Thanks to @elykdeer@bird.makeup and the @binaryninja@infosec.exchange team for having me on the AI vs AI Binary Ninja stream. Great discussion on agentic RE, tooling, and feedback loops.
The recording of my first Binary Cartography webinar is now public:
Agentic Reverse Engineering: How AI Agents Are Changing Binary Analysis
Topics: keygenning, cracking & anti-tamper removal
Recording: https://www.youtube.com/watch?v=DZcDaXTvDeE
Slides/code/samples: https://github.com/mrphrazer/binary-cartography/tree/main/2026-03-agentic_reverse_engineering
RE: @mr_phrazer@infosec.exchange
Agentic reverse engineering can do a lot, but obfuscation still breaks many analysis workflows in malware and commercial software.
If you want to learn how to build & steer automation for analyzing protected code, check out my training at @recon@infosec.exchange
https://recon.cx/2026/en/trainingSoftwareDeobfuscationTechniques.html
New blog post: Building a Pipeline for Agentic Malware Analysis
Agentic RE + malware analysis with custom skills, MCP tooling, and persistent case state to automate intial triage
Link: https://synthesis.to/2026/03/18/agentic_malware_analysis.html
Github: https://github.com/mrphrazer/agentic-malware-analysis
RE: @mr_phrazer@infosec.exchange
I also published my Ghidra Headless MCP that follows similar design principles: https://github.com/mrphrazer/ghidra-headless-mcp
Recently my RE workflow moved into sandboxed VMs where agents have full control over the environment. I needed an MCP server that runs headless in the same sandbox and exposes way more of the #BinaryNinja API than others.
Here's the release: https://github.com/mrphrazer/binary-ninja-headless-mcp
New chapter: I've transitioned to a part-time Chief Scientist role at Emproof.
I’m shifting my focus to my independent work in reverse engineering:
trainings • consulting • tooling • research
Details: https://synthesis.to
Happy to bring my Software Deobfuscation Techniques training back to @recon@infosec.exchange - June 15–18, 2026 in Montreal!
Learn systematic approaches to defeating modern obfuscation found in DRM/anti-tamper & APT malware.
https://recon.cx/2026/en/trainingSoftwareDeobfuscationTechniques.html
Happy to share that later today (Friday, Nov 14, at 10:00 PM CET / 16:00 ET), I’ll be live on the #BinaryNinja livestream to talk about (anti-)reverse engineering & code (de)obfuscation. I'll also showcase some of my plugins.
The recording of our (CC @nicolodev@infosec.exchange talk "Breaking Mixed Boolean-Arithmetic Obfuscation in Real-World Applications" at @recon@infosec.exchange is now online!
Recording: https://www.youtube.com/watch?v=QxSGWk3MqaQ
Slides: https://synthesis.to/presentations/recon25_mba_obfuscation.pdf
#BinaryNinja Plugin: https://github.com/mrphrazer/obfuscation_analysis
The new version of my #BinaryNinja plugin Obfuscation Analysis (v1.2) adds recursive function inlining in the decompiler.
It collapses call-heavy code into a single function; analysis, constant propagation, DCE and other analyses work across boundaries.
We at emproof open-sourced a free firmware reverse engineering workshop for self-study.
Topics: ELF analysis, cracking, malware triage, embedded-Linux, bare-metal, crypto-key extraction, anti-analysis. Docker setup and solutions included.
https://github.com/emproof-com/workshop_firmware_reverse_engineering
The slides from our @recon@infosec.exchange talk, "Breaking Mixed Boolean-Arithmetic Obfuscation in Real-World Applications" (CC @nicolodev@infosec.exchange are now online!
Slides: https://synthesis.to/presentations/recon25_mba_obfuscation.pdf
Tomorrow at 3:30 pm, Nicolò Altamura and I will present our talk “Breaking Mixed Boolean-Arithmetic Obfuscation in Real-World Applications” at @recon@infosec.exchange
Details: https://cfp.recon.cx/recon-2025/talk/BKBQ37/
Plugin release: https://github.com/mrphrazer/obfuscation_analysis
New #BinaryNinja plugin: Obfuscation Analysis
Simplifies arithmetic obfuscation (MBA) directly in the decompiler (see demo below). Also identifies functions with corrupted disassembly.
Co-authored by @nicolodev@infosec.exchange ; available in the plugin manager.
Check it out: https://github.com/mrphrazer/obfuscation_analysis
Excited to teach my class on software deobfuscation in Paris at @hexacon_fr@bird.makeup Oct 6–9, 2025!
Learn advanced techniques to defeat state-of-the-art obfuscation in DRMs & APT malware.
https://www.hexacon.fr/trainer/blazytko/
#reverseengineering #malware #malwareanalysis #softwaresecurity
At @recon@infosec.exchange , @nicolodev@infosec.exchange and I discuss the current state of MBA (de)obfuscation and their applications. We’ll also introduce a new #BinaryNinja plugin for simplifying MBAs in the decompiler.
Details: https://cfp.recon.cx/recon-2025/featured/
I'll also give a training: https://recon.cx/2025/trainingSoftwareDeobfuscationTechniques.html
New heuristic in my #BinaryNinja plugin obfuscation_detection:
Duplicated Subgraphs uses iterative context hashing to spot repeated multi-block code. We merge each block’s signature with its successors over multiple rounds for efficiency.
My class on code deobfuscation at REcon Montreal (June 24-27) is now open for registration! Learn how to analyze obfuscated code and break it by writing custom tools using symbolic execution, SMT solving, and program synthesis.
Details & Register: https://recon.cx/2025/trainingSoftwareDeobfuscationTechniques.html
Happy to present "Unleashing AI: The Future of Reverse Engineering with Large Language Models" with @mu00d8@infosec.exchange at
@recon@infosec.exchange We'll cover current & future RE applications, running offline models and enhancing results by merging LLMs with static analysis.
https://recon.cx/2024/presentations.html
#reverseengineering #malwareanalysis #malware #AI #LLM #REcon2024