{"$schema": "https://c3voc.de/schedule/schema.json", "generator": {"name": "pretalx", "version": "2025.2.2"}, "schedule": {"url": "https://cfp.recon.cx/recon-2026/schedule/", "version": "0.5", "base_url": "https://cfp.recon.cx", "conference": {"acronym": "recon-2026", "title": "Recon 2026", "start": "2026-06-19", "end": "2026-06-21", "daysCount": 3, "timeslot_duration": "00:05", "time_zone_name": "Canada/Eastern", "colors": {"primary": "#3aa57c"}, "rooms": [{"name": "Grand Salon Opera", "slug": "1-grand-salon-opera", "guid": "0bbd3952-2f8b-5b94-bfa1-4da68fabba35", "description": "Grand Salon Opera", "capacity": null}, {"name": "Soprano A", "slug": "2-soprano-a", "guid": "ed4e98db-ac63-5754-851f-baf3e8b755a3", "description": null, "capacity": null}, {"name": "Soprano B", "slug": "3-soprano-b", "guid": "206dc37d-af7a-5bff-821b-42bfd62746ce", "description": null, "capacity": null}, {"name": "Soprano C", "slug": "4-soprano-c", "guid": "d7b91d51-8c8b-549d-b307-f47264645402", "description": null, "capacity": null}], "tracks": [], "days": [{"index": 1, "date": "2026-06-19", "day_start": "2026-06-19T04:00:00-04:00", "day_end": "2026-06-20T03:59:00-04:00", "rooms": {"Grand Salon Opera": [{"guid": "d60517e7-4ddb-5755-8612-b3dc31acc042", "code": "7PEBYD", "id": 105, "logo": null, "date": "2026-06-19T10:00:00-04:00", "start": "10:00", "duration": "00:30", "room": "Grand Salon Opera", "slug": "recon-2026-105-opening-ceremony", "url": "https://cfp.recon.cx/recon-2026/talk/7PEBYD/", "title": "Opening ceremony", "subtitle": "", "track": null, "type": "Short Talk", "language": "en", "abstract": "Opening ceremony", "description": "", "recording_license": "", "do_not_record": false, "persons": [], "links": [], "feedback_url": "https://cfp.recon.cx/recon-2026/talk/7PEBYD/feedback/", "origin_url": "https://cfp.recon.cx/recon-2026/talk/7PEBYD/", "attachments": []}, {"guid": "6b411fad-0f81-5912-9ec4-6f551bcbd583", "code": "YGP3RN", "id": 55, "logo": null, "date": "2026-06-19T10:30:00-04:00", "start": "10:30", "duration": "00:30", "room": "Grand Salon Opera", "slug": "recon-2026-55-i-have-to-use-ai-so-what-now-a-skeptic-guide-to-vibing-re-vr", "url": "https://cfp.recon.cx/recon-2026/talk/YGP3RN/", "title": "I have to use AI, so what now? A skeptic guide to vibing RE/VR", "subtitle": "", "track": null, "type": "Short Talk", "language": "en", "abstract": "What's a Claude? Why are we re-inventing IPCs? What's the difference between GPT-5.2 and 5.3? All great questions we will NOT answer in this presentation. Instead we will focus on how we can use AI to handle the annoying tasks while saving our time for the fun work. We'll see how we can identify binaries of interest and spicy code, create a VR harness in the age of MCP servers to automate report generation and the associated collection of necessary artifacts, and more. All-in-all, a pragmatic approach to using AI to enhance our reversing capabilities instead of deskilling ourselves.", "description": "", "recording_license": "", "do_not_record": false, "persons": [{"code": "D9UFBN", "name": "Philippe Laulheret", "avatar": "https://cfp.recon.cx/media/avatars/D9UFBN_v3tqJTJ.webp", "biography": "Philippe Laulheret is a Senior Vulnerability Researcher at Cisco Talos. With a focus on Reverse Engineering and Vulnerability Research, Philippe uses his background in Embedded Security and Software Engineering to poke at complex systems and get them to behave in interesting ways. \r\nPhilippe presented multiple projects covering hardware hacking, reverse engineering and exploitation at DEF CON, Black Hat, REcon, Hardwear.io, Eko Party and more. In his spare time, Philippe enjoys playing CTFs, immersing himself in the beauty of the Pacific Northwest, and exploring the realm of Creative Coding. Philippe holds a MSc in Computer Science from Georgia Tech and a MSc in Electrical and Computer Engineering from Sup\u00e9lec (France).", "public_name": "Philippe Laulheret", "guid": "3543aee5-ace3-528d-ba9c-07290c75f4ca", "url": "https://cfp.recon.cx/recon-2026/speaker/D9UFBN/"}], "links": [], "feedback_url": "https://cfp.recon.cx/recon-2026/talk/YGP3RN/feedback/", "origin_url": "https://cfp.recon.cx/recon-2026/talk/YGP3RN/", "attachments": [{"title": "Slides", "url": "/media/recon-2026/submissions/YGP3RN/resources/laulheret_recon26_9tE9RPy.pdf", "type": "related"}]}, {"guid": "dfe508da-358d-56d1-b4ee-bb3f9ffa8af8", "code": "EZTMNB", "id": 70, "logo": null, "date": "2026-06-19T11:00:00-04:00", "start": "11:00", "duration": "01:00", "room": "Grand Salon Opera", "slug": "recon-2026-70-click-once-and-stay-forever-uncovering-a-new-abuse-of-the-clickonce-technology", "url": "https://cfp.recon.cx/recon-2026/talk/EZTMNB/", "title": "Click Once and Stay Forever: uncovering a new abuse of the ClickOnce technology", "subtitle": "", "track": null, "type": "Talk", "language": "en", "abstract": "What if we told you there's a Windows feature that's been quietly sitting in plain sight for decades, just waiting to be weaponized in a way for which no one thought to look? Meet ClickOnce: Microsoft's well-intentioned deployment technology that lets users run, install, and automatically update applications with minimal interaction and zero admin privileges. While this feature has been simplifying software deployment for decades now, it turns out its convenience comes with some unexpected baggage.\r\n\r\nDeep diving into this overlooked technology, we reverse engineered the ClickOnce deployment stack from the ground up, documenting for the first time how its components actually work behind the scenes. Through this process, we uncovered a new abuse of the ClickOnce technology that allows an unprivileged user to establish fileless persistence on the system. By repurposing some old tricks, threat actors can abuse an attack surface exposed by the ClickOnce components to execute their payload every time a user interacts with a ClickOnce application. No elevated privileges needed, no suspicious files left behind, and as a bonus, the malicious payload runs under a native Windows process!\r\n\r\nIn this talk, we'll demystify the ClickOnce technology by exploring its deployment scenarios and documenting how it works behind the scene. We'll walk through the journey that led to our new discovery, demonstrate the technique live, and wrap up with practical detection strategies to protect against these techniques. By the end, you'll understand how sometimes the most unexpected threats come gift-wrapped in Microsoft's most helpful features.", "description": "", "recording_license": "", "do_not_record": false, "persons": [{"code": "7U7M3F", "name": "Mathilde Venault", "avatar": "https://cfp.recon.cx/media/avatars/7U7M3F_ZaGrSBU.webp", "biography": "Mathilde Venault is a security researcher at CrowdStrike, where she specializes in threat detection through malware analysis, adversary tradecraft research, and reverse engineering of Windows internals. She has delivered workshops and presented at conferences including Black Hat USA, REcon, 44CON, SinCon, and c0c0n, driven by a passion for documenting what Microsoft won't. True to her French roots, she's always down to turn any conference hallway into a dinner table \u2014 bread and cheese non-negotiable.", "public_name": "Mathilde Venault", "guid": "dd7549de-e58a-5732-98ec-24d870960bcc", "url": "https://cfp.recon.cx/recon-2026/speaker/7U7M3F/"}], "links": [], "feedback_url": "https://cfp.recon.cx/recon-2026/talk/EZTMNB/feedback/", "origin_url": "https://cfp.recon.cx/recon-2026/talk/EZTMNB/", "attachments": [{"title": "Slides