A blog about my programming and reverse engineering adventures.
There is a specific stage of grief every .NET reverse-engineer goes through when writing the next .NET deobfuscator or config extractor. It is the realization you have to write yet another ugly pattern-matching algorithm to find the exact same string decryptor, VM opcode handler, or C2 connection initializer functions to extract obfuscator configurations or IoCs. I got sick of it. I wanted ...
Some people may think I am a shill for .NET. With my previous post, they may be right. However, as much as I like .NET, there are some things that just really do not make any sense to me, and they frustrate me to no end. Given that I maintain a PE parsing library and thus am deeply familiar with the anatomy of .NET binaries, I feel I am qualified to complain about some of the design choices ...
Over the past couple years, I have come to know the .NET platform pretty well, from both a developer’s and a reverse engineer’s standpoint. I can’t always quite say the same about people in the security community. In fact, more often than not, I encounter a lot of “experts” in the scene (e.g., on Twitter, YouTube, forums, blogs, webinars, talks, chat logs…) that come up with factoids about .N...
At last, as promised in my previous post, with a huge delay I finally managed to finalize my Flare-On12 write-ups. Overall, it was a really good and fun set of challenges, and as always, the latter ones humbling me, reminding me how much I still have to learn in the field of RE. My only main complaint: I wish there were more realistic/malware related challenges. This year felt very CTF-y :^). ...
Today a bit of a different, more rambly post. DEFCON and Grand Canyon It’s been a couple of months since I’ve been back from BSidesLV 2025 and DEFCON 33. Long story short, it was awesome and extra special this year for me. I met so many cool and talented people that have humbled me in many ways. From the talks to the people (shoutout Malware Village), there is so much cool stuff around that I...