David Álvarez

#TeamGen malware analyst 🖖 (Norton, Avast, Lifelock, MoneyLion...) | Author of the book Ghidra Software Reverse Engineering for Beginners

[David Álvarez @wormable]

🚀 Ghidra 12.1 released!

Major update with improved decompiler analysis, Dockerized Ghidra, enhanced debugger/emulation support, new filesystem & processor features, and additional security hardening across the 12.x branch.

⬇️ Download
https://t.co/lKPHvUAjqi

#Ghidra #Cyber

[hasherezade @hasherezade]

New release: #PEbear 0.7.2: https://t.co/AsAbJGR9nb - with important bugfixes and new features:

[kernullist @kernullist]

Released v0.0.8 of windbg-decompile-ext.
This update adds a native dark decompile viewer for WinDbg, cached function browsing, and persistent replay for previously analyzed targets.
repo: https://t.co/8rXb1fGOuT

[allthingsida @allthingsida]

My talk "SELECT * FROM binary - Vibe Reversing Across IDA, Ghidra, and Binary Ninja" got accepted at @reconmtl .

I am happy to talk about this toolset (idasql, bnsql and ghidrasql) and how it is designed to allow AI agents to work across all these top 3 reverse engineering tools.

Point Claude, Codex, or your favorite agent to any single one or all of them at once, and allow your agent can now use the tools all at once to analyze one or more binary at once.

These work nicely with loops like "/goal" to allow e2e analysis over many hours.

Use cases:
- Full source code recovery (with types and code structure)
- Full database annotations (also with type recovery, comments, etc.)
- Binary diffing
- Or just any kind of Q&A against your binary or binaries

https://t.co/ohevK9zzxn

[Chetan Nayak (Brute Ratel C4 Author) @NinjaParanoid]

Have been spending quite a good amount of time on the BRC4 2.6 release. So many new techniques, new smaller implant, new evasion methods, better QOL etc.. Whats funny is that the hard part wasn't the research, its the integration and testing. 😪 Might finally get some peace time after this release is done!

[Jonas L @jonasLyk]

The attack also works on physical machines- use a usb to com cable- get one that dont require its driver to download.

It works all the way back to windows xp.

I have no azure account-but I think that the emm driver is auto loaded even in not RE there.
You can then without logging in still dump any process to none encrypted drive.
ps. booting in safe mode dont trigger tpmlock but downgrade lsaiso to just ppl.
pps. without login can also kill ppl process like defender.
3 times it stop starting again.

[Jonas L @jonasLyk]

https://t.co/AeIdwj23cp

[PagedOut @pagedout_zine]

We are looking for sponsors for the upcoming Issue #9 of Paged Out!
If you know anyone who would be interested, send them to our page - https://t.co/aNXJkV9Q9w

[Zero Day Engineering @zerodayalpha]

New Zero Day Engineering research: Chrome Exploit Mitigations, by @alisaesage https://t.co/vMRAk24Zhi

[Bernardo Quintero @bquintero]

aquí con mi padrino tecnológico, el gran Felipe Romera

cuando en 1999 escribí un email al PTA buscando una oficina para montar Hispasec, me convocó en su despacho y me regaló dos libros: uno sobre cómo crear un plan de empresa y el otro, su novela

desde entonces, siempre cerca

[Gen Threat Labs @GenThreatLabs]

As we're observing active development of #Vidar, we're releasing a config extractor for the newest Vidar builds, together with an #IDA string decryption script.

Vidar has been actively developed in recent months, changing its versioning from 18.7 back to 1.0, with the latest builds now at 1.8. But the versioning was not the only thing that changed. Starting from version 1.5, Vidar was reworked, including a new string encryption mechanism, config protection, and additional anti-sandbox checks.

The released config extractor and string decryption script support versions 1.5 and later, as this is where a major rework was done. Previously, each string had its own single-byte XOR key. In versions 1.5+, each string is encrypted with a custom ChaCha-based stream cipher, using a per-string 44-byte key blob and a final single-byte XOR. As for config protection, earlier versions used a custom polyalphabetic substitution over a permuted alphabet with a position-dependent offset, whereas the new versions use a plain 16-byte repeating-key XOR, with the key stored right next to the encrypted blob. Apart from the XOR-encrypted config, Vidar also features a fallback config, which is resolved separately within the encrypted strings.

