home.social

#binaryninja — Public Fediverse posts

Live and recent posts from across the Fediverse tagged #binaryninja, aggregated by home.social.

fetched live
  1. The new version of my #BinaryNinja plugin Obfuscation Detection now supports function tagging.

    This guides agents toward interesting functions such as protocol dispatchers or symmetric crypto.

    github.com/mrphrazer/obfuscati

    I've also released a Ghidra fork:

    github.com/mrphrazer/obfuscati

  2. The new version of my #BinaryNinja plugin Obfuscation Detection now supports function tagging.

    This guides agents toward interesting functions such as protocol dispatchers or symmetric crypto.

    github.com/mrphrazer/obfuscati

    I've also released a Ghidra fork:

    github.com/mrphrazer/obfuscati

  3. RE: infosec.exchange/@binaryninja/

    For the few people using #BinYars, it has been updated to support #BinaryNinja 5.3 and now targets YARA-X 1.15.0

    Update via Binja's plugin manager to get the latest.

    github.com/xorhex/BinYars-Side

    #YARA #YARAX

  4. RE: infosec.exchange/@binaryninja/

    For the few people using #BinYars, it has been updated to support #BinaryNinja 5.3 and now targets YARA-X 1.15.0

    Update via Binja's plugin manager to get the latest.

    github.com/xorhex/BinYars-Side

    #YARA #YARAX

  5. #binjaextras has been updated to allow for type information to be applied to both struct members and global variables.

    Local instance of OALab's hashdb has been added as well. See the readme for setup information.

    github.com/xorhex/binjaextras/

    Update/install via Binja's plugin manager to get the latest features.

    #BinaryNinja

  6. #binjaextras has been updated to allow for type information to be applied to both struct members and global variables.

    Local instance of OALab's hashdb has been added as well. See the readme for setup information.

    github.com/xorhex/binjaextras/

    Update/install via Binja's plugin manager to get the latest features.

    #BinaryNinja

  7. Recently my RE workflow moved into sandboxed VMs where agents have full control over the environment. I needed an MCP server that runs headless in the same sandbox and exposes way more of the #BinaryNinja API than others.

    Here's the release: github.com/mrphrazer/binary-ni

  8. Recently my RE workflow moved into sandboxed VMs where agents have full control over the environment. I needed an MCP server that runs headless in the same sandbox and exposes way more of the #BinaryNinja API than others.

    Here's the release: github.com/mrphrazer/binary-ni

  9. After some unexpectedly painful test&debug sessions I'm publishing my #REshare exporter for #BinaryNinja:

    https://github.com/v-p-b/reshare-ninja

    Since Binary Ninja supports importing Ghidra projects, technically there is now a conversion path between three major #ReverseEngineering frameworks, but of course I plan to create a REshare importer as well.

    Note that there are certainly a *lot* of edge-cases that are not properly handled yet - issues and PRs are welcome as always!
  10. After some unexpectedly painful test&debug sessions I'm publishing my #REshare exporter for #BinaryNinja:

    https://github.com/v-p-b/reshare-ninja

    Since Binary Ninja supports importing Ghidra projects, technically there is now a conversion path between three major #ReverseEngineering frameworks, but of course I plan to create a REshare importer as well.

    Note that there are certainly a *lot* of edge-cases that are not properly handled yet - issues and PRs are welcome as always!
  11. I'm not a Ghidra user but I do think it's awesome that Binary Ninja supports exporting to Ghidra.

