Miasm @MiasmRe

miasm.re Paris, France Joined February 2016

Tweets

70
Followers

914
Following

5
Likes

50

Miasm @MiasmRe

4 years ago

@Farenain Great! You will have a second implementation to look at soon in miasm-rs 😉

1 1 6 0 0

View Details

While there are several frameworks for #reverseengineering that provide features we needed to see through Wslink’s virtual-machine-based obfuscator, we used @MiasmRe in this project simply because it’s actively maintained and we’re already familiar and satisfied with it. 4/5

1 1 7 0 0

View Details

Miasm @MiasmRe

5 years ago

@_trou_ It's more and more difficult to "manually" address problems generated by tools : 25 years ago, obfuscation, optimizations or even program size had "human size". Now, most of them are tool generated (even source code). So we also have to use tools to be able to solve them.

0 0 1 0 0

View Details

Miasm @MiasmRe

5 years ago

Little update: based on the great @NCCGroupInfosec blog post (research.nccgroup.com/2021/10/12/a-l…), we added color support for IR and ASM graph output: Thank you guys !

1 9 34 0 4

View Details

newsoft @newsoft

5 years ago

@MiasmRe you have a fan :) research.nccgroup.com/2021/10/12/a-l…

2 5 25 0 4

View Details

Miasm @MiasmRe

5 years ago

@newsoft Great Post!

0 0 2 0 0

View Details

Hash Miser @H_Miser

5 years ago

I finally decided to publish my complete toolset written for Tinynuke analysis You'll find config and injects grabber, dll extractors, Ghidra deobfuscation scripts and @cea_sec miasm based scripts github.com/Heat-Miser/tin… #Tinynuke #ReverseEngineering #Malware

1 24 63 0 12

View Details

Miasm @MiasmRe

5 years ago

@crackin76726107 Hum, as Miasm is a framework, I would answer "as the user has decided to implement it" :) To be honest, the picture gives nearly no clue. Is it code flattening?

2 0 0 0 0

View Details

Miasm @MiasmRe

5 years ago

@BincatLady @moyix Yes, the core algorithms are re-coded in Rust to improve speed (Jitter / Lifter / code analysis / ... ) and to clean APIs a bit :) But bindings allow python scripting currently!

0 0 6 0 0

View Details

Miasm @MiasmRe

5 years ago

@crackin76726107 Yes, you have a nice one there:

Tim Blazytko @mr_phrazer

5 years ago

Giving the workshop on code deobfuscation was great fun. Thanks for your active participation! #HITB2021AMS Check out code, slides and samples here: github.com/mrphrazer/hitb…

5 56 157 0 23

1 0 1 0 0

View Details

Miasm @MiasmRe

5 years ago

@crackin10554874 Hi @crackin10554874, can you be a bit more precise for example on the Miasm gitter ? gitter.im/cea-sec/miasm

0 0 0 0 0

View Details

Tim Blazytko @mr_phrazer

5 years ago

Giving the workshop on code deobfuscation was great fun. Thanks for your active participation! #HITB2021AMS Check out code, slides and samples here: github.com/mrphrazer/hitb…

5 56 157 0 23

View Details

Miasm @MiasmRe

5 years ago

Congratulation, you both succeeded in: - resolving the challenge - writing a great tutorial on how to add a custom architecture in Miasm & exploit the IR!

Suraj Malhotra @MrT4ntr4

5 years ago

Writeup for FCSC CTF 2021 - 'VMV' "Defeating Nested Virtualization with @MiasmRe" mrt4ntr4.github.io/FCSC21-CTF-VMV/ I explain how to write a custom architecture in Miasm and then use some pattern detection logic to solve the challenge. This took most of my time, Hope you guys like it!

1 19 51 0 3

0 2 18 0 1

View Details

Tim Blazytko @mr_phrazer

5 years ago

If you want to learn more about control-flow graph construction, analysis and loop detection, check out my slide deck. I also wrote a blog post on how these concepts can be easily explored with @MiasmRe. synthesis.to/2021/03/15/con…

1 27 92 0 20

View Details

Tim Blazytko @mr_phrazer

6 years ago

A good example of automatic code deobfuscation based on pattern matching is stadeo by @ESET. They use @MiasmRe to automatically remove control flow flattening for the stantinko malware family. github.com/eset/stadeo

1 13 62 0 8

View Details

Miasm @MiasmRe

6 years ago

@mr_phrazer @r2gui Great workshop Tim! Hopefully, IR translation/symbolic execution/z3 translation will be nearly instantaneous in the @rust version of miasm ;)

0 0 3 0 0

View Details

Tim Blazytko @mr_phrazer

6 years ago

Friday, 19:00 GMT+2 at #r2con2020: In a live coding, I will use @r2gui and @MiasmRe to automatically identify and remove opaque predicates in an APT malware sample. Check it out: rada.re/con/2020/youtu…

3 11 40 0 5

View Details

Adrien Guinet @adriengnt

6 years ago

Emulating the NotPetya bootloader with @MiasmRe, an article by @la_F0uin3 and myself, translated from an article originally published in @MISCRedac : aguinet.github.io/blog/2020/08/2… Code available here: github.com/aguinet/miasm-…

0 24 37 0 7

View Details

Miasm @MiasmRe

6 years ago

@0xrepnz @_sudhackar For a real case symbolic execution example, here is (an old) one: miasm.re/blog/2016/09/0…

1 0 3 0 1

View Details

Miasm @MiasmRe

6 years ago

@rh0main Thanks a lot to @w4kfu => the solution was in the redirection by *hash* of Apiset!

0 0 2 0 0

View Details

Miasm @MiasmRe

6 years ago

@rh0main If I don't mess up, api-ms-win-core-processthreads-l1-1-2 is not present in the ApiSet, and it's present on the disk (in the downlevel sub dir). So I definitively miss something here.

1 0 0 0 0

View Details

Miasm @MiasmRe

6 years ago

I am missing something here; On windows 10 15063: - In kernel32, IsProcessCritical is an export redirected to api-ms-win-core-processthreads-l1-1-2.IsProcessCritical - no ApiSet for this dll - in this dll, IsProcessCritical is... a redirected export to kernel32.IsProcessCritical