of the talk", "url": "/media/recon-2026/submissions/EZTMNB/resources/REcon2026_VENAULT_Mathil_8aISNBr.pdf", "type": "related"}]}, {"guid": "5101a7cd-039e-56c5-ae8a-c2576f9a7423", "code": "8BJ3KP", "id": 93, "logo": "https://cfp.recon.cx/media/recon-2026/submissions/8BJ3KP/Screenshot_2026-04-10_at_1.34.23P_xJyhj4G.webp", "date": "2026-06-19T13:00:00-04:00", "start": "13:00", "duration": "01:00", "room": "Grand Salon Opera", "slug": "recon-2026-93-fat-chungus-cve-2025-24857-a-journey-through-u-boot-exploitation", "url": "https://cfp.recon.cx/recon-2026/talk/8BJ3KP/", "title": "FAT Chungus: CVE-2025-24857 - A Journey Through U-Boot Exploitation", "subtitle": "", "track": null, "type": "Talk", "language": "en", "abstract": "Amazon Element55 unpacks CVE-2025-24857, a severe flaw they discovered in U-Boot\u2019s FAT filesystem support that exposes unauthorized code execution. This talk will elucidate the requisite lore of our research and methodology, how Amazon responded internally, and the coordinated disclosure process.", "description": "lol AI summary:\r\n\r\nKey Topics Covered:\r\n\r\nThe Vulnerability\r\n\r\nRoot Cause: An integer underflow in U-Boot\u2019s get_fatent() function triggered during file reads from attacker-controlled USB devices.\r\nImpact: Bypasses secure boot, enabling arbitrary code execution on otherwise hardened devices.\r\nScope: Affects U-Boot versions prior to 2017.11, Qualcomm IPQ chipsets (IPQ4019, IPQ5018, etc.), and devices like Amazon eero routers.\r\n\r\nDiscovery & Fuzzing\r\n\r\nChallenge: Fuzzing a 250MB FAT32 filesystem was impractical due to size constraints.\r\nSolution: Zombified U-Boot\u2019s FAT reader into a Linux userland tool, embedding the entire FAT image for targeted sector fuzzing.\r\nBreakthrough: Crashes identified within minutes by focusing on the FAT header sector.\r\nExploitation Chain\r\n\r\nTriggering the Bug: Manipulating the root_cluster parameter to force fatlength < startblock, causing getsize to underflow to ~UINT32_MAX.\r\nMemory Layout: Deterministic addresses in executable RAM (0x4a900000\u20130x4aa00000) with disabled NX-bit.\r\nOverflow Control: Using USB emulation (Facedancer/Cynthion) to send empty sector responses, triggering U-Boot\u2019s recovery mode and enabling precise overflow length control.\r\nCode Execution: Hijacking U-Boot\u2019s environment variable hash table via overflow to redirect execution to attacker-controlled shellcode.\r\nPayload Development\r\n\r\nRust Implementation: Safe, panic-handled Rust code for heap restoration, interrupt disablement, and kernel loading.\r\nHeap Repair: Rebuilding DLMalloc linked lists and re-importing environment variables from eMMC.\r\nBootargs Manipulation: Enabling root shell via systemd.wants=serial-getty@ttyMSM0.service.\r\nResponsible Disclosure & Mitigation\r\n\r\nCoordinated Response: Collaboration with CISA (Advisory ICSA-25-343-01), Qualcomm, and the U-Boot Project.\r\nAmazon\u2019s Action: Patched tens of millions of eero routers via automatic, cryptographically signed updates by January 2025.\r\nFix: Upgrade to U-Boot v2025.4 or later.", "recording_license": "", "do_not_record": false, "persons": [{"code": "ZVLTSB", "name": "Tim Noise", "avatar": "https://cfp.recon.cx/media/avatars/ZVLTSB_bSMTbCJ.webp", "biography": "Tim is a professional Silvio Cesare impersonator who specializes in wedding(), birthday_party() and funeral().", "public_name": "Tim Noise", "guid": "85a4318d-5edd-5191-887c-75a7f806b247", "url": "https://cfp.recon.cx/recon-2026/speaker/ZVLTSB/"}, {"code": "98WEGB", "name": "bryce case, jr./ytcracker", "avatar": "https://cfp.recon.cx/media/avatars/98WEGB_MvBAjvn.webp", "biography": "eternal practitioner of the mystical dark arts of gibson hacking and fearless leader of a veritable global army of digital gangsters.", "public_name": "bryce case, jr./ytcracker", "guid": "92dc5bc7-054b-5060-b101-5003318db714", "url": "https://cfp.recon.cx/recon-2026/speaker/98WEGB/"}], "links": [], "feedback_url": "https://cfp.recon.cx/recon-2026/talk/8BJ3KP/feedback/", "origin_url": "https://cfp.recon.cx/recon-2026/talk/8BJ3KP/", "attachments": []}, {"guid": "0bce6335-c416-5d6a-a0f5-a04cbca5219b", "code": "PSNDXB", "id": 45, "logo": null, "date": "2026-06-19T14:00:00-04:00", "start": "14:00", "duration": "01:00", "room": "Grand Salon Opera", "slug": "recon-2026-45-select-from-binary-vibe-reversing-across-ida-ghidra-and-binary-ninja", "url": "https://cfp.recon.cx/recon-2026/talk/PSNDXB/", "title": "SELECT * FROM binary \u2014 Vibe Reversing Across IDA, Ghidra, and Binary Ninja", "subtitle": "", "track": null, "type": "Talk", "language": "en", "abstract": "\"Vibe coding\" lets developers build software by describing intent to an AI agent. Can the same approach work for reverse engineering - where the analyst describes what they want to understand and the agent drives the tools?\r\n\r\nThree tools - idasql (IDA Pro), ghidrasql (Ghidra), and bnsql (Binary Ninja) - expose the internals of each platform as live SQL virtual tables: functions, cross-references, strings, types, disassembly, and decompilation, all queryable and writable through standard SQL. The same query runs against all three tools. Because SQL is the one query language every LLM already speaks fluently, these tools turn any AI coding agent into a reverse engineering partner - no scripting, no plugins, no tool-specific API knowledge required.\r\n\r\nWe will demonstrate live \"vibe reversing\" sessions: an analyst converses naturally with an AI agent that autonomously issues SQL queries, decompiles\r\nfunctions, annotates variables, recovers types, and cross-references findings across multiple binaries and multiple RE tools simultaneously. We will show side-by-side analysis of the same binary in IDA, Ghidra, and Binary Ninja, driven entirely through natural language, and transfer annotations between them.", "description": "Every major RE tool has a powerful but incompatible scripting API. Analysts must learn each one. AI agents can't easily drive them without tool-specific glue code. There is no common interface -- until now.\r\n\r\nidasql, ghidrasql, and bnsql expose the internals of IDA Pro, Ghidra, and Binary Ninja as live SQL virtual tables -- 30+ tables covering functions, cross-references, strings, types, disassembly, and decompilation. These tables are not read-only exports: analysts and AI agents can rename functions, annotate variables, apply types, set comments, and manage bookmarks through standard SQL INSERT/UPDATE/DELETE statements. Changes are reflected live in the RE tool.\r\n\r\nBecause SQL is the one query language every LLM already speaks fluently, this turns any AI coding agent into a reverse engineering partner -- no IDAPython, no Ghidra scripts, no tool-specific plugins required.\r\n\r\nThis talk covers:\r\n\r\n**One language, three tools.** The same SQL query runs against IDA, Ghidra, and Binary Ninja. We show how `SELECT name, size FROM funcs ORDER BY size DESC LIMIT 10` returns near-identical results across all three tools for the same binary -- and where the interesting differences are.\r\n\r\n**The decompiler as a database.** Decompiled pseudocode, AST nodes, local variables, and call arguments are all queryable tables. We demonstrate queries like \"find all functions that call malloc without checking the return value\" expressed as pure SQL joins across decompiler and cross-reference tables.\r\n\r\n**Read-write reverse engineering.