Announcing #BinaryRefinery 0.10.0 [BR]. Includes some (hopefully) notable performance improvements and quite a few bug fixes. It also adds a prototype batch parser/emulator which aspires to become a proper batch deobfuscator in future releases.
[BR] github.com/binref/refin...
If you like binary refinery, check out this sample
It's also mostly undetected yet on VT:
samplepedia.cc/sample/361f2...
There is an open position on my team:
crowdstrike.wd5.myworkdayjobs.com/en-CA/crowds...
While this is not currently listed here, I am certain that U.S. remote is an option and if you're in Canada, I strongly expect that this would work as well.
I have created a website, where you can share your sample analysis (via links or posts) and search samples for training based on tags and difficulty.
If you write analysis blogs, you can share them there.
samplepedia.cc
Let's talk #windows #registry.
⚠️ HKLM\Reg\Key\Value
Value could be a subkey 😭
⚠️ HKLM\Reg\Key:Value
Key names can contain colons 😭
💎 HKLM\Reg\Key\\Value
This works unambiguously 🤩
(not the first to realize)
BUT WHY ISN'T THIS STANDARD NOTATION 😭
The amazing @cxiao.net is offering training at decoderloop.com for
#Rust #Malware #ReverseEngineering 😱
Her insight is absolutely priceless, she's taught me all I know about this. If you are organizing an event: This is the state-of-the-art training you are looking for.
Good news, the intermediate malware analysis course is almost finished.
I have currently a test student working through the course to get rid of mistakes that I do not notice.
Tips for newcomers to malware blog articles:
➡️You don't need to document every malware function. Focus on key areas
➡️Your text must be factually correct and it is okay to skip those details you are unsure about
➡️When you are done, just stop writing
Finally, I have finally fixed the annoying issue that I ran into on the stream with passing arguments to path extractor units that match a file on disk. Starting with v0.8.24, these arguments will no longer read file contents by default.
The main problems were caused by running an old version of pip in WSL, which caused an old version of LIEF to be installed, hence failing to parse executable formats. The 'solution' is to add a stricter version requirement for LIEF and improve the documentation to include a pip update.
I just pushed out #BinaryRefinery v0.8.24 which fixes all the issues I encountered during my recent live stream =D.
