Sam Thomas

Program analysis. Reverse engineering. Creator of @VulHuntRE.

[Sam Thomas @xorpse]

I'm pleased to announce a new release of the #idalib #Rust bindings for @HexRaysSA IDA Pro! This release provides support for IDA 9.5, ARM64 targets, cross-compilation, bug fixes, and API improvements. Thanks to @0xdea for their work on this release.
https://t.co/VAyv0oGP20

[Anton @ant_av7]

Huge findings from @yeggorv💪

[Antonio 's4tan' Parata @s4tan]

Excited to see our paper, “A Hybrid Static-Dynamic Analysis for Identifying BYOVD Vulnerabilities,” now public! It introduces dynamic sandbox detection and IOCTLance features, leading to 13 reported vulnerabilities and 5 CVEs.
https://t.co/jNRltzSpZO

[Hex-Rays SA @HexRaysSA]

📢 IDA 9.5 is here: more platforms, more agentic power.

→ 3 new decompilers: Android Dalvik, Infineon TriCore and Qualcomm Hexagon
→ IDA MCP and Assist for AI-driven reverse engineering
→ Recursive decompilation across call graphs
→ IDA Home now includes 11 cloud decompilers instead of 2, at the same price
→ And much, much more

It’s one of our biggest releases yet. Active license holders can download it now from the Download Center.

https://t.co/sNYObPyqDz

[Dr Heidy Khlaaf (هايدي خلاف) @HeidyKhlaaf]

Excited to announce that I'll be keynoting at Black Hat Europe this year in London! I'll be talking about the distinction between AI Security and AI Safety, and the co-option and conflation of security and safety methodologies in AI that are leading us down a precarious path.

[lukas seidel @pr0me]

understanding and benchmarking vulnerability detection capabilities is an interesting challenge and I can recommend @niklas2484's recently published PhD thesis on that topic.

it includes "Top Score on the Wrong Exam", one of my favorite (pre-LLM) ml-for-vuln-detection papers.

[Philip Zucker @SandMouth]

A new blog post "Ghidra + CBMC = Assembly Model Checker" https://t.co/mBH6Mq9xAf A fairly small tool can lift assembly to CBMC's GOTO IR enabling simple cross C-assembly model checking for many ISAs (Ghidra supports 20+ https://t.co/VdCfROb9W4 ) #ghidra #assembly #verification

[Kristopher Micinski -- REBORN @krismicinski]

Wrote some slides on symbolic exploit search / synthesis... https://t.co/4iDbiwTOrL

[Zion Leonahenahe Basque @mahal0z]

DecBench is growing fast, but I want to remind people that I manually verify results and submissions on the site. That means two things: 1) if you see results elsewhere and not on https://t.co/w1XSy8lkmu, I can't speak to their quality. 2) Result updates can be slower, so please don't spam 👍

[Michaël Marcozzi 🇪🇺🇧🇪 @michaelmarcozzi]

I am recruiting a postdoc to work with me here in Paris on fuzzing and backdoor detection!

➡️ Do not hesitate to apply or share the offer!

[Sam Thomas @xorpse]

@StockerTho29162 @HexRaysSA @mcbbugu @0xdea The project provides a collection of crates to write tools/plugins on top of IDA Pro in Rust, rather than using the official C++ or Python SDKs provided by Hex-Rays.

[Sam Thomas @xorpse]

I'm pleased to announce a new release of the #idalib #Rust bindings for @HexRaysSA IDA Pro! This release provides new APIs and bug fixes. Thanks to new and existing contributors @mcbbugu, Amaan Qureshi, and @0xdea for their work on this release.
https://t.co/Nwfb25i5Vh

[Zion Leonahenahe Basque @mahal0z]

A new decompiler approach enters the ring!

[Brendan Dolan-Gavitt @moyix]

Super interesting work, and improving on structure recovery is really impressive; that's a seriously hard problem that has had a lot of previous work

[lukas seidel @pr0me]

it's great that with decbench, we have a high-quality public benchmark.

yet, decompiler evaluation remains hard, and I see two primary challenges right now:
1. high-quality, real-world-like, fully private data. Frontier LLMs have seen virtually every open source function in existence and leakage is not fully avoidable, something we also cannot rule out for our model.
2. finding a better proxy for semantic fidelity. A program can recompile, but do something entirely different. A program can also recompile, have a totally different byte-level structure from the groundtruth, and still do the same job. Dynamic-execution based attestation is tough to get correct at scale, but might be a better signal in the long run.

[lukas seidel @pr0me]

we submitted and verified our results via the public site: https://t.co/0eL1MAsRRt
(`normalize` as there is no arch-specific view right now)

it's cool to see that our {static context collection -> one-shot decompilation} approach can compete with fully agentic frontier LLMs

[lukas seidel @pr0me]

today, we @RevEng_AI released the next generation of our decompiler: Ventris

the new model comes with improved struct layout recovery, better PE support, and more.

on decbench, we beat all other available decompilers in structure recovery, and achieve #2 rank overall

[Takahiro Haruyama @cci_forensics]

I've shared the list of malicious models detected by MLTracer, along with a systematic analysis of techniques for evading existing model scanners, in the following GitHub repo.
https://t.co/cO0SCi3VOF
In short, the AI supply chain security field still likely has a lot of room for improvement.

[quarkslab @quarkslab]

"Software protection is futile, AI will break it", they said.

But, does it? how?
To shine some light read about Rémy Salim's experiments in "Defeating AI-Assisted Reverse Engineering"

Where is the fair play, Claude?
https://t.co/WiqzDEjCA8

[domas @xoreaxeaxeax]

Schrödinger’s TOCTOU — a bug class where a struct’s size mod 16 decides if you’re exploitable, where -O2 saves you and -O3 kills you, where a compiler upgrade introduces the bug, and a downgrade… introduces it too. Invisible, intractable, everywhere.

https://t.co/yT55nqRb6c