Sam Thomas

Program analysis. Reverse engineering. Backdoor detection.

[eversinc33 🤍🔪⋆｡˚ ⋆ @eversinc33]

Spent the last 2 weeks working on a devirtualizer for VMProtect 3.5 and learning Remill. Idk yet if I will blog about it, but I at least wanted to publish the code:

https://t.co/GLqKWpOOU7

The approach is different from my last blog, as it lifts the whole x86 code of the VM

[Sanjay Rawat @tosanjayr]

Dyn Taintflow Analysis (DTA) - one of the main components of VUzzer (NDSS 2017) - finally got the re-engineering I'd been postponing for years.
Several ideas had been stuck in my notebook ever since. 1/n

[Sanjay Rawat @tosanjayr]

One was, for example, the interned-label tag-map design I discussed with @c_giuffrida (thanks) back then, inspired by DFSan of LLVM.
This year, working with Claude, I finally (dared!) took the leap: a DynamoRIO-native LibDFT64 port, off Intel Pin entirely. v0.1 just shipped. 2/

[Sanjay Rawat @tosanjayr]

Parser benchmarks (5 iters; methodology in repo):
• tiffcp: 4.54× faster than Pin LibDFT64
• xmllint: 4.20× faster
• pdfimages: 2.20× faster
Public C++ API ships 3 sink patterns — opcode-class / PC-range / function-entry — with 4 reference clients. 3/

[Sanjay Rawat @tosanjayr]

This means it allows to implement typical taintflow related workflows.
Github: https://t.co/siTqdTJzOT
For some technical details, DESIGN.md is the one you would like to read first.
Thanks 🙏 4/4

[Kristopher Micinski -- REBORN @krismicinski]

My second PhD student, Yihao Sun, will be doing his dissertation defense tomorrow at noon Eastern time. Yihao's work has been a true sight to behold. He has papers at ASPLOS, AAAI, NeurIPS, VLDB, among others. This Fall, he starts as faculty at Utah State University! (Zoom link.)

[lukas seidel @pr0me]

decompilers historically have poor support for language-specific constructs, beginning with C++ templates or classes, not even talking about Go or Rust.

this work is astonishingly high-quality, from my first little tests it makes Rust decompilations indeed way more approachable

[0xor0ne @0xor0ne]

VulHunt by @binarly_io

https://t.co/ovsuyb5E26

Blog post series:

https://t.co/UzipgZw8la
https://t.co/F6E4OyqRAy
https://t.co/YG4tPvcDDt
https://t.co/24WivmtGZs
https://t.co/aGYL9HFo4B

#infosec

[lukas seidel @pr0me]

fresh desk and a new chair. for a new start.

[BINSEC Team @ Université Paris-Saclay, CEA, List @BinsecTool]

🚨 Postdoc opening (24 months) in software security & fuzzing!

Join our @BinsecTool team @CEA_List to work on smarter fuzzing for supply‑chain security.

📍 Paris‑Saclay 🇫🇷
🔗 Apply: https://t.co/b2yCb6HoZg

#Postdoc #Cybersecurity #Fuzzing #BinaryAnalysis #SupplyChainSecurity

[Michaël Marcozzi 🇪🇺🇧🇪 @michaelmarcozzi]

We are looking for a postdoc! ⬇️

[uefitool @uefitool]

UEFITool / UEFIExtract / UEFIFind NE A74
- a lot of bugfixes for issues found by @binarly_io folks
- CSME version detection improvements
- Insyde FlashDeviceMap improvements
- other minor fixes
https://t.co/YhYbdc5GuC

[Robert Yates @yates82]

I wrote a thing. if you are interested in obfuscation/de-obfuscation and compilers, but perhaps don't have a tangible experience with it, then i hope this story will be interesting to you and teach a few things along the way (-:

[Sam Thomas @xorpse]

Writing Rust-based IDA plugins is as simple as implementing IDAPlugin and using an attribute macro to define metadata. The crate handles the rest!

[Sam Thomas @xorpse]

We're pleased to announce a new release of our #Rust bindings for @HexRaysSA IDA Pro! This release adds compatibility with latest SDK, and introduces a Rust-native interface for developing plugins. https://t.co/VAyv0oGP20

[quarkslab @quarkslab]

🤔Ever wondered how your favorite tools work under the hood? During our work on SightHouse, we dug into BSIM, Ghidra's Binary function SIMilarity engine.

Many tools have been built around it, yet its internals remained undocumented. Until now 👇
https://t.co/Gw9AkTk0yb

[Abhi @AbhiTheModder]

It’s finally here: radare2 + Warp (warrp) ⚡️

This makes r2 the first tool outside of the binary ninja ecosystem to adopt the format. Huge thanks to Mason (from @vector35) and @trufae (@radareorg) for their invaluable feedback's during development.

https://t.co/wFuzChcMvq

[BINARLY🔬 @binarly_io]

What sets BRS apart is its flexibility and transparency. It is configured through product-, organization-, or ecosystem-specific risk profiles and is built to incorporate a wide range of existing metrics.

[BINARLY🔬 @binarly_io]

Relying on a single metric like CVSS or EPSS can miss critical product or organizational context. BRS brings consistency to comparing different risks, such as a known high-severity vulnerability with a PoC versus a potential zero-day.

[BINARLY🔬 @binarly_io]

Why create another metric? Traditional scoring systems are often rigid, opaque, and narrow in scope. They may not reflect product-specific requirements, differences across ecosystems such as firmware and cloud containers, or the realities of an evolving threat landscape.