Salvatore Lazzarone

Software security antagonist.
Currently hacking LLVM for pasta.

@[email protected]

[quarkslab @quarkslab]

Practical Android Software Protection in the Wild: An Appetizer

In which @Farenain analyzes 2.5 million Android apps to identify and classify the obfuscators, packers and code protectors they use:

https://t.co/xKQGrK2qxI

[0xor0ne @0xor0ne]

Exploring the relationship between compilers, obfuscation, and de-obfuscation through LLVM, by Robert Yates (@quarkslab)

https://t.co/7rfwhEczcz

#infosec

[0xor0ne @0xor0ne]

Exploring the relationship between compilers, obfuscation, and de-obfuscation by Robert Yates (@quarkslab)

https://t.co/7rfwhEczcz

#infosec

[0xor0ne @0xor0ne]

"From Zero to QEMU: A journey into system emulation"

https://t.co/bYgH3zq83f

Credits Antonio Nappa

#infosec #qemu

[Elastic Security Labs @elasticseclabs]

LLMs have gotten good enough at reverse engineering to recover source code from obfuscated binaries with real accuracy.

So we asked the obvious next question: how fast and cheap is it to use one to build obfuscation specifically designed to beat it?

We benchmarked Claude Opus 4.6 against the Tigress obfuscator across 20 targets first, to map its strengths and failure modes. 40% solve rate. Phase 3 multi-layer combos hit 0%, with cost explosions that killed the runs.

Then we ran a dev/test/refine loop to build 3 purpose-built obfuscation variants targeting the same crackme, iterating directly against the model's known weaknesses.

The finding: LLM-targeted obfuscation is fast and cheap to develop. Context windows, budget caps, and shortcut biases are all exploitable attack surfaces.

The arms race just shifted.

[Joe Fioti @joefioti]

You've heard of loop unrolling, now get ready for loop rolling.

[Calif @calif_io]

MAD Bugs: All Your Reverse Engineering Tools Are Belong to US

Ghidra, radare2, IDA Pro, and Binary Ninja Sidekick. If your tool doesn't show up here, it's not cool enough. Contact us for a free RCE.

https://t.co/PsCenNMKtI

[kernullist @kernullist]

Just shipped a WinDbg x64 extension that turns live disassembly into verified pseudocode via LLM — chunked multi-pass analysis, in-process HTTP, mock fallback, and a verification pass that cross-checks LLM output against original analysis facts.
https://t.co/8rXb1fGOuT

[allthingsida @allthingsida]

I've been building libghidra: a typed SDK for automating Ghidra from C++, Python, and Rust (mainly for AI agents). Decompile, rename, comment, inspect symbols/types/xrefs, save, close, and reopen projects from code. Treat Ghidra like infrastructure, not just a GUI.

Under the hood this is a typed API surface over a Ghidra host/extension. The same core workflows exist across C++, Python, and Rust, so you can use it for quick scripts, larger pipelines, or native tooling. 1/n

[allthingsida @allthingsida]

Ok, ida-frustrated 0.0.2 has now some cool animations and scenes. Press Ctrl-Alt-T in any widget to get a random visual. It really would uplift the frustration! ;)

[Daax @daaximus]

I decided to commit another part to the Applied Reverse Engineering series with an article diving into rolling your own primitive tracer for discrete purposes; coupled with an analysis on outrunning integrity checks.

https://t.co/GjIZpjhVzw

[Peter Meerwald-Stadler @pmeerw]

preprint from Thales/INRIA Rennes, proposing the Rumba algorithm:
A Mathematical Framework for MBA simplification
https://t.co/Zr9DofKYd6

[Trail of Bits @trailofbits]

99.86% of 73K+ obfuscated expressions, simplified. CoBRA is a new open-source tool that handles four types of Mixed Boolean-Arithmetic obfuscation where existing tools fail. 🧵

[Synacktiv @Synacktiv]

Deep dive into the provisionning an on-prem low-privileged #LLM stack, with air-gapped networking and GPU-isolation, hardened down to kernel modules.

What could possibly go wrong?

Read the full article here: https://t.co/OS4clOUn2N

[Peter Meerwald-Stadler @pmeerw]

new MBA article: Unifying Mixed Boolean-Arithmetic Obfuscation by Architectural and Anti-Generalization Hardening https://t.co/nMDOAk1tZK

[Tur.js @Tur24Tur]

For anyone dealing with RASP protected apps, frida-strace is now your first step. Trace the syscalls, find what the app checks, hook those specific
functions, bypass. No more guessing. Frida 17.8.0+, kernel 6.1+ required.

#Frida #MobileSecurity #AppSec

[SSTIC @sstic]

Préparez vos outils, le challenge SSTIC sortira le mercredi 15 avril 2026 !

[lander @landaire]

https://t.co/o0NWcWpqKd

[Ricardo Carvalho @crvvdev]

If you're interested about anti-cheat reverse engineering then please checkout my very detailed and rich article about EMACLAB Anti-cheat.
This anti-cheat software is used in Counter-Strike 2 league called GamersClub, pretty popular in South America.

https://t.co/jLmbpAfVSG

[lukas seidel @pr0me]

the full preprint is available here: https://t.co/E7NNP9Y4wZ

source code will be made available soon!

also thank you to my co-authors @xorpse @binarly_io @mlsec @bifoldberlin