing alongside Claude Mythos Preview, a model they described as so powerful at finding vulnerabilities they couldn't release it. The announcement featured AWS, Microsoft, Google, and Apple as partners, $100M in compute credits, and a clear message: this is dangerous, and only we can be trusted to deploy it safely.

The results were real. Thousands of zero-days across every major OS and browser. A 27-year-old bug in OpenBSD. A 16-year-old bug in FFmpeg. Fully autonomous exploit chains that would have taken human researchers weeks.

But here's what bothered me: all the credit went to the model.

Read the technical blog carefully and a different picture emerges. The real innovation isn't the model. It's the workflow:

- Rank every file in a codebase by attack surface
- Fan out hundreds of parallel agents, each scoped to one file
- Use crash oracles (AddressSanitizer, UBSan) as ground truth
- Run a second verification agent to filter noise
- Generate exploits as a triage mechanism for severity

That's a pipeline. And pipelines are model-agnostic.

At Lazarus AI, we spend our days deploying custom AI in places where "just use the closed API" isn't an option: regulated industries, enterprise, and government. When I saw Glasswing, my instinct was the same one I have every week: strip out the proprietary model, keep the architecture, run it on whatever model is best for the customer.

Clearwing is a fully open-source vulnerability discovery engine. Crash-first hunting, file-parallel agents, oracle-driven verification, variant hunting, adversarial verification. Works with any LLM.

I tested it with OpenAI Codex 5.4 and reproduced Glasswing's findings. I'm now reproducing results with our own ReAligned model - Qwen3.5 finetuned to Western alignment.

Mythos is certainly a great model. The N-day exploit walkthroughs in Anthropic's blog show real reasoning depth. But it's an incremental improvement over Opus, the same way Opus was over Sonnet, and Sonnet over Haiku. It's not a leap to superintelligence. It's the next point on a curve we've been watching for years.

What actually changed the game was the workflow.

Defenders shouldn't have to wait for access to a gated model to secure their software. These vulnerabilities have been sitting in codebases for decades. The tools to find them should be available to everyone: the open source maintainer running FFmpeg on a Saturday, the startup that can't afford $125/M output tokens, the researcher in a country where Anthropic doesn't operate.

Clearwing is MIT licensed and available now.

https://t.co/E0WP5njZQJ

Clearwing enables a wide variety of security activities. Handle with care. It is sharp.

[Robert Yates @yates82]

I wrote a thing. if you are interested in obfuscation/de-obfuscation and compilers, but perhaps don't have a tangible experience with it, then i hope this story will be interesting to you and teach a few things along the way (-:

[Sam Thomas @xorpse]

We're pleased to announce a new release of our #Rust bindings for @HexRaysSA IDA Pro! This release adds compatibility with latest SDK, and introduces a Rust-native interface for developing plugins. https://t.co/VAyv0oGP20

[Vaishnavi @_vmlops]

GOOGLE BUILT A SECRET WEAPON FOR FILE DETECTION

they ran it internally for years, gmail, drive, safe browsing, hundreds of billions of files every week

then they open sourced it

it's called magika and it exposes what files really are, not what they pretend to be

rename malware to "resume.pdf"? magika sees through it
disguise a script as an image? magika sees through it
any trick attackers use with file extensions? magika sees through all of it

ai trained on 100 million files. 200+ content types. 99% accuracy. 5ms per file

one command
`pip install magika`

the same tool protecting google's billion users is now protecting yours

https://t.co/Jr3LjmQobq

[BINARLY🔬 @binarly_io]

Today, we’re introducing Binarly Risk Score (BRS), a new risk prioritization system designed to help security teams cut through scanner noise and focus on what matters most. https://t.co/43cf56REim

[Anthropic @AnthropicAI]

You can read a detailed technical report on the software vulnerabilities and exploits discovered by Claude Mythos Preview here: https://t.co/AgU6ltV2qW

[Xeno Kovah @XenoKovah]

@ryanaraine I do. https://t.co/OWvx9J6tag, https://t.co/SW1s7VGtDa

[Joe Desimone @dez_]

We open sourced the tool used to detect the Axios supply chain compromise! I built it Friday after a red eye home from RSAC. Also, wrote up the full story, including the hectic moments after that first critical alert
https://t.co/HAm8eMr8vO

[lukas seidel @pr0me]

source code for XTRIDE, our type recovery lib in rust, is now online!

incl. docs, data pipelines and instructions to reproduce our results, and a standalone poc

https://t.co/YeS5fM61fD

[YONEUCHI, Takashi @lmt_swallow]

リリースノートはこちら。あまりに場が荒れているので、週明けのリリース予定を巻き、投入することにしました。
https://t.co/D8MkzVILea
新規パッケージフィードの全量解析エンジン（誰かがインストールする前にマルウェアを発見する仕組み）の調整、ターゲット予見に集中します。ウオ〜

[Brian Baskin @bbaskin]

A long delayed release of Noriben v2.0.3.
Now can do post-collection analysis from a Mac or Linux box (w/ file hashing disabled). This saves from having to spin up a Win VM just to rerun reports.

Better hashing and file checking due to edge case of pipes

https://t.co/RWK7QGGmvx