shell-storm

Reverse engineering and binary exploitation since the 2000s

[Jonathan Salwan @JonathanSalwan]

Bootstraping code coverage on top of the Triton library.
https://t.co/lH2M4OG2Ho

[Jonathan Salwan @JonathanSalwan]

It's now possible to reason on symbolic memory pointers with Triton (QF_ABV logic). This new mode will complexify constraints and increase RAM consumption (at this moment) but at least has the merit of existing :).

https://t.co/aLDykDDrrN

[Jonathan Salwan @JonathanSalwan]

Solution of the NorthSec 2018 MarsAnalytica challenge. Another example of analyzing a virtual machine and a methodology example when analyzing a big binary with Triton.

https://t.co/POjZ5E04K7

[Jonathan Salwan @JonathanSalwan]

Dead code elimination with Triton is now available. Example with VMProtect's junk code: https://t.co/Azd8xJxcH4

[shell-storm @shell_storm]

Since few days the https://t.co/53S8QNZcBg repo is done. So here is the backup https://t.co/XP2xupsM7m

[Jonathan Salwan @JonathanSalwan]

VMProtect Devirtualization: An experimental dynamic approach to devirtualize pure functions protected by VMProtect 3.x https://t.co/NsfnlT4pvC

[shell-storm @shell_storm]

@kmkz_security @offensive_con Said this once at @phdays...

[Jonathan Salwan @JonathanSalwan]

Synthesizing obfuscated expressions when reverse engineering protected binaries is now possible with Triton https://t.co/H3WHk9Ph0d

[Jonathan Salwan @JonathanSalwan]

Microblogging: From an obfuscated binary code to a synthesized LLVM IR. New feature! https://t.co/dkQKDjmPHH

[shell-storm @shell_storm]

Raising the flag!
https://t.co/O9nQaTiAb5

[shell-storm @shell_storm]

Hahaha, what a found! What happens in Moscow stays in Moscow...

[shell-storm @shell_storm]

@milkmix_ Omg ces stickers existent toujours !!!

[The Triton library @qb_triton]

At @quarkslab we are glad to announce the release of Triton v0.8 which brings the ARM32 architecture and much more! Check out the release https://t.co/mFux5crSsa and our blog post describing what's new in the v0.8 https://t.co/M6rFlj71lF.

[Jonathan Salwan @JonathanSalwan]

Manuscrit de thèse et slide sur l'exécution symbolique pour la déobfuscation. Sorry for non french people =(. https://t.co/15Yi1SZFzM & https://t.co/obv5zZbQtz

[quarkslab @quarkslab]

Today is a big day, especially for @JonathanSalwan: he will defend his PhD: symbolic execution for binary deobfuscation. The team is super proud of the long road he walked!

[The Triton library @qb_triton]

After more than 1 year, we are glad to announce the release of Triton v0.7 https://t.co/yTQ2FpXl0A - AArch64 semantics, Android compilation, Python 3.6, bug fixes and much more! @quarkslab is already working on the v0.8 and have some surprises in store =)

[The Triton library @qb_triton]

After more than 1 year from v0.5, the v0.6 of Triton has been tagged as release! https://t.co/ENBCk55PMm - Version 0.7 will focus on AArch64 already in development at @quarkslab!

[Jonathan Salwan @JonathanSalwan]

Paper, slides and results about our talk "Symbolic deobfuscation:
from virtualized code back to the original" https://t.co/GiesBX8psS (few months of work with Quarkslab, CEA-List and Verimag)

[The Triton library @qb_triton]

We just released the v0.5 (https://t.co/1uByiA3PW7). The next version (https://t.co/VtkfKuOQd5) will be a real step forward! Stay tuned.

[Jonathan Salwan @JonathanSalwan]

Slide of our talk about "Deobfuscation of VM based software protection" https://t.co/fAWUcwzj3s && Video [fr] https://t.co/UdY4fBbwFZ #sstic