** These tools don't just query -- they write back. We walk through a complete annotation workflow: the agent decompiles a function, renames variables to meaningful names, applies recovered struct types, adds comments explaining the logic, and bookmarks points of interest. All through SQL, all persisted to the database.\r\n\r\n**AI-driven analysis sessions.** Live demonstration of \"vibe reversing\": an analyst describes what they want in natural language, and the AI agent autonomously drives the RE tool. We show single-binary triage from scratch, cross-tool comparison of the same binary in IDA and Ghidra side by side, and multi-database campaigns where the agent cross-references findings across related malware samples.\r\n\r\n**Cross-tool annotation transfer.** An agent reads the annotations, variable names, and type definitions from one tool's database and applies them in another -- bridging the gap between analysts who use different RE tools on the same project.\r\n\r\n**Autonomous type recovery.** The agent reads decompiler output, identifies pointer arithmetic patterns and field access offsets, and constructs struct, union, and enum definitions through SQL -- creating types, adding members, and applying them to variables and function signatures. We show how an agent recovers a multi-level struct hierarchy from raw decompiler output and applies it across all functions that reference it.\r\n\r\n**Source recovery from binaries.** We show a complete end-to-end case: starting from a stripped binary, the agent iteratively decompiles, annotates, recovers types and structures, and produces compilable source code -- all driven by natural conversation. We also demonstrate guided recovery where the agent is given partial source code alongside a binary and reconstructs the missing pieces by correlating decompiler output against the known code.\r\n\r\n**Malware analysis in practice.** We walk through a real-world C2 malware sample with layered complexity: an outer loader, an inner DLL, and embedded plugin blobs, each requiring extraction and independent analysis. The agent autonomously identifies the layers, extracts the embedded components, opens them in separate database sessions, cross-references between them, and produces a complete annotated teardown of the malware's architecture.\r\n\r\n**Multi-database diffing.** With multiple databases open simultaneously, the agent compares two versions of the same binary -- identifying new functions, changed code paths, and patched vulnerabilities. This extends naturally to malware variant analysis, patch diffing, and firmware update comparison.\r\n\r\n**Practical limits and honest lessons.** Where LLMs excel at RE tasks (pattern matching, bulk annotation, cross-referencing, structure recovery), where they still struggle (complex control flow, novel obfuscation, very large functions), and what the SQL interface cannot yet capture.\r\n\r\nAttendees will leave with a concrete understanding of how to connect AI agents to their existing RE workflow across any of the three major platforms, and what \"vibe reverse engineering\" looks like in practice today.", "recording_license": "", "do_not_record": false, "persons": [{"code": "GY3RDQ", "name": "Elias Bachaalany", "avatar": "https://cfp.recon.cx/media/avatars/GY3RDQ_zN3nT7H.webp", "biography": "Elias is a longtime IDA pro user with over 20 years of experience. He was also a programmer for IDA, and during his Hex-Rays tenure, he developed key features such as the Bochs and WinDbg plugins and contributed vastly to IDAPython. Today, Elias is a game security engineer who focuses on helping first- and third-party game studios mitigate against cheaters and game vulnerabilities.\r\nIn his free time, Elias runs the @allthingsIDA YouTube channel dedicated to teaching practical reverse engineering with IDA Pro and various reverse engineering tools.\r\nAdditionally, Elias is an accomplished author/co-author with titles such as Batchography: The Art Of Batch Files Programming, Practical Reverse Engineering, and The Antivirus Hacker's Handbook.\r\nElias is embarking on his fifth year of teaching with us.\r\nFun fact: Elias likes riding Electric Unicycles (EUCs) with over 6,000 miles so far. He is an intermediate racing FPV drone flyer and a good bowling player. Elias can handle technical discussions alongside spiritual and new-age topics in a single sitting.", "public_name": "Elias Bachaalany", "guid": "b9d690e6-47c1-5c77-a948-4739c7d8a212", "url": "https://cfp.recon.cx/recon-2026/speaker/GY3RDQ/"}], "links": [], "feedback_url": "https://cfp.recon.cx/recon-2026/talk/PSNDXB/feedback/", "origin_url": "https://cfp.recon.cx/recon-2026/talk/PSNDXB/", "attachments": []}, {"guid": "dc7aaf02-0227-5aa7-8ed3-27059d9d8d74", "code": "A99GW9", "id": 56, "logo": null, "date": "2026-06-19T15:00:00-04:00", "start": "15:00", "duration": "00:30", "room": "Grand Salon Opera", "slug": "recon-2026-56-deobfuscation-in-the-age-of-agentic-reverse-engineering", "url": "https://cfp.recon.cx/recon-2026/talk/A99GW9/", "title": "Deobfuscation in the Age of Agentic Reverse Engineering", "subtitle": "", "track": null, "type": "Short Talk", "language": "en", "abstract": "Agentic workflows are rapidly changing how we reverse engineer binaries. Large language models are no longer limited to explaining decompiler output or writing small helper scripts; when paired with real tooling, they can drive analysis, orchestrate workflows, and connect multiple analysis layers faster and at a larger scale than a human analyst alone. In this talk, we explore what this shift means for code deobfuscation, from deflattening, opaque-predicate removal, and string recovery to interprocedural and whole-program deobfuscation. We argue that the key advance is not that models suddenly understand obfuscated code perfectly, but that they can now coordinate the broader workflow around deobfuscation. We conclude by examining what kinds of obfuscation may remain resilient in the face of increasingly agentic reverse engineering.", "description": "Large language models first entered reverse engineering as helpful assistants: improving decompiler output, suggesting names, answering questions about code, and generating small analysis scripts. Useful as these capabilities were, they largely remained confined to the role of a smart helper sitting next to the analyst. But reverse engineering has changed quickly. With tool-connected, agentic workflows, models are no longer limited to commenting on pseudocode. They can query disassemblers and decompilers, inspect cross-references and intermediate representations, generate custom scripts, patch binaries, rerun analyses, and iteratively refine hypotheses in a loop. The result is a fundamental shift: from LLM-assisted code reading to agentic reverse engineering.\r\n\r\nThis shift is especially significant for deobfuscation. Rather than a single clever trick, deobfuscation is usually an iterative process of recovering structure, applying transformations, and reanalyzing the result until something meaningful emerges. Agentic workflows are unusually well matched to this style of work. They can automate common simplification steps, connect different analysis layers, and keep pushing the program toward something more understandable.\r\n\r\nOnce deobfuscation becomes agentic, it also becomes more global. Instead of operating on one function at a time, agents can help identify core routines, propagate recovered semantics across the call graph, mine repeated obfuscation motifs, and apply transformations at interprocedural or whole-program scale. This changes the practical unit of work in reverse engineering: from manually attacking isolated functions to coordinating larger deobfuscation campaigns across an entire binary or malware family.