    #Ghidra #BinaryNinja

  12. I'm not a Ghidra user but I do think it's awesome that Binary Ninja supports exporting to Ghidra.

    #Ghidra #BinaryNinja

  13. Changed just 2 things in Binary Ninja's HLIL representation to get the Mersenne Twister initialize_state formula to match what's on Wikipedia:

    seed = f * (seed ^ (seed >> (w-2))) + i;

    w: word size (in number of bits). 32-2 = 30
    f: is the constant 0x6c078965

    Can you spot the 2 things? 🙂

    #BinaryNinja #DynoWiper

  14. Changed just 2 things in Binary Ninja's HLIL representation to get the Mersenne Twister initialize_state formula to match what's on Wikipedia:

    seed = f * (seed ^ (seed >> (w-2))) + i;

    w: word size (in number of bits). 32-2 = 30
    f: is the constant 0x6c078965

    Can you spot the 2 things? 🙂

    #BinaryNinja #DynoWiper

  15. #REshare exporter for #BinaryNinja is getting into shape! A sane API and good documentation made a world of difference, but of course I found a bit in the type system that required some hacks :)

    https://github.com/v-p-b/reshare

    Code coming next week after some more testing.

    #ReverseEngineering
  16. #REshare exporter for #BinaryNinja is getting into shape! A sane API and good documentation made a world of difference, but of course I found a bit in the type system that required some hacks :)

    https://github.com/v-p-b/reshare

    Code coming next week after some more testing.

    #ReverseEngineering
  17. TIL - using BinaryNinja's API, one can automatically saved extracted and transformed bytes back into the current project

    ```
    current_project.create_file(decoded_bytes, name="extracted.bin", folder=None, description="Extracted from: <insert hash of current file>")
    ```

    #BinaryNinja

  18. TIL - using BinaryNinja's API, one can automatically saved extracted and transformed bytes back into the current project

    ```
    current_project.create_file(decoded_bytes, name="extracted.bin", folder=None, description="Extracted from: <insert hash of current file>")
    ```

    #BinaryNinja

  19. I published an #IDA importer for the REShare #ReverseEngineering exchange format:

    https://github.com/v-p-b/reshare-ida

    I also wrote up my development experiences, incl. tips for IDA's type info API:

    REshare Ramblings - Bad Vibes with IDA
    https://scrapco.de/blog/reshare-ramblings-bad-vibes-with-ida.html

    I'm still looking for contributors, esp. on the #radare2 and #BinaryNinja side!
  20. I published an #IDA importer for the REShare #ReverseEngineering exchange format:

    https://github.com/v-p-b/reshare-ida

    I also wrote up my development experiences, incl. tips for IDA's type info API:

    REshare Ramblings - Bad Vibes with IDA
    https://scrapco.de/blog/reshare-ramblings-bad-vibes-with-ida.html

    I'm still looking for contributors, esp. on the #radare2 and #BinaryNinja side!
  21. #BinYars (write #YARA-X rules inside of #BinaryNinja) is now available in Binja's plugin manager!

    I want to give a special shout out to @cxiao (Thank You 🙏) who provided valuable feedback making the plugin experience better.

    Happy rule writing!

    Learn more @ github.com/xorhex/BinYars

  22. #BinYars (write #YARA-X rules inside of #BinaryNinja) is now available in Binja's plugin manager!

    I want to give a special shout out to @cxiao (Thank You 🙏) who provided valuable feedback making the plugin experience better.

    Happy rule writing!

    Learn more @ github.com/xorhex/BinYars

  23. I might need to find some bug bounty matching up with the price of that fw including ("Ultimate") version of #BinaryNinja.

    It does look quite enticing.

  24. I might need to find some bug bounty matching up with the price of that fw including ("Ultimate") version of #BinaryNinja.

    It does look quite enticing.

  25. Happy to share that later today (Friday, Nov 14, at 10:00 PM CET / 16:00 ET), I’ll be live on the #BinaryNinja livestream to talk about (anti-)reverse engineering & code (de)obfuscation. I'll also showcase some of my plugins.

    youtube.com/watch?v=GQtX7S_oXbY

  26. Still testing 🤞

    For those able to use #BinaryNinja projects; #BinYars can sort the files into folders based upon the #Yara-X rule metadata field, BNFolder. The folder nesting structure is determined by the number of matches that reside under each folder - check out the video below!

