Building a Pipeline for Agentic Malware Analysis
Building agentic malware-analysis workflows that combine strong initial triage with deeper automated recovery of malware structure and behavior.
Tim Blazytko’s Blog
Latest posts
Identification of API Functions in Binaries
Identify API functions in statically linked and embedded binaries using heuristics and analysis workflows.
Statistical Analysis to Detect Uncommon Code
Statistical analysis for detecting uncommon instruction sequences and spotting obfuscation patterns in binaries.
Practical MBA Deobfuscation with msynth
Practical MBA deobfuscation with msynth, simplifying mixed Boolean-arithmetic expressions in binaries.
Writing Disassemblers for VM-based Obfuscators
How to write disassemblers for VM-based obfuscators and recover instruction semantics via symbolic execution.
Automated Detection of Obfuscated Code
Heuristic detection of obfuscated code using CFG metrics (cyclomatic complexity, SCC structure, loop depth), entropy features, opaque predicate signatures, and VM dispatcher patterns.
Automation in Reverse Engineering: String Decryption
Step-by-step automation of malware string decryption (Mirai) using Binary Ninja HLIL and scripting.
Introduction to Control-flow Graph Analysis
Intro to control-flow graph construction, dominance, and loop analysis, with slides and Miasm code examples.
Automated Detection of Control-flow Flattening
Heuristic for detecting control-flow flattening in binaries using CFG structure analysis, implementation details, and evaluation results.