\r\n\r\nIn this talk, we revisit the state of LLM-assisted reverse engineering from our earlier work and examine how the landscape has evolved. We argue that the key breakthrough is not that models suddenly understand obfuscated code perfectly, but that they can now help orchestrate the broader workflow around deobfuscation: tool usage, reasoning, scripting, patching, and iterative refinement. This naturally leads to the defensive question as well. If reverse engineering is becoming agentic, what must obfuscation look like to remain resilient against attacks that are tool-driven, scriptable, and scalable? We close by exploring the emerging design space of anti-agentic obfuscation, including intertwined and global obfuscation layers, diversification, and structures that resist clean decomposition and large-scale automation.", "recording_license": "", "do_not_record": false, "persons": [{"code": "3JSLC8", "name": "Nicol\u00f2 Altamura", "avatar": "https://cfp.recon.cx/media/avatars/3JSLC8_DkcmPnw.webp", "biography": "Nicol\u00f2 Altamura is a security engineer (MSc, University of Verona) working in software protection field. He specializes in reverse engineering, static analysis, and software security, creating tools like disassemblers, decompilers, and obfuscation frameworks. Through his blog and open-source projects, he explores advanced topics ranging from Mixed Boolean-Arithmetic transformations to malware detection heuristics. Drawing on both academic research and hands-on experience, he aims to bridge theory and practice in the field of software protection.", "public_name": "Nicol\u00f2 Altamura", "guid": "6bfd198e-410c-5967-a330-27a80961cacf", "url": "https://cfp.recon.cx/recon-2026/speaker/3JSLC8/"}, {"code": "SF3BPX", "name": "Tim Blazytko", "avatar": "https://cfp.recon.cx/media/avatars/SF3BPX_LepBS4b.webp", "biography": "Tim Blazytko is a well-known binary security researcher and reverse-engineering expert with a PhD in program analysis. He focuses on independent consulting and hands-on work across reverse engineering and software protection. He regularly contributes to the reverse engineering community through trainings, international conference talks, research papers, and open-source tools. Furthermore, he supports clients with advanced binary analysis, malware investigations, and security audits. Tim also serves as Chief Scientist at Emproof.", "public_name": "Tim Blazytko", "guid": "f6cb2fb5-fceb-54ef-b2d2-dc9fb3068c16", "url": "https://cfp.recon.cx/recon-2026/speaker/SF3BPX/"}], "links": [{"title": "Slides of \"Deobfuscation in the Age of Agentic Reverse Engineering\"", "url": "https://synthesis.to/presentations/recon26_agentic_deobfuscation.pdf", "type": "related"}], "feedback_url": "https://cfp.recon.cx/recon-2026/talk/A99GW9/feedback/", "origin_url": "https://cfp.recon.cx/recon-2026/talk/A99GW9/", "attachments": []}, {"guid": "eb319fb6-804c-5601-aec0-dbfc3d6081b4", "code": "ECTXZH", "id": 86, "logo": null, "date": "2026-06-19T16:00:00-04:00", "start": "16:00", "duration": "01:00", "room": "Grand Salon Opera", "slug": "recon-2026-86-chaining-microsoft-binaries-to-get-privileged-primitives-in-windows-kernel", "url": "https://cfp.recon.cx/recon-2026/talk/ECTXZH/", "title": "Chaining Microsoft binaries to get privileged primitives in Windows kernel", "subtitle": "", "track": null, "type": "Talk", "language": "en", "abstract": "We leveraged a novel code injection to a PPL process we call \u2018Bring Your Own Vulnerable WerFaultSecure\u2019 and then abuse Microsoft System Guard for privileged primitives in the kernel. We\u2019ll explain how to make WerFaultSecure run arbitrary code and the vulnerabilities we found in a Microsoft driver.", "description": "The goal of our research was to find undocumented pathways to escalate privileges to the Windows kernel while evading endpoint security solutions. For that end, we found a driver of Microsoft System Guard, which is shipped out of the box, that could be leveraged. Using it from user-space however had limitations. To overcome them, we are forced to run as PPL-WinTCB process, the highest protection level in Windows user-mode. To do that reliably, we showcase a new method to inject code into such a process.\r\nOur novel PPL injection technique leverages the IRundown COM interface to achieve code execution within the process WerFaultSecure.exe, which runs at the highest protection level (WinTCB), and is successfully tested on the latest version of Windows 11. What inspired us to target WerFaultSecure.exe specifically was a vulnerability introduced by James Forshaw in 2018. \r\nThe vulnerability allowed for code injection into the WinTCB-signed WerFaultSecure.exe by abusing a code path in FaultRep.dll (a WerFaultSecure.exe dependency) to enable the IRundown COM interface. This code execution primitive has been widely abused to hijack threads through the DoCallback method. Similarly, in 2023 Clement Labro took advantage of an arbitrary pointer overwrite in ntdll.dll to force PPL processes to load unsigned dynamic libraries, thus achieving code execution in the context of protected processes. In response, Microsoft introduced several countermeasures to inhibit these attacks.\r\nDuring the talk we will showcase how to bypass these mitigations altogether. In particular, we will walk the audience through:\r\nThe abuse of an old vulnerable version of WerFaultSecure which has a Dll Sideloading vulnerability, which we exploit to load an old version of FaultRep, which contains the COM vulnerability. We call this technique \u2018Bring Your Own Vulnerable WerfaultSecure\u2019; \r\nThe abuse of a section object which is shared by WerFaultSecure.exe and its parent process. We will show how to construct a ROP chain on the shared memory which will be executed by the DoCallback method of the IRundown interface. This ROP chain is needed in order to give our shellcode the required execute permissions.\r\nHow to retrieve and decrypt the secrets that are needed to remotely connect to the interface from PPL processes that are using this communication method. \r\nHow to connect to the target interface and craft a ROP chain in the shared section aforementioned. This will enable us to pivot the execution from the ROP chain to custom shellcode. Last but not least, we will briefly discuss the concept of Control Flow Guard, or CFG, the need for admin privileges to disable it for the exploit to work, as well as ideas to bypass this requirement and new pathways to privilege escalation through PPL injection.\r\nAfter meeting the prerequisite - executing code at PPL-WinTCB level, we continue to achieve kernel-mode (ring 3) privileges.\r\nMicrosoft System Guard is a Windows native infrastructure which validates operating system and device integrity by verifying that certain parts of kernel objects like drivers, devices, processes, threads have not been altered. It achieves this by leveraging an assertion engine running in VTL1 (SgrmEnclave_secure.dll), in combination with a kernel-mode driver - SgrmAgent.sys - which provides it with different facilities. Checks can be performed on the fields IntegrityLevel or TokenSource of the object _TOKEN owned by certain critical processes such as MsMpEng.exe for instance. This driver starts automatically at startup on every Windows 10 (and equivalent Server) release. SgrmAgent.sys enforces the following checks: \r\nThe caller must be WinTCB-signed;\r\nThe caller service security identifier (SID) must match a SID that is hardcoded within the driver;\r\nThe driver can be initialized only once, meaning only one handle can be granted.