Vidar configuration extractor ↓
https://t.co/Vx67uGUqoJ

Vidar IDA string decryption script ↓
https://t.co/QnC38IBBmL

IoCs:

af992d4a96d5fcbdf3b0cd1783234ceb5ad9c2037349ec8a82e6d1aa7f2f0148 (Vidar v18.7)
4ed9e2f720e4f23ff0e57a1a032152f0452008da3447b7265d780cee3221c027 (Vidar v1.0) <--- Vidar changed versioning of their builds
ec6f4f05575a6e7401e167a8a0f2506a6755c2d832deb63a0a5ff027d5ee6c5d (Vidar v1.1)
5788e98d4f9dd24f6ff9797832229c9096cadd108aaabef8d6737aad111f77c6 (Vidar v1.2)
f9ef434791a0b9b8b5f2472a666febbbef46dc5bc196706173fa2111909fae10 (Vidar v1.3)
e130a62564efaff95fb43590e431114bb384a2a94215d07da6ce696c7709a369 (Vidar v1.4)
a9dc6cfa821c1c0d75c18fc8e07554bc8ad778ad49c39b0bbe38101c09c289b5 (Vidar v1.5)

296c97d66ac4cb05777f053fa2c17e78b415567e449d169aa3cf683a6565d28a (Vidar v1.5) <--- Vidar reworked (duplicit label v1.5)
16911bd74f0d6751a30a1be56a3752daf7bf333c0d6ec61d8746646dbe2a530d (Vidar v1.6)
27d4ad97468fa0388bc704a32dd5c5e21e6b1de76a160fbd2615530c58aa74a6 (Vidar v1.7)
155f9f56fcdab7dd03740656eaa27000ad68f76a4f7b4933fa57416278e909a7 (Vidar v1.8)

#malware #infostealer #extractor

[AVAR Asia @avar_asia]

The world’s most prominent cyber security leaders and researchers will gather at AVAR 2026 to discuss
the future of cyber security under the theme of Evolving Cyber Defence in the AI Era. Learn more about
AVAR 2026 at https://t.co/duSACEIKXA
#AVAR2026 #Cybersecurity #Conference

[Tim Blazytko @mr_phrazer]

I fully agree: even targets such as anti-cheats and gaming DRMs have become significantly easier to analyze with agents, if you know how to guide them and validate their results.

@nicolodev and I will about that at @reconmtl:

https://t.co/SYeix8evn4

[Alex Matrosov @matrosov]

Previous generations of software protection (DRM perspective) have always relied on code complexity (for RE), compute limitations, and human limitations as the guarantees that kept hacking timelines reasonably long.

That's changed now. Beyond the acceleration in vulnerability research and malware analysis, the same new reality applies to software protection, and security by obscurity, or assuming the attacker is limited in compute and motivation, no longer works.

[David Álvarez @wormable]

Others could take control of your life (just put few resources for The Truman Show) I mean, without ethics at all. And tell you: Well, call the police!
(You can't talk about it! And they are the police).

[David Álvarez @wormable]

Let's put it as gently as possible: "Interacting" (not even joinning) with an intelligence service means entering a complex, opaque, and difficult-to-leave system, where certain decisions can affect your freedom and your life in ways that are not always obvious or predictable.

[David Álvarez @wormable]

I'm sure interacting with NSA is always an extremely good experience. 🙂❤️

[Hexacon @hexacon_fr]

Windows Internals for Security Engineers by @yarden_shafir

📅 Oct 12-15
📍 Espace Vinci or Espace Cléry, Paris 2nd
👉 https://t.co/90NKwD8DU3

[Youming Lin @SudoR00tMe]

OffensiveCon Berlin 2026's conference videos are out.

Do check it out!

https://t.co/ckefJJlBl7

[hasherezade @hasherezade]

New #TinyTracer (4.0) is ready: https://t.co/hNcO4b3zJ9 - refactored for compatibility with the latest PIN - and with some new features!