iiinova — where your digital self keeps evolving

Max 'Libra' Kersten

@maxkersten.nl

245 followers 104 following 34 posts

Malware analyst and reverse engineer, author of the Binary Analysis Course. DMs are always open. Opinions are my own and not the views of my employer.

Posts Replies Media

Max 'Libra' Kersten @maxkersten.nl · 01/07/2025

Based on @struppigel.bsky.social's script, we propagate external function parameters in the disassembly listing, making life slightly easier! 9/n

Left are several instruction as shown by default in Ghidra, on the right hand side the external function parameters are added as comments by the script.

110

Max 'Libra' Kersten @maxkersten.nl · 01/07/2025

Using the same graph theory code as used in GhidrAI, we can define which functions are the (least) complex. The most complex function calls are marked bright red, lesser complex functions are darker shades of red. This helps you identify interesting functions when no symbols are present! 8/n

A side-by-side view of the same disassembly instructions. The left hand side is shown as-is by Ghidra, while the right hand side contains the colourised function calls based on the function's complexity. The brigther red a function call is, the more complex the function is.

100

Max 'Libra' Kersten @maxkersten.nl · 01/07/2025

Those who worked with me before, know that visual art creation is not my strength. Visuals can, however, be very helpful during the analysis! And thus: graphic design is my (now) my passion! 7/n

Word Art 2003 style text which states "Graphic Design is my passion"

100

Max 'Libra' Kersten @maxkersten.nl · 01/07/2025

That is not to say the LLM will generate perfect function and variable names, as well as function summaries. But it cant hurt to try! The result gives you, the analyst, a lot more context and insight! 6/n

The output of the LLM shown within Ghidra's plate comment

132

Max 'Libra' Kersten @maxkersten.nl · 01/07/2025

Based on research by @mrphrazer.bsky.social and @mu00d8.bsky.social, presented at RECon 2024, I used graph theory code from Ghidra's codebase to select the order in which functions are sent to the LLM, ensuring as much context as possible is retained. The script is aptly named GhidrAI! 5/n

A side-by-side view of Ghidra's decompiler. Left is the raw output, right is the output enhanced by the LLM.

131

Max 'Libra' Kersten @maxkersten.nl · 01/07/2025

My new research focuses on an improved version of this workflow, while putting my money where my mouth is by providing ready-to-use scripts for all steps along the way! 3/n

The improved workflow, where the yellow squares remain unchanged while the blue ones have been newly added.

110

Max 'Libra' Kersten @maxkersten.nl · 01/07/2025

Last year, I blogged about the recovery of symbols in my "No Symbols, No Problem" blog and subsequent DEFCON 32 talk. This resulted in a workflow, as shown in the attached image. Blog: www.trellix.com/blogs/resear... Talk: www.youtube.com/watch?v=-re_... 2/n

The workflow to analyze files when reverse engineering, with a focus on accuracy.

100

Max 'Libra' Kersten @maxkersten.nl · 01/07/2025

Ghidra, scripting, LLM, automagic automation. That should grab the attention for this thread. If you want to read the complete blog, you can do so here: www.trellix.com/blogs/resear... 1/n

A side by side comparison of the original output by Ghidra, and the LLM enriched output.

195

Max 'Libra' Kersten @maxkersten.nl · 22/05/2025

Tuesday's workshop @botconf.infosec.exchange.ap.brid.gy went well with very engaged and enthusiastic attendees!

030

Max 'Libra' Kersten @maxkersten.nl · 01/03/2025

What do you wear at @re-verse.io? A Ghidra tshirt and Hex Rays cap, with @psifertex.bsky.social rocking the Binary Ninja tshirt, hoodie, and cap!

Jordan is wearing a Binary Ninja tshirt, hoodie, and cap, whereas Im wearing a Ghidra tshirt and a Hex Rays cap

0121

Max 'Libra' Kersten @maxkersten.nl · 25/02/2025

This Friday, I will represent Trellix at @re-verse.io and I will talk about code reuse, attribution, and the dangers thereof. Looking forward to it, and to meet the Vector 35 folks! The full abstract can be found at: re-verse.sessionize.com/session/754398

The image contains a part od the talk's abstract:

The dreadful feeling when reversing a binary which shows hundreds or thousands of unknown functions is, unfortunately, all too well known by analysts. It does not matter if the binary in question is a malware sample, a patch-diffing effort, or a hobby project, the lack of function symbols severely slows down the analysis. This talk dives into function symbol recovery by detecting code reuse in binaries to avoid the slow and tedious analysis, and to improve attribution capabilities. The AcidRain and AcidPour wipers, used against Ukrainian targets in the wild, will be used as case studies. Automation of repetitive steps is kept in mind throughout the process.

0103