\r\n\r\nSgrmBroker.exe is the only process which is allowed to acquire a handle to the driver by design. This is because it runs as a protected process, and its service SID matches the one the driver expects. Hence we leveraged our novel PPL injection to make WerFaultSecure execute a shellcode which opens the broker process and steals its handle to the driver, thus bypassing the checks altogether. We then use the stolen handle to communicate with the driver.\r\n\r\nOur research examined SgrmAgent.sys\u2019s IOCTLs which yielded a treasure trove, subverting System Guard\u2019s defensive purpose. We identified multiple \u2018sub-IOCTLs\u2019 within the \u2018OctpMailboxDispatcher\u2019 handler which enable the caller to:\r\nread kernel virtual memory and physical memory;\r\nmap files and virtual memory of processes;\r\nread model-specific registers.\r\n\r\nThese routines are used by the assertion engine to implement certain checks as one would expect. What is more surprising is that we also came across the thread-freezing sub-IOCTL - \u2018OctpHandleFreezeThread\u2019 - which can halt threads indefinitely by scheduling an ad-hoc kernel Asynchronous Procedure Call. This allows not only to access sensitive processes but even to bypass tampering protections enforced by 3rd party kernel drivers.\r\n\r\nWe will run a live demo of the entire attack and discuss possible detection opportunities.\r\n\r\nWhile Microsoft does not consider admin-to-kernel a security boundary due to the fact that admin users can load 3rd party drivers, our research demonstrates that it is possible to escalate to the kernel with only Microsoft binaries and without loading a driver.\r\n\r\n\r\nReferences:  \r\nhttps://googleprojectzero.blogspot.com/2018/11/injecting-code-into-windows-protected.html \r\nhttps://x.com/GabrielLandau/status/1683854578767343619 \r\nhttps://blog.scrt.ch/2023/03/17/bypassing-ppl-in-userland-again/ \r\nhttps://iamelli0t.github.io/2021/04/10/RPC-Bypass-CFG.html  \r\nhttps://github.com/Slowerzs/PPLSystem\r\nhttps://infocon.org/mirrors/vx%20underground%20-%202025%20June/Papers/Windows/Internals%20and%20Analysis/2022-08-02%20-%20Inside%20Windows%20Defender%20System%20Guard%20Runtime%20Monitor.pdf\r\nhttps://www.microsoft.com/en-us/security/blog/2018/04/19/introducing-windows-defender-system-guard-runtime-attestation/", "recording_license": "", "do_not_record": false, "persons": [{"code": "MJPNYP", "name": "Angelo Frasca Caccia", "avatar": "https://cfp.recon.cx/media/avatars/MJPNYP_6NFCMBm.webp", "biography": "Angelo is a security researcher specialised in Windows Internals. He currently works at SentinelOne, where he conducts research on advanced exploits and tampering techniques targeting the Windows ecosystem. Angelo\u2019s background also includes web application penetration testing and red teaming, particularly assume-breach adversary simulations. \r\n\r\nAngelo is eCXD, eCPPT, eJPT and OSCP certified. He enjoys reverse engineering and programming. His GitHub profile (https://github/lem0nSec) features his main contributions to the cybersecurity community.\r\n\r\nAngelo has a master\u2019s degree in International Security Studies from University of Leicester, where he graduated in 2021 with the \u2018Best Campus-Based Masters Dissertation Prize\u2019 and the \u2018Best Campus-Based Masters Student Performance Prize\u2019.", "public_name": "Angelo Frasca Caccia", "guid": "85f6dd35-1559-55ac-8088-802e76f78178", "url": "https://cfp.recon.cx/recon-2026/speaker/MJPNYP/"}, {"code": "UXNHGE", "name": "Alejandro Pinna", "avatar": null, "biography": "Alejandro Pinna is the manager of the Offensive Security Research team in SentinelOne, focusing on Offensive Tradecraft and evasive TTP analysis.\r\nPassionate about CyberSecurity and Offensive Security for many years, belonged to one of the most advanced Red Teams in Spain till he joined SentinelOne in 2022, where he contributed with advanced research till finally he started leading the team in January 2025\r\n\r\nAngelo Frasca is part of the Exploits and Antitampering Research team in SentinelOne for the last 2 years.\r\nHis work consists on understanding which techniques Windows Exploits use to obtain privileged primitives in the kernel and creating defenses against them, improving SentinelOne EDR self-protection and detection capabilities", "public_name": "Alejandro Pinna", "guid": "50365d7d-0842-5ace-8968-da6e6c59e597", "url": "https://cfp.recon.cx/recon-2026/speaker/UXNHGE/"}], "links": [], "feedback_url": "https://cfp.recon.cx/recon-2026/talk/ECTXZH/feedback/", "origin_url": "https://cfp.recon.cx/recon-2026/talk/ECTXZH/", "attachments": [{"title": "Slides", "url": "/media/recon-2026/submissions/ECTXZH/resources/Angelo_Frasca_Caccia__A_PJ7WuNK.pdf", "type": "related"}]}, {"guid": "d6b699d6-057e-5e5f-b4a7-bbabe35dc1f4", "code": "8TZSJN", "id": 96, "logo": null, "date": "2026-06-19T17:00:00-04:00", "start": "17:00", "duration": "01:00", "room": "Grand Salon Opera", "slug": "recon-2026-96-8-years-of-reverse-engineering-interpreters-techniques-automation-and-one-framework", "url": "https://cfp.recon.cx/recon-2026/talk/8TZSJN/", "title": "8 Years of Reverse-Engineering Interpreters: Techniques, Automation, and One Framework", "subtitle": "", "track": null, "type": "Talk", "language": "en", "abstract": "Over the past eight years we have systematically reverse-engineered nearly ten interpreter and VM binaries, including Lua, Python, Ruby, PHP, VBScript, JScript, PowerShell, and V8, to extract their internal structures and automate that extraction at scale. This talk presents 11 concrete analysis techniques, organized around 6 foundational binary analysis approaches, for recovering interpreter internals from stripped binaries. The techniques include multiple detection logics for VM component recovery that identify their exact locations in memory, and a progressive deduction algorithm for ISA recovery that iteratively eliminates opcode ambiguity across hundreds of test traces. Together they power STAGER, our automated dynamic analysis system built on top of Intel Pin. STAGER completes a full analysis of one interpreter in at most a couple of hours, which is an order-of-magnitude improvement over manual reverse engineering that typically takes days to weeks, and keeps pace with the frequent version updates of real-world interpreter binaries. We will release STAGER as open-source at the conference.\r\n\r\nThe security payoff is direct. We use STAGER output to build script-level API tracers, which hook the interpreter's own built-in API functions (e.g., eval), enabling behavioral monitoring across diverse interpreter targets. We further leverage branch VM instruction identification and conditional flag detection to build a multi-path explorer, and use recovered ISA mappings to perform dynamic bytecode instrumentation; together these enable fine-grained analysis of evasive script malware that actively resists conventional debugging. We also combine STAGER output with fuzzing harnesses for vulnerability discovery in interpreter runtimes, and demonstrate bytecode-based process injection techniques for red team operations that bypass diverse security mechanisms. These applications are grounded in real targets and will be shown in a live demo.