Max 'Libra' Kersten

@maxkersten.nl

237 Followers 103 Following

Malware analyst and reverse engineer, author of the Binary Analysis Course. DMs are always open. Opinions are my own and not the views of my employer.

Left are several instruction as shown by default in Ghidra, on the right hand side the external function parameters are added as comments by the script.
A side-by-side view of the same disassembly instructions. The left hand side is shown as-is by Ghidra, while the right hand side contains the colourised function calls based on the function's complexity. The brigther red a function call is, the more complex the function is.
Word Art 2003 style text which states "Graphic Design is my passion"
The output of the LLM shown within Ghidra's plate comment
A side-by-side view of Ghidra's decompiler. Left is the raw output, right is the output enhanced by the LLM.
The improved workflow, where the yellow squares remain unchanged while the blue ones have been newly added.
The workflow to analyze files when reverse engineering, with a focus on accuracy.
A side by side comparison of the original output by Ghidra, and the LLM enriched output.
A picture of the workshop's title slide
Jordan is wearing a Binary Ninja tshirt, hoodie, and cap, whereas Im wearing a Ghidra tshirt and a Hex Rays cap
The image contains a part od the talk's abstract: The dreadful feeling when reversing a binary which shows hundreds or thousands of unknown functions is, unfortunately, all too well known by analysts. It does not matter if the binary in question is a malware sample, a patch-diffing effort, or a hobby project, the lack of function symbols severely slows down the analysis. This talk dives into function symbol recovery by detecting code reuse in binaries to avoid the slow and tedious analysis, and to improve attribution capabilities. The AcidRain and AcidPour wipers, used against Ukrainian targets in the wild, will be used as case studies. Automation of repetitive steps is kept in mind throughout the process.