Giovanni Lagorio

Security enthusiast, CTF player, co-founder of @ZenHackTeam he/him

[Simone Aonzo @packm4d]

(1/n) New research on Windows malware, to appear at ACM ASIA CCS 2026 [1]:
"SoK: Systematization, Detection, and Hunting of Windows Malware Persistence Techniques" [2]

This work is a collaboration between EURECOM and the University of Twente.

[Tim Blazytko @mr_phrazer]

The recording of my first Binary Cartography webinar is now public:

Agentic Reverse Engineering: How AI Agents Are Changing Binary Analysis

Topics: keygenning, cracking & anti-tamper removal

Recording: https://t.co/dheTSRkJqP

Slides/code/samples: https://t.co/nAqtcqVs7i

[Simone Aonzo @packm4d]

I was watching a presentation [1] on @REverseConf 2026 and I learned an anti-emulation trick that uses x87 FPU quirks. It is used by an anti-cheat engine (as part of an MBA).

Here you go, it detects Unicorn: https://t.co/UVBTg22Q3a

[1] https://t.co/kYKrXrRpwA

[RE//verse @REverseConf]

RE//verse 2026 talks are live on YouTube! Want to revisit a talk or catch the ones you missed? The full playlist is now available:
https://t.co/HbQUuGF0IZ

[PagedOut @pagedout_zine]

https://t.co/o4CGqi5qR0 ← we've just released Paged Out! zine Issue #7
https://t.co/ZEuR7WtUAL ← direct link
https://t.co/DFuGBWFb4D ← prints for zine collectors
https://t.co/8VN5hGyEux ← issue wallpaper
Enjoy!

Please please please RT to spread the news - thank you!

[Florian Roth ⚡️ @cyb3rops]

So, these threat actors successfully phished an author of multiple open source NPM packages with a total of 2 billion weekly downloads – including debug, chalk, and ansi-styles.

Since most companies run at least one React or Angular app, they had the opportunity to execute code on millions of systems across thousands of orgs.

And they used it to drop an amateurishly obfuscated crypto stealer, got caught by basic detection rules, and the issue was remediated after 2 hours.

I hope everyone understands how close this was – and can imagine what would’ve happened if someone with real skills had done it.

#NPM #Compromise #SupplyChain

[hasherezade @hasherezade]

New #TinyTracer (v3.0) is out - with many cool features: https://t.co/qvbQqaUq16 - check them!

[Microsoft Developer @msdev]

Big news: Windows Subsystem for Linux is now Open Source! 🎉

Download WSL, build from source, contribute fixes & features, and join its active development.

Learn more: https://t.co/JzhrU4RAkx

[[email protected] @Zardus]

Hello hackers! Another @pwncollege semester ends, continuing @ASU's @ace_inst's never-ending quest to revolutionize the way hackers learn to become productive members of the cybersecurity community. Read on to learn what this means for students and Capture the Flag! 🧵

[João Vitor(Keowu) @keowu]

My new article, "Writing a Full Windows ARM64 Debugger for Reverse Engineering," covers the topic in detail, including its internals and the core differences between Windows on Intel and ARM64:

https://t.co/5xASMMNAEk

[Mattias Gustavsson 💖 @Mattias_G]

"dos-like" is a mini-engine/framework I made a couple of years ago. It makes it easy to make games and other things with a 90s MS-DOS look and feel, but using a modern C compiler and running on Windows, Linux, macOS and in the browser using WebAssembler.

[Pavel Yosifovich @zodiacon]

Learn to write a WinDbg extension:
https://t.co/MVbkvqZKas

[Nauseam (in sf!) @ChadNauseam]

"A calculator app? Anyone could make that."

Not true.

A calculator should show you the result of the mathematical expression you entered. That's much, much harder than it sounds.

What I'm about to tell you is the greatest calculator app development story ever told.

[Zion Leonahenahe Basque @mahal0z]

It's finally here! Ghidra 11.3 dropped with built-in support for Python 3 through Pyhidra. Let's go! https://t.co/iZMl9L9lZq

[Tim Blazytko @mr_phrazer]

Last Thursday, I gave a webinar on anti-reverse engineering techniques like obfuscation, anti-debug, anti-tamper etc, including practical examples. Recording, slides and examples are now available.

https://t.co/M99j6jHkJs

https://t.co/3o4TIAQBbE

[Duncan Ogilvie 🍍 @mrexodia]

DataExplorer is a plugin for @x64dbg that integrates the pattern language from @WerWolv's ImHex. You can quickly visualize data structures in memory!

[hasherezade @hasherezade]

The last release of #TinyTracer for this year: v2.9.5 : https://t.co/qvbQqaUXQE . Added ability to follow child processes (thanks to @red5heep). Improved tracing of #VMProtect - protected executables.

[hasherezade @hasherezade]

New #HollowsHunter (v0.4.0) is out: https://t.co/FBWjtKp8ez. Now you can use it in the classic mode, as well as in ETW mode - as a multi-threaded listener. The watched events can be defined by a simple profile - but it is just a beginning...

[Muhammad Umair @m_umairx]

FLARE is releasing a tool today that I've been working on over this year that helps break down binaries into smaller functional clusters and uses Gemini to describe their relationships, behavior and the overall malware functionality. It's called XRefer and it is out for you to read about and try out. Check out the write up here, and look below for some examples: https://t.co/qLxJMOgePy

[Alisa Esage Шевченко @alisaesage]

Releasing full 2+hr video of my browser exploitation workshop from VXCON 2024: https://t.co/SBn4fMarPU

In which I show what goes inside the mind of a skilled hacker while exploiting a highly non-trivial vulnerability in v8, from zero to exploit concept.

Especially this workflow requires advanced abstract thinking, thereby emphasize the role of theoretical modeling in attacking hard zeroday research targets, which is a part of why it's fun. @zerodaytraining