\r\n\r\nBeyond the techniques themselves, we share hard-won lessons from nearly ten real-world targets: how compiler register allocation breaks memory-based variable tracking and how to compensate with register-level static analysis, how to handle interpreters layered atop other interpreters (e.g., PowerShell on .NET CLR) where execution traces interleave two VM layers, and how to suppress or work around JIT compilation interference, including the aggressive JIT behavior seen in V8. Accuracy results across all targets, including honest failure cases where our approach hits fundamental limitations, are presented per technique.\r\n\r\nThree concrete takeaways for attendees:\r\n1. A working mental model of interpreter internals as attack and analysis surface, grounded in nearly ten real-world targets.\r\n2. The 11-technique framework, including VM component localization logics and a progressive ISA deduction algorithm, directly applicable to diverse interpreter binaries.\r\n3. STAGER (open-source release) and the methods to adapt it to new interpreter targets.", "description": "", "recording_license": "", "do_not_record": false, "persons": [{"code": "FVYQBM", "name": "Toshinori Usui", "avatar": "https://cfp.recon.cx/media/avatars/FVYQBM_J0IZx76.webp", "biography": "Toshinori Usui is an associate distinguished researcher and security principal at NTT Social Informatics Laboratories, with 10+ years of experience in binary analysis, malware analysis, and offensive security. Toshinori has presented his research at top-tier hacker and academic conferences such as Black Hat USA Briefings, REcon, RAID, and ACSAC. He is also a CTF lover focused on reversing and pwn, formerly belonging to Sutegoma2 and binja and currently Team Enu. Toshinori received his Ph.D. in 2021 and has some security certificates, including GREM and GCFE.", "public_name": "Toshinori Usui", "guid": "72159fb9-cc73-58f2-aebd-20634b2e7664", "url": "https://cfp.recon.cx/recon-2026/speaker/FVYQBM/"}], "links": [], "feedback_url": "https://cfp.recon.cx/recon-2026/talk/8TZSJN/feedback/", "origin_url": "https://cfp.recon.cx/recon-2026/talk/8TZSJN/", "attachments": []}, {"guid": "6b89eee9-1d4a-5f71-a55f-c0379764a3c1", "code": "SN8MYU", "id": 104, "logo": null, "date": "2026-06-19T18:30:00-04:00", "start": "18:30", "duration": "01:00", "room": "Grand Salon Opera", "slug": "recon-2026-104-the-ai-reversing-panel-are-we-all-powerful-or-out-of-a-job", "url": "https://cfp.recon.cx/recon-2026/talk/SN8MYU/", "title": "The AI Reversing Panel: Are we all powerful, or out of a job?", "subtitle": "", "track": null, "type": "Panel", "language": "en", "abstract": "It\u2019s not every day we convene a panel at Recon.\r\nAI affects us all, but where can we go beyond buzzwords and make it concrete?\r\n- What actually works, how we set up our own harnesses, what constantly fails, and what works today that didn\u2019t even a month ago? Are there limits?\r\n- How the technology affects us daily, from attackers to defenders? We see software development sped up to the max, models finding vulnerabilities autonomously, malware being dissected by AI, and written even faster.\r\n- Topics such as disclosure, when vulnerability in code == public, and if coordinated disclosure can survive it. Is full disclosure back?\r\n- And lastly\u2026 are we still going to have a job in a year or two? Will there still be a need for researchers? Let\u2019s be specific.\r\nWe will welcome surprise guests to the panel, as we cycle through topics. The topics themselves are discussion seeds only.", "description": "", "recording_license": "", "do_not_record": false, "persons": [{"code": "7Q8BGY", "name": "John McIntosh", "avatar": "https://cfp.recon.cx/media/avatars/7Q8BGY_VsENv6N.webp", "biography": "John McIntosh (@clearbluejar) is a security researcher at ClearSecLabs specializing in reverse engineering and offensive security. His expertise spans binary analysis, patch diffing, and vulnerability discovery, with multiple open-source security tools for vulnerability research available on his GitHub. His website, https://clearbluejar.github.io/, features detailed write-ups on reversing recent CVEs and building RE tooling with Ghidra.\r\n\r\nJohn has delivered advanced reverse engineering and vulnerability discovery talks at leading international security conferences worldwide, including Black Hat, REcon, Insomnihack, Ringzer0, SecTor, 44CON, and DEF CON. His sessions emphasize systematic, reproducible workflows and hands-on, AI-augmented analysis, consistently recognized for clarity and technical depth. A distinguished presenter and educator, John maintains a fervent commitment to sharing cutting-edge research, advancing binary analysis, and fostering collaboration within the global security community.", "public_name": "John McIntosh", "guid": "a86723a0-d43e-5cdc-bea2-78bcf82dc47d", "url": "https://cfp.recon.cx/recon-2026/speaker/7Q8BGY/"}, {"code": "HJHJCD", "name": "Aaron Portnoy", "avatar": null, "biography": "Aaron Portnoy is Chief Product Officer at Mindgard and the inaugural Hacker Fellow at Dartmouth College, applying over twenty years of offensive research to AI security. He created the Pwn2Own hacking competition, organizing and judging its first six iterations while running research at TippingPoint's Zero Day Initiative, and went on to co-found Exodus Intelligence, one of the first firms to commercialize zero-day research. Over his career he has personally discovered hundreds of zero-day vulnerabilities in software from vendors including OpenAI, Cursor, NVIDIA, Microsoft, Google, Amazon, Palo Alto Networks, and Adobe; authored the award-winning IDA Toolbag; and published research in Phrack. He has led offensive programs at Raytheon and Boldend and pioneered attack surface management research at Randori through its IBM acquisition. His current research focuses on the security of AI systems. Featured in TIME Magazine's 2014 cover story \"World War Zero,\" Aaron has delivered over thirty invited talks at venues including Black Hat, REcon, CanSecWest, EkoParty, USENIX WOOT, BlueHat, RSA, and the NSA Distinguished Speaker Series.", "public_name": "Aaron Portnoy", "guid": "53291744-d3b0-5d9a-9d67-9c60bf13f569", "url": "https://cfp.recon.cx/recon-2026/speaker/HJHJCD/"}, {"code": "CHDPND", "name": "Marion Marschalek", "avatar": null, "biography": "Marion Marschalek is an independent security consultant and trainer with her consulting company Hack & Cheese. Prior to that she held senior positions at AWS and Intel, and different roles in the threat detection industry, as a malware reverse engineer and incident responder. Marschalek is a frequent speaker at major security conferences, including Black Hat, Defcon, HITB, RSA, and SyScan, among others. She used to teach reverse engineering classes at University of Applied Sciences St. Poelten, from where she graduated in 2011 with a Master\u2019s Degree in Information Security. In 2015 she started a hacker bootcamp for women titled BlackHoodie, which over the years established itself as a global initiative to attract more diverse talent to the security industry. In her spare time she enjoys long distance running.", "public_name": "Marion Marschalek", "guid": "493a2911-701b-55d8-b999-9b1e5226309f", "url": "https://cfp.recon.cx/recon-2026/speaker/CHDPND/"}, {"code": "JCK7LZ", "name": "Gadi Evron", "avatar": null, "biography": "Founder and CEO at Knostic, CISO-in-Residence for AI, Cloud Security Alliance.