Rt.

[cr3ghost @cr3ghost]

Themida turns a few lines of code into thousands of VM handler instructions. Completely unreadable.

back engineering built a static devirtualizer that lifts it all to IR, resolves the control flow, and recovers the original logic.

The before/after in the repo is genuinely shocking.

Works on pretty much any VM obfuscator, not just Themida.

Blog: https://t.co/fY4YkY2aH3
Devirt output: https://t.co/p2gkKi1vXp

Author: @BackEngineerLab

#ReverseEngineering #InfoSec #Malware

[Hex-Rays SA @HexRaysSA]

Plugin Contest winners used it. Binarly built award-winning Rust bindings with it. BinSync added an idalib mode for headless pipeline support...

... Now it's your turn.

We're hosting a free virtual workshop on idalib — IDA as a library. Call IDA's analysis engine directly from your own code, automate workflows without launching the GUI, and integrate IDA into any toolchain you're already running.

Free. Virtual. Hands-on.
👉 https://t.co/WHQyp8rxf1

[Back Engineering Labs @BackEngineerLab]

Static Devirtualization of Themida/CodeVirtualizer. The techniques in this article apply to pretty much every virtual machine obfuscator with minor modifications.

https://t.co/RMvPKcv3KB

Original Program & Devirtualized Output

https://t.co/R8hLk9ISRZ

[winterknife 🌻 @_winterknife_]

Updated KernelToUserInjector kernel driver to get around ALLOCVM, WRITEVM, PROTECTVM, QUEUEUSERAPC ETW threat intelligence sensors.
Find the sample EtwTi logs in Misc dir.
https://t.co/QtylOFJifH

[Guy Leech @guyrleech]

Confirmed! Took a process dump of the parent msedge process, used SysInternals strings utility searched for a known password and there it was! Don't share @MicrosoftEdge process dumps !!

[Rt. @rt10_07]

We are "Biological Bootloader" for "Silicon Successor". -- AI's take.

Damm 😲

[kernullist @kernullist]

A new update to the WinDbg LLM decompiler extension adds Zydis-based structured disassembly, SSA-lite recovery, RIP/IAT awareness, and PDB-based type and name hints. Decompiler output in WinDbg should now read a bit more naturally and hold together more consistently.
https://t.co/WFDyKqA2HG

[x64dbg @x64dbg]

There is also a pre-alpha Linux version brewing 👀

[allthingsida @allthingsida]

I've been building libghidra: a typed SDK for automating Ghidra from C++, Python, and Rust (mainly for AI agents). Decompile, rename, comment, inspect symbols/types/xrefs, save, close, and reopen projects from code. Treat Ghidra like infrastructure, not just a GUI.

Under the hood this is a typed API surface over a Ghidra host/extension. The same core workflows exist across C++, Python, and Rust, so you can use it for quick scripts, larger pipelines, or native tooling. 1/n

[Rt. @rt10_07]

I see few people including the author of #RedSun himself asking questions why would AV write the malicious file back. To this I want to say the virus cleaning happens in the same way across all AV. If detection is a Virus first it would try to disinfect and if fail restore it

[vx-underground @vxunderground]

Another zero day exploit released by some nerd (can't remember name right now) because they're annoyed with Microsoft. It's been confirmed by other nerds. It is yet another legit zero day. Whew.

https://t.co/Zllhns1ztn

[allthingsida @allthingsida]

Reposted on my channel: https://t.co/ofuWP1UtQk

[ς๏гєɭคภς0๔3г ([email protected]) @corelanc0d3r]

New Post: Debugging - WinDBG(X) Automation & Scripting - Part 1 https://t.co/4E19TTdDQJ

[Jacob Paullus @psycep_]

gopacket is live! Check it out, it is intended to be a full reimplementation of Impacket in Go (it is in beta please send me bug reports) https://t.co/9XjTickbyA

[Rt. @rt10_07]

I think many other AV vendors are likely vulnerable to this same attack pattern. Defender was the target here and being roasted while other AV quietly patch their product. Tech at this level is almost similar across the board.

[vx-underground @vxunderground]

Another zero day exploit released by some nerd (can't remember name right now) because they're annoyed with Microsoft. It's been confirmed by other nerds. It is yet another legit zero day. Whew.

https://t.co/Zllhns1ztn

[Rt. @rt10_07]

@EvilSecOfficial @vxunderground Btw who know how many vendors are vulnerable to similar attack pattern. I am sure Defender is not the single one but it’s the target here and others will quietly fix it. The tech across AV at this level is nearly similar.

[Huntress @HuntressLabs]

The Huntress SOC is observing the use of Nightmare-Eclipse's BlueHammer, RedSun, and UnDefend exploitation techniques.

Investigation by: @wbmmfq, @Curity4201, + @_JohnHammond 🧵👇

[Rt. @rt10_07]

@ChaoticEclipse0 Btw is the true that this has to be running on the machine for quite some time before a new update is downloaded. if so, then isn't that a big enough window to get this detected via cloud etc.

[Justin Elze @HackingLZ]

Neat https://t.co/9FJ1tIirVR

[Josh Stroschein | The Cyber Yeti @jstrosch]

LIVE - Workflow Optimizations in IDA Pro with @allthingsida (Elias Bachaalany) https://t.co/qRKb80pHRU

[Silky @S1lky_1337]

My BlueHammer version ( now redhammer) implements my VDM version patch, deploys and loads the BYOVD for my exploitkit.
It bypasses the new signature for BlueHammer aswell. How is this still unpatched?