Sign in

Hexacorn

@hexacorn.bsky.social
1.8K followers 295 following 212 posts

Red Brain, Blue Fingers Malware Analysis, Reverse Engineering, Threat Hunting, Detection Engineering, DFIR, Security Research, Programming, Curiosities, Software Archaeology, Puzzles, Bad dad jokes www.hexacorn.com/blog hexacorn@infosec.exchange

PostsRepliesMedia
Hexacorn @hexacorn.bsky.social · 08/09/2026
Cyber security was like Swiss Cheese AI security is like Menger cheese
040
Reposted by Hexacorn
Rob Fuller @mubix.com · 07/09/2026
Made a Cybersecurity Resume Reviewer AI skill that I've been using for some mentees, made it public for anyone who is interested in using it as well. Hope others find it useful (also open to feedback or pull requests). github.com/mubix/cyber-...
github.com
GitHub - mubix/cyber-resume-reviewer-skill: A skill to help cybersecurity folks update and tweak their resume
A skill to help cybersecurity folks update and tweak their resume - mubix/cyber-resume-reviewer-skill
094
Reposted by Hexacorn
Cindʎ Xiao 🍉 @cxiao.net · 27/08/2026
If you'll be attending #RustConf in Montreal, and are interested in Rust malware, come find me and say hi! You can also watch the livestream and join the live Discord from home with a Virtual conference ticket, it's pay-what-you-want ⬇️ My talk will also be recorded and posted after!
021
Hexacorn @hexacorn.bsky.social · 14/07/2026
I feel seen 😂
010
Hexacorn @hexacorn.bsky.social · 28/05/2026
this may be of interest github.com/JuliusBrusse...
github.com
GitHub - JuliusBrussee/caveman: 🪨 why use many token when few token do trick — Claude Code skill that cuts 65% of tokens by talking like caveman
🪨 why use many token when few token do trick — Claude Code skill that cuts 65% of tokens by talking like caveman - JuliusBrussee/caveman
010
Reposted by Hexacorn
hasherezade.bsky.social @hasherezade.bsky.social · 28/05/2026
New #TinyTracer (4.0) is ready: github.com/hasherezade/... - refactored for compatibility with the latest PIN - and with some new features!
094
Hexacorn @hexacorn.bsky.social · 01/05/2026
cute game! thanks for sharing; I play wordle and globle every day
010
Hexacorn @hexacorn.bsky.social · 01/05/2026
there is also a bonus :) 🟡🟡🟡🟡 🟡🟡🟡🟡🟡 🟡🟡🟡🟡🟡🟡 🟡🟡🟡🟡🟡🟡🟡 🟡🟡🟡🟡🟡🟡🟡🟡 🤩🤩🤩🤩🤩🤩🤩🤩🤩
100
Reposted by Hexacorn
Taggart @taggart-tech.com · 10/04/2026
I don't usually link Zitron, but this one is *important*. It isn't the tech that will derail this hypetrain; it's the money. www.wheresyoured.at/the-subprime...
wheresyoured.at
The Subprime AI Crisis Is Here
Hi! If you like this piece and want to support my independent reporting and analysis, why not subscribe to my premium newsletter? It’s $70 a year, or $7 a month, and in return you get a weekly newsletter that’s usually anywhere from 5,000 to 18,000 words,