\r\n\r\nGadi Evron is Founder and CEO at Knostic, an AI agent security company, CISO-in-Residence for AI at CSA, and chairs the [un]prompted conference. Previously, he founded Cymmetria (acquired), was the Israeli National Digital Authority CISO, founded the Israeli CERT, and headed PwC's Cyber Security Center of Excellence. He wrote the post-mortem analysis of the \"First Internet War\" (Estonia 2007), founded some of the first information-sharing groups (TH-Research, 1997, DA/MWP, 2004), wrote APT reports (Rocket Kitten - 2014, Patchwork - 2016), and the first paper on DNS DDoS Amplification Attacks (2006). Gadi has written two books on cybersecurity, is a frequent contributor to industry publications, and speaker at industry events, from Black Hat (2008, 2015) to Davos (2019) and CISO360 (2022).", "public_name": "Gadi Evron", "guid": "e380750d-0341-5ab5-97a9-bad75874217c", "url": "https://cfp.recon.cx/recon-2026/speaker/JCK7LZ/"}], "links": [], "feedback_url": "https://cfp.recon.cx/recon-2026/talk/SN8MYU/feedback/", "origin_url": "https://cfp.recon.cx/recon-2026/talk/SN8MYU/", "attachments": []}], "Soprano A": [{"guid": "145a94f1-1e85-5c92-a7c2-b570dabafb01", "code": "V9XUD3", "id": 5, "logo": null, "date": "2026-06-19T13:00:00-04:00", "start": "13:00", "duration": "03:00", "room": "Soprano A", "slug": "recon-2026-5-basics-of-net-exploitation", "url": "https://cfp.recon.cx/recon-2026/talk/V9XUD3/", "title": "Basics of .NET Exploitation", "subtitle": "", "track": null, "type": "Workshop (3hrs)", "language": "en", "abstract": "Solarwinds, Microsoft Sharepoint, Microsoft Exchange, Veeam, Veritas, any many more...\r\nAll of these products are written in .NET\r\nIf you'd like to learn how to reverse engineer, find vulnerabilities and exploit .NET targets\r\nthis workshp will teach you the basics", "description": "[X] Topics:\r\n\r\nReversing .NET targets (static analysis, debugging, patching)\r\nIntroduction to .NET vulnerabilities\r\nBasics of deserialization exploits in .NET\r\nPatch diffing and exploiting an Nday\r\n\r\n[X] Requirements:\r\n\r\nWindows 10 or 11 VM\r\nDO NOT bring an ARM laptop (MacBook) tools will not run on this CPU\r\nIf you do not have a intel/amd laptop, try preparing a remote windows server (vps,ec2,etc)\r\nBasic knowledge of C#\r\nBasic of any reverse engineering is a must (x86, etc)", "recording_license": "", "do_not_record": true, "persons": [{"code": "KM9WRL", "name": "Sina Kheirkhah (@SinSinology)", "avatar": "https://cfp.recon.cx/media/avatars/KM9WRL_uoQjK47.webp", "biography": "My name is Sina Kheirkhah also known as @SinSinology I\u2019m a full-time vulnerability researcher with a passion for popping shells across all kinds of targets, server-side enterprise solutions, hardware devices and I also do reverse engineering, low-level exploitation, attacking .NET/Java stacks, bypassing mitigations, chaining bugs, and all the good stuff.\r\n\r\nTo highlight some of my work, I\u2019ve been a Pwn2Own contestant multiple times 20{22,23,24x2,25x3} and have won the \u201cMaster of Pwn\u201d title at the 2025 January edition of Pwn2Own competition in Tokyo Japan. Later in October of the same year, came back as @SummoningTeam (@_mccaulay, @Yogehi, @Ch0pin, @hyprdude) and all of us together won the \u201cMaster of Pwn\u201d title at the October edition of Pwn2Own in Cork Ireland.", "public_name": "Sina Kheirkhah (@SinSinology)", "guid": "67cb6c71-53aa-58f4-aaa9-f49fe5a286a8", "url": "https://cfp.recon.cx/recon-2026/speaker/KM9WRL/"}], "links": [], "feedback_url": "https://cfp.recon.cx/recon-2026/talk/V9XUD3/feedback/", "origin_url": "https://cfp.recon.cx/recon-2026/talk/V9XUD3/", "attachments": []}], "Soprano B": [{"guid": "73ea4ed7-0543-5b05-a828-255d9ffc7f7f", "code": "YACFKE", "id": 59, "logo": null, "date": "2026-06-19T13:00:00-04:00", "start": "13:00", "duration": "03:00", "room": "Soprano B", "slug": "recon-2026-59-c-symbol-and-type-recovery-in-binary-ninja", "url": "https://cfp.recon.cx/recon-2026/talk/YACFKE/", "title": "C++ Symbol and Type Recovery in Binary Ninja", "subtitle": "", "track": null, "type": "Workshop (3hrs)", "language": "en", "abstract": "One of the first steps taken during the reverse engineering process is to recover as much context as possible from a given binary, including symbols, function signatures, classes and structures associated with statically linked code. This is especially important for modern compilers and linkers that embed a plethora of boilerplate that you don't want to spend time reverse engineering. Throughout this workshop we will explore recovering this information using multiple open source tools in Binary Ninja. Our target will be a real-world malware sample written in C++ that is used to terminate EDR and antivirus technologies. The sample contains multiple components, including user-mode and kernel-mode binaries that require symbol and type information recovery for accurate analysis.", "description": "The 3-hour workshop will contain the following sections:\r\n\r\n- **C++ Foundation (35 minutes)**:\u00a0We begin by discussing core C++ concepts, such as Object Oriented Programming, Runtime Type Information and Virtual Function Tables. We will then recover RTTI and VTable information in an example binary in Binary Ninja.\r\n- **Malware Triage and Manual C++ Reverse Engineering (60 minutes):**\u00a0This section focuses on initial analysis of the target malware binary. We will identify the malware\u2019s compiler and libraries using metadata like the Rich Header. Then we will manually reverse engineer **C Runtime (CRT)**\u00a0boilerplate, argument parsing logic (```wmain```, ```lstrcmpiW```), and the \"install\" and \"uninstall\" execution paths for the malware. In addition we will analyze malware's techniques for establishing persistence, Windows service registration process and signal handling.\r\n- **Automated Context Recovery with WARP (30 minutes):**\u00a0In contrast to the manual reversing process, you will learn how to use specialized tools for type identification and recovery. We will demonstrate how to identify standard C++ library functions (like those for ```std::vector``` and exception handling) and how to match the malware\u2019s compilation environment to generate high-quality WARP analysis signatures\u00a0based on C++ templates that automatically recover and rename these complex functions.\r\n- **Fuzzy Function Matching with BinDiff (35 minutes):**\u00a0We conclude by leveraging binary diffing to fill the remaining gaps. You will see how the BinDiff\u00a0tool and its fuzzy matching algorithms are used to compare the unknown malware against a known, clean reference binary. This technique allows more lenient matching of function names, data structures, and class types, allowing us to recover information that WARP has missed. We will also demonstrate porting missing types from the example compiled binary to the malware database using Binary Ninja type archives.\r\n- **Q&A and Resources (20 minutes):**\u00a0Final thoughts and time for questions on integrating these techniques into your professional workflow.\r\n\r\nBy the end of this session, you will learn robust, multi-faceted strategies for symbol and type recovery to assist with reverse engineering C++ malware in Binary Ninja with open source tools. All attendees will receive the workshop manual, slides, the sample binaries, pre-built WARP signatures, Bindiff files and a reference cheat sheet for the techniques covered.