iiinova — where your digital self keeps evolving

hasherezade.bsky.social

@hasherezade.bsky.social

1.5K followers 75 following 27 posts

Programmer, #malware analyst. Author of #PEbear, #PEsieve, #TinyTracer. Private account. All opinions expressed here are mine only (not of my employer etc) ; hasherezade.net

Posts Replies Media

hasherezade.bsky.social @hasherezade.bsky.social · 01/08/2026

At #BlackHat2026, I’ll walk through the #JSCeal #malware case study and the static deobfuscation toolkit I built to recover readable code from the obfuscated #V8 compiled bytecode. If you’ll be at #BlackHat, I’d be glad to see you there! blackhat.com/us-26/briefi...

030

hasherezade.bsky.social @hasherezade.bsky.social · 06/06/2026

Now the Linux build is also available as AppImage:

190

hasherezade.bsky.social @hasherezade.bsky.social · 06/06/2026

In hex editor: in addition to NOP/clear of the selected ranges, you can fill them with a custom character:

000

hasherezade.bsky.social @hasherezade.bsky.social · 06/06/2026

Added string search (ANSI and Unicode) - as another option along to signature search:

100

hasherezade.bsky.social @hasherezade.bsky.social · 06/06/2026

In hex editor: any selected number can be now interpreted as an address within the PE and followed on demand via context menu

100

hasherezade.bsky.social @hasherezade.bsky.social · 06/06/2026

New release: #PEbear 0.7.2: github.com/hasherezade/... - with important bugfixes and new features:

PE-bear release notes - available on GitHub

194

hasherezade.bsky.social @hasherezade.bsky.social · 28/05/2026

New #TinyTracer (4.0) is ready: github.com/hasherezade/... - refactored for compatibility with the latest PIN - and with some new features!

094

hasherezade.bsky.social @hasherezade.bsky.social · 11/10/2025

Finally done with #FlareOn12. What a ride! I am looking forward to read other people’s solutions, especially of those who did the 9th task quickly.

090

hasherezade.bsky.social @hasherezade.bsky.social · 06/06/2025

- option of custom parsing exports directory allows to pinpoint even the APIs that the malware author tried to hide by erasing exports table in memory: (github.com/hasherezade/...)

030

hasherezade.bsky.social @hasherezade.bsky.social · 06/06/2025

- watching not only the functions arguments, but also, how they changed after the function execution, and the function return value: (github.com/hasherezade/...) - thanks to a new contributor, maxspl:

120

hasherezade.bsky.social @hasherezade.bsky.social · 06/06/2025

includes: tracing defined local functions (github.com/hasherezade/...):

100

hasherezade.bsky.social @hasherezade.bsky.social · 06/06/2025

New #TinyTracer (v3.0) is out - with many cool features: github.com/hasherezade/... - check them out!

1156

hasherezade.bsky.social @hasherezade.bsky.social · 09/03/2025

#PEbear (github.com/hasherezade/...) is now available via WinGet (learn.microsoft.com/en-us/window...)! You can install it easier than ever - just type: `winget install pe-bear` from Powershell.

0128

hasherezade.bsky.social @hasherezade.bsky.social · 08/02/2025

New release: #IDA_IFL (Interactive Functions List) plugin v1.5 - works for IDA 9. Shout-out to my new contributor, @mahmoudimus.bsky.social who added the support! github.com/hasherezade/...

061

hasherezade.bsky.social @hasherezade.bsky.social · 14/12/2024

New #PEsieve & #HollowsHunter (v0.4.0) are released: github.com/hasherezade/... & github.com/hasherezade/... - A lot has changed in the new version, check it out!

04518