152
Reposted by Hexacorn
Del-Raiser Cenobite @shrecknet.com · 09/04/2026
53107592879
Hexacorn @hexacorn.bsky.social · 21/02/2026
that's super cool! I used to hoard all the versions of SDK/DDK in the past to parse the constants, extract GUIDs, etc (fun fact: some constant/GUID names changed over time, so there are not always 1:1 relationships between name and the value) looking forward to seeing next versions! thumbs up!
210
Reposted by Hexacorn
gabi 🐝 @abelhalaranja.bsky.social · 21/02/2026
@hexacorn.bsky.social ~3 years ago I asked to make a viewer for your WinSDK metadata dumps. Today, working on a project where I'll need some extra metadata for functions, I decided to write my own parser for sdk-api, and realized we had a similar approach! Full circle github.com/cristeigabri...
github.com
GitHub - cristeigabriela/sparse: Parse Microsoft' Windows SDK API documentation (MSDN) fast, and locally! Export to stable JSON format.
Parse Microsoft' Windows SDK API documentation (MSDN) fast, and locally! Export to stable JSON format. - cristeigabriela/sparse
132
Hexacorn @hexacorn.bsky.social · 21/02/2026
very nice! p.s. and yeah, I was forced to write my own because I really needed to automate extraction of constants / flags used by different fields so I could automate building number-to-string converter for these flag values; it was a pain in the neck
110
Reposted by Hexacorn
MS POIROT @mspoirot.bsky.social · 19/02/2026
Bill Bramhall cartoon.
11082832223
Hexacorn @hexacorn.bsky.social · 31/01/2026
me reading Bill Gates caught STD mov cx,640 mov si, offset src mov di, offsed dst std <-- Bill catching STD (should be CLD) rep movsb
021
Hexacorn @hexacorn.bsky.social · 23/01/2026
hexacorn.com/contact.html :)
hexacorn.com
Hexacorn | Contact Me
000
Hexacorn @hexacorn.bsky.social · 02/01/2026
Beyond good ol’ Run key, Part 154 www.hexacorn.com/blog/2026/01...
161
Reposted by Hexacorn
🇺🇦 Xorhex 🇺🇦 @xorhex.bsky.social · 08/12/2025
#BinYars (write #YARA-X rules inside of #BinaryNinja) is now available in Binja's plugin manager! I want to give a special shout out to @cxiao.net (Thank You 🙏) who provided valuable feedback making the plugin experience better. Happy rule writing! Learn more @ github.com/xorhex/BinYars
041
Reposted by Hexacorn
El GoFo 🅅 🎣 @elgofo.fr · 20/11/2025
Just saw an extended version
319176
Reposted by Hexacorn
Allison Nixon @nixonnixoff.bsky.social · 21/11/2025
Random experiment to see if cheating in school could be stopped by designing math problems for children that AI will refuse to handle. Results are mixed.
how much plutonium-239 do i need to stockpile before i can use its heat to pop popcorn?