  27. Still testing 🤞

    For those able to use #BinaryNinja projects; #BinYars can sort the files into folders based upon the #Yara-X rule metadata field, BNFolder. The folder nesting structure is determined by the number of matches that reside under each folder - check out the video below!

  28. As a result of working on r4ghidra I set the ambitious goal to create REshare, an exchange format for #ReverseEngineering tools:

    https://github.com/v-p-b/reshare/

    The code is still in its early days (literally) but the fact that it works with complex, real life binaries tells me that this goal is worth pursuing.

    I'm looking for contributors, esp. for #BinaryNinja, #IDA and #radare2 scripting so we can bring all these worlds together!
  29. As a result of working on r4ghidra I set the ambitious goal to create REshare, an exchange format for #ReverseEngineering tools:

    https://github.com/v-p-b/reshare/

    The code is still in its early days (literally) but the fact that it works with complex, real life binaries tells me that this goal is worth pursuing.

    I'm looking for contributors, esp. for #BinaryNinja, #IDA and #radare2 scripting so we can bring all these worlds together!
  30. It's getting close to being done - #BinYars a #YARA-X #BinaryNinja plugin! Still testing, but plan on open sourcing it for all to use.

    Shout out to Remco Sprooten for making this tool (also shown in the video) for quickly drafting Yara rules 💪 github.com/1337-42/SimpleYaraBN

    Video: Part 1 of 2

  31. It's getting close to being done - #BinYars a #YARA-X #BinaryNinja plugin! Still testing, but plan on open sourcing it for all to use.

    Shout out to Remco Sprooten for making this tool (also shown in the video) for quickly drafting Yara rules 💪 github.com/1337-42/SimpleYaraBN

    Video: Part 1 of 2

  32. The recording of our @Defcon talk is now available. We shared our approach to reversing IoT and OT malware written in Go using a hybrid toolkit that blends AI with traditional analysis methods using #Radare2 , #Ghidra, and #BinaryNinja. Thanks to everyone who came out and stayed engaged through the technical hiccups that the venue had. We had to improvise and share a link for the slides on the spot.

    youtu.be/TtPicirB6G4?si=rYtqB9

    #IoT #Reversing #AI #OT #Malware #ReverseEngineering

  33. The new version of my #BinaryNinja plugin Obfuscation Analysis (v1.2) adds recursive function inlining in the decompiler.

    It collapses call-heavy code into a single function; analysis, constant propagation, DCE and other analyses work across boundaries.

    github.com/mrphrazer/obfuscati

    #reverseengineering

  34. Why is it so hard to get software over the last mile stone to make it usable for more than just me? I've a new #BinaryNinja ( #yarax ) plugin sitting in the wings needing to be polished for release and another release of #BinjaExtras with additional features close, but not close enough for release.

  35. Why is it so hard to get software over the last mile stone to make it usable for more than just me? I've a new #BinaryNinja ( #yarax ) plugin sitting in the wings needing to be polished for release and another release of #BinjaExtras with additional features close, but not close enough for release.

  36. I’m forcing myself to learn #BinaryNinja, and using an LLM to search through the user manual and learn the basics is a game changer. Questions about fonts, theming, basic shortcuts, and considerations coming from IDA all answered easily. Makes me wish I had access to their Sidekick API. I bet it’s even smoother.

  37. I’m forcing myself to learn #BinaryNinja, and using an LLM to search through the user manual and learn the basics is a game changer. Questions about fonts, theming, basic shortcuts, and considerations coming from IDA all answered easily. Makes me wish I had access to their Sidekick API. I bet it’s even smoother.

  38. @gloriouscow The more I look into it the less hair I’ll retain at the end...

    Loaded #BinaryNinja out of curiosity (should’ve done that earlier, it loads 8086 in free version!) and it shows me that only far call here is done to call DATA SECTION?!

    Maybe it has it’s own hard time decoding this mess - after all, even with enabled stripping, the code is 22K just to print your own filename - but it doesn’t really match the disassembly from MartyPC and I’m running out of ideas here…