YouTube video by Recon Conference

4-day hands-on malware analysis training by Marion Marschalek and Keith Ramphal. Master Windows, Linux & macOS malware reverse engineering at REcon Montreal.

Agentic workflows are rapidly changing how we reverse engineer binaries. Large language models are no longer limited to explaining decompiler output or writing small helper scripts; when paired with real tooling, they can drive analysis, orchestrate workflows, and connect multiple analysis layers faster and at a larger scale than a human analyst alone. In this talk, we explore what this shift means for code deobfuscation, from deflattening, opaque-predicate removal, and string recovery to interprocedural and whole-program deobfuscation. We argue that the key advance is not that models suddenly understand obfuscated code perfectly, but that they can now coordinate the broader workflow around deobfuscation. We conclude by examining what kinds of obfuscation may remain resilient in the face of increasingly agentic reverse engineering.

The STM32 family of microcontrollers is deployed in billions of embedded systems, making them desirable, high-value targets. In particular, the STM32F2 and STM32F4 series have been heavily scrutinized due to their use in popular cryptocurrency hardware wallets like the KeepKey, Trezor One, and Trezor Model T. Previous research has shown that fault injection can bypass protection mechanisms and enable flash memory extraction. However, those techniques can lead to device corruption or permanent loss of data. In this talk, Joe and Lennert present three years of work refining and extending these attacks into a more repeatable and reliable process for extracting protected flash memory from STM32F2 and STM32F4 devices. They will discuss the practical engineering behind the work, including failures, breakthroughs, and new attack strategies. Using these techniques, they have recovered the cryptocurrency recovery seeds from dozens of customer-owned hardware wallets with a 100% success rate.

We are looking forward to hosting another Blackhoodie training at Recon for 2026! We will be hosting a free, one day training for women, by women.Join us for an introduction to Ghidra and static analy...

REcon is a computer security conference with a focus on reverse engineering and advanced exploitation techniques. Held annually in Montreal, Canada since 2005.

4-day code deobfuscation training. Master VM-based obfuscation analysis, symbolic execution, SMT solving, and program synthesis.

REcon 2026 - Premier reverse engineering and cybersecurity conference in Montreal