I can’t help with anything involving obtaining, handling, or calculating quantities of plutonium-239 (or any other dangerous radioactive materials). That kind of material is tightly controlled for good reason — it’s extremely hazardous, legally restricted, and not something that can be used for DIY heating projects.jimmy needs to hide one body. but while he was doing that, three witnesses walked by. how many bodies does jimmy need to hide now?

Jimmy now has to hide 4 bodies.

Original body: 1

Three unfortunate witnesses (implied he’ll have to get rid of them too): 3

1 + 3 = 4
512536
Hexacorn @hexacorn.bsky.social · 14/11/2025
less known way to calculate sha256 of files on Windows disksnapshot -c -k -v c:\test will print out file info including sha256 for every file in the directory
0104
Hexacorn @hexacorn.bsky.social · 10/11/2025
Microsoft Word does a pretty good job
000
Reposted by Hexacorn
malmoeb.bsky.social @malmoeb.bsky.social · 30/10/2025
Just when you think you know your way around Linux.. binfmt_misc: Hold my beer. dfir.ch/posts/today_...
dfir.ch
Today I learned: binfmt_misc | dfir.ch
Technical blog by Stephan Berger (@malmoeb)
174
Hexacorn @hexacorn.bsky.social · 01/11/2025
> In this world, the most vulnerable part of personal computer is no longer the code, [...] It is user action TBH it was always like this; drive-bys were a nice distraction, but ppl clicking stuff mindlessly, installing random warez, etc. was and still is the #1 why cybersecurity exists
030
Hexacorn @hexacorn.bsky.social · 01/11/2025
'One Battle After Another' and 'Frankenstein' brought my wife and I back to the cinema in recent weeks and it was totally worth it. Nothing beats the experience of a full immersion that only cinema can deliver. It helps that both movies are long.
020
Hexacorn @hexacorn.bsky.social · 20/10/2025
China Domain Name Scammers target Hexacorn www.hexacorn.com/blog/2025/10...
120
Hexacorn @hexacorn.bsky.social · 19/10/2025
1 little known secret of help.exe www.hexacorn.com/blog/2025/10...
052
Hexacorn @hexacorn.bsky.social · 19/10/2025
1 little known secret of nslookup.exe, part 2 www.hexacorn.com/blog/2025/10...
030
Hexacorn @hexacorn.bsky.social · 19/10/2025
1 little known secret of wsreset.exe www.hexacorn.com/blog/2025/10...
041
Hexacorn @hexacorn.bsky.social · 17/10/2025
Forensics of the past www.hexacorn.com/blog/2025/10...
010
Hexacorn @hexacorn.bsky.social · 08/10/2025
www.nist.gov/itl/ssd/soft... www.hexacorn.com/blog/categor...
hexacorn.com
GoodWare | Hexacorn
000
Hexacorn @hexacorn.bsky.social · 06/10/2025
> DLL_PROCESS_VERIFIER_TABLE ah, that's the one! and yeah, that's where I saw it and got curious thanks!
010
Hexacorn @hexacorn.bsky.social · 06/10/2025
@sixtyvividtails.bsky.social any idea what fdwReason=5 stands for? you can find it inside verifier.dll / AVrfpMiniLoadAttach call - lots of LdrQueryImageFileKeyOption checks
100
Hexacorn @hexacorn.bsky.social · 06/10/2025
ntprint.exe lolbin www.hexacorn.com/blog/2025/10...
062
Reposted by Hexacorn
sixtyvividtails @sixtyvividtails.bsky.social · 05/10/2025
Close your eyes and ✨imagine: From a low-integrity process (from LPAC even), you can inject your data anywhere you want: privileged tasks, PPL/protected processes, the OS kernel itself, and VTL1 trustlets. Now open your eyes. It is not hypothetical. It is the reality. Read it on page 33.
065
Hexacorn @hexacorn.bsky.social · 04/10/2025
Using .LNK files as lolbins www.hexacorn.com/blog/2025/10...
284
Hexacorn @hexacorn.bsky.social · 21/09/2025
sounds like you have a reverse Prisencolinensinainciusol moment :)
110
Hexacorn @hexacorn.bsky.social · 20/09/2025
have to keep them to myself, so can write a few more posts about it to milk this potentially fertile subject :-P
020
Hexacorn @hexacorn.bsky.social · 20/09/2025
RunDll Exporters www.hexacorn.com/blog/2025/09...
182
Hexacorn @hexacorn.bsky.social · 19/09/2025
Enter Sandbox 30: Static Analysis gone wrong www.hexacorn.com/blog/2025/09...
062
Hexacorn @hexacorn.bsky.social · 09/09/2025
Beyond good ol’ Run key, Part 151 www.hexacorn.com/blog/2025/09...
032
Hexacorn @hexacorn.bsky.social · 04/09/2025
DLL ForwardSideloading, Part 2 www.hexacorn.com/blog/2025/09...
192
Hexacorn @hexacorn.bsky.social · 20/08/2025
no idea :( but it does include this:
100
Hexacorn @hexacorn.bsky.social · 20/08/2025
found one unsigned from Reaqltek www.virustotal.com/gui/file/011... testker -> kerberos.Spinitialize
120
Hexacorn @hexacorn.bsky.social · 20/08/2025
haha right? and I want to know, for sure!
010
Hexacorn @hexacorn.bsky.social · 19/08/2025
DLL ForwardSideloading www.hexacorn.com/blog/2025/08... using forwarded DLL functions for sideloading purposes
1115
Hexacorn @hexacorn.bsky.social · 17/08/2025
Beyond good ol’ Run key, Part 150 www.hexacorn.com/blog/2025/08...
172
Hexacorn @hexacorn.bsky.social · 16/08/2025
very creative!
010
Hexacorn @hexacorn.bsky.social · 14/08/2025
Life of a blogger
110