All things IDA, security, reverse engineering, programming, AI and more. Friend and fan of Hex-Rays but non-official.

Joined March 2023
164 Photos and videos
allthingsida retweeted
Now the Linux build is also available as AppImage:
New release: #PEbear 0.7.2: github.com/hasherezade/pe-be… - with important bugfixes and new features:
2
5
60
9,371
My talk "SELECT * FROM binary - Vibe Reversing Across IDA, Ghidra, and Binary Ninja" got accepted at @reconmtl . I am happy to talk about this toolset (idasql, bnsql and ghidrasql) and how it is designed to allow AI agents to work across all these top 3 reverse engineering tools. Point Claude, Codex, or your favorite agent to any single one or all of them at once, and allow your agent can now use the tools all at once to analyze one or more binary at once. These work nicely with loops like "/goal" to allow e2e analysis over many hours. Use cases: - Full source code recovery (with types and code structure) - Full database annotations (also with type recovery, comments, etc.) - Binary diffing - Or just any kind of Q&A against your binary or binaries cfp.recon.cx/recon-2026/talk…
5
41
271
12,744
allthingsida retweeted
Spent the last 2 weeks working on a devirtualizer for VMProtect 3.5 and learning Remill. Idk yet if I will blog about it, but I at least wanted to publish the code: github.com/eversinc33/MogVMP The approach is different from my last blog, as it lifts the whole x86 code of the VM
17
92
406
17,877
I made a video for the first 30 years. Catch up if you want. youtu.be/tzJ5JjUW48s
🎂 IDA Turns 35. From DOS-era disassembler to one of the most widely used reverse engineering platforms in the world... To celebrate, we’re launching: • 35% off new licenses (see eligibility requirements) • Limited-edition swag giveaway • “35 Ways to Use IDA” as told by you • Stories from the past and a few for the future Read all about it here: hex-rays.com/blog/ida-turns-…
11
60
11,697
allthingsida retweeted
Rust reverse engineering is about to get a lot easier. 🦀 I'm thrilled to announce that Oxidizer, the first Rust decompiler, has been officially merged into angr! Try it out: github.com/angr/angr You can also find the paper here: github.com/sefcom/oxidizer/b…
22
124
805
70,188
Thanks @Steph3nSims for hosting. I enjoyed showing the capabilities of libghidra and ghidrasql to create AI based reverse engineering workflows. While the “sql” wording can be confusing, ghidrasql can equally do everything, if not more than your favorite MCP you already use.
Automated Reverse Engineering with LibGhidra, GhidraSQL, and AI Agents x.com/i/broadcasts/1rGmqovgR…
6
41
8,660
allthingsida retweeted
The stream below with @allthingsida is tomorrow (Friday) at 11AM PT!
Join us next Friday, May 8th at 11AM with Elias Bachaalany (@allthingsida) for the next @offby1security stream on, "Automated Reverse Engineering with LibGhidra, GhidraSQL, and AI Agents! youtube.com/watch?v=9avSjDHK…
9
23
3,486
allthingsida retweeted
New training updates, plus Spring discounts: • On-demand Starter → 20% off with code STR20 • AI-powered Intermediate → 40% off (May 12) with code AI-INTER40 • Malware, Decompiler & Programming → 30% off with code SPRING30 Details course breakdown: hex-rays.com/blog/spring-tra… *Limited time offer, check blog for expiration dates!
1
3
1,819
allthingsida retweeted
REcon is right around the corner. Early-bird training pricing has been extended, and conference tickets remain at March rates until May 11. Conference: June 19 to 21 2026 Training: June 15 to 18 2026 Location: Montreal, Canada Heads up: hotel booking cutoff is next week too. If you live in IDA, Ghidra, or a debugger, this is your conference. recon.cx/2026/en/index.html #REcon #RE #reverseengineering #InfoSec
17
33
6,420
allthingsida retweeted
Made a little experiment of lifting IDA microcode to z3 to automatically resolve opaque predicates. It works quite well on a few malware families I tested on. In the gif you can see Lumma stealer's opaque predicates being solved automatically:
1
26
200
11,918
Ok, ida-frustrated 0.0.2 has now some cool animations and scenes. Press Ctrl-Alt-T in any widget to get a random visual. It really would uplift the frustration! ;)
Put together a "frustrated" mode for IDA ;p (Still working out the animation quirks)
3
10
123
12,072
I've been building libghidra: a typed SDK for automating Ghidra from C , Python, and Rust (mainly for AI agents). Decompile, rename, comment, inspect symbols/types/xrefs, save, close, and reopen projects from code. Treat Ghidra like infrastructure, not just a GUI. Under the hood this is a typed API surface over a Ghidra host/extension. The same core workflows exist across C , Python, and Rust, so you can use it for quick scripts, larger pipelines, or native tooling. 1/n
4
59
514
31,994
libghidra can run Ghidra’s native decompiler engine from a normal C executable: no Java process, no UI, no HTTP server. The build embeds the processor specs, and the app can open a binary, list functions, decompile, rename, type, and inspect data offline. 8/n
1
5
1,208
Put together a "frustrated" mode for IDA ;p (Still working out the animation quirks)
I did not know Ghidra does that. Sorry, if this is silly, I stumbled upon it by accident.
1
41
19,024