\r\n\r\n#### Prerequisites & Preparation\r\n\r\nAttendees should have basic familiarity with x86/x64 assembly and have Binary Ninja installed (a free license is sufficient). Prior malware analysis experience is helpful but not required. As we will be working with malware, please install Binary Ninja and BinDiff within a Virtual Machine for this workshop.", "recording_license": "", "do_not_record": false, "persons": [{"code": "7TVKT7", "name": "Joshua Reynolds", "avatar": "https://cfp.recon.cx/media/avatars/7TVKT7_zoL0n83.webp", "biography": "Joshua Reynolds is the founder of Invoke RE. With over a decade of experience, Joshua has held senior roles at industry-leading companies, including Cisco and CrowdStrike. Joshua has spoken at major conferences such as REcon, RSA, DEF CON and Virus Bulletin on topics including ransomware, malicious document analysis and automating malware analysis. Joshua\u2019s industry-standard malware analysis training courses are taught to hundreds of students globally through his company Invoke RE.", "public_name": "Joshua Reynolds", "guid": "bc26c282-db69-5700-9a83-612b20d1930c", "url": "https://cfp.recon.cx/recon-2026/speaker/7TVKT7/"}], "links": [], "feedback_url": "https://cfp.recon.cx/recon-2026/talk/YACFKE/feedback/", "origin_url": "https://cfp.recon.cx/recon-2026/talk/YACFKE/", "attachments": []}]}}, {"index": 2, "date": "2026-06-20", "day_start": "2026-06-20T04:00:00-04:00", "day_end": "2026-06-21T03:59:00-04:00", "rooms": {"Grand Salon Opera": [{"guid": "4f32d91d-f4db-5bcb-b6b5-fbb3b4f5f6e7", "code": "HARHBR", "id": 94, "logo": null, "date": "2026-06-20T10:00:00-04:00", "start": "10:00", "duration": "01:00", "room": "Grand Salon Opera", "slug": "recon-2026-94-beyond-xnu-anatomy-of-the-secure-kernel-exclaves-on-apple-silicon", "url": "https://cfp.recon.cx/recon-2026/talk/HARHBR/", "title": "Beyond XNU: Anatomy of the Secure Kernel & Exclaves on Apple Silicon", "subtitle": "", "track": null, "type": "Talk", "language": "en", "abstract": "Apple\u2019s platform security story is shifting. Security critical functionality is increasingly moving out of the traditional XNU kernel into the guarded world, an Apple Silicon proprietary secure execution mode. Initially used for the Secure Page Table Monitor (SPTM) and the Trusted Execution Monitor (TXM), it now also hosts a separate CL4 microkernel, the Secure Kernel, which runs Exclaves. Exclaves are isolated components that XNU can communicate with through defined interfaces.\r\n\r\nThis talk is a deep technical tour of the Secure Kernel and the Exclave ecosystem as it exists on modern iOS and macOS. We will build a clear mental model of component roles, privilege separation, IPC patterns, shared memory data flows, and the choke points where validation and policy decisions occur. From there, we will show how to identify endpoints, recover message formats, map memory and permissions, and instrument execution so you can turn black box components into something you can actually audit.\r\n\r\nThe goal is to leave attendees with concrete strategies for finding vulnerabilities and mitigation bypass opportunities in this new Apple security perimeter.", "description": "Apple Silicon introduced a guarded world alongside XNU. That environment started with SPTM and TXM, and today it also includes a CL4 microkernel, the Secure Kernel, which hosts Exclaves. Exclaves are isolated components that XNU can communicate with through defined interfaces, and that boundary is where a lot of interesting engineering decisions and security relevant behavior lives.\r\n\r\nThis talk goes in depth on how the Secure Kernel and Exclaves actually work on modern iOS and macOS. We will cover the execution model and privilege separation, how communication is structured (IPC plus shared memory), and which parts of the stack tend to be responsible for validation and policy decisions. The goal is to make the system understandable enough that you can reason about it like any other target, rather than treating it as an opaque blob.\r\n\r\nTopics include:\r\n\t\u2022\tSecure Kernel internals (task model, isolation, lifecycles)\r\n\t\u2022\tTightbeam (endpoints, transports, message formats)\r\n\t\u2022\tXRT scheduler messages\r\n\t\u2022\tExclave resources and Conclaves\r\n\t\u2022\tIPC + shared memory semantics (ownership, lifetimes, validation points)\r\n\t\u2022\tSecurity implications: bug classes and mitigation bypass angles", "recording_license": "", "do_not_record": false, "persons": [{"code": "DVMFXK", "name": "Stefan Esser", "avatar": "https://cfp.recon.cx/media/avatars/DVMFXK_dIzxvCC.webp", "biography": "Stefan Esser is an independent security researcher focused on Apple platform internals. He is best known for early work on PHP security, including Hardened-PHP and Suhosin, as well as vulnerability research across a wide range of software. Over the last decade his work has centered on iOS and macOS, with a focus on kernel and Apple Silicon security architecture. He co-authored iOS Hackers Handbook and regularly speaks internationally about Apple security research and reverse engineering.", "public_name": "Stefan Esser", "guid": "bc1b2f9f-58ad-5ee4-8627-8b8beec19787", "url": "https://cfp.recon.cx/recon-2026/speaker/DVMFXK/"}], "links": [], "feedback_url": "https://cfp.recon.cx/recon-2026/talk/HARHBR/feedback/", "origin_url": "https://cfp.recon.cx/recon-2026/talk/HARHBR/", "attachments": [{"title": "Slides", "url": "/media/recon-2026/submissions/HARHBR/resources/RECON2026_Beyond_XNU_Ana_P5WGM8a.pdf", "type": "related"}]}, {"guid": "d3990ba5-fbdd-5dbc-af27-22db3d72cb02", "code": "V3THYR", "id": 79, "logo": null, "date": "2026-06-20T11:00:00-04:00", "start": "11:00", "duration": "01:00", "room": "Grand Salon Opera", "slug": "recon-2026-79-prism-internals-reversing-microsoft-s-x86-to-arm64-binary-translator", "url": "https://cfp.recon.cx/recon-2026/talk/V3THYR/", "title": "Prism Internals: Reversing Microsoft's x86-to-ARM64 Binary Translator", "subtitle": "", "track": null, "type": "Talk", "language": "en", "abstract": "Prism is Microsoft's binary translator on Windows on ARM, JIT-compiling x86 and x64 to ARM64 at runtime. Five binaries, ~11K functions, no symbols. We reversed the full JIT pipeline, the CHPE/ARM64X hybrid loading mechanism, and the undocumented `.jc` translation cache format. Along the way we found that the x64se variant runs CRC32C integrity verification on translated code while x86 does not. The cache has no integrity checks on x86 translations: four structural checks, then arbitrary ARM64 executes verbatim. We release `prism-cache-parser` and demonstrate cache poisoning on Snapdragon X: drop a crafted `.jc` file, hijack translations for any DLL, survive reboots, invisible to every default detection layer.", "description": "Every Windows on ARM machine ships Prism, a binary translator that JIT-compiles x86 and x64 to ARM64 at runtime. Five binaries, ~11K functions, no symbols, no documentation. We reversed all of it: the translation pipeline from opcode decoding to ARM64 emission, the CHPE/ARM64X hybrid loading mechanism that ties the two JIT engines together across architectures, and the undocumented `.jc` translation cache format (validated against 341 real files from a Snapdragon X install).\r\n\r\nWe found that the x64se \"strict\" variant runs CRC32C integrity checks on translated code while the x86 variant does not, and that the cache service validates `.jc` files with four structural checks and nothing else. We demonstrate cache poisoning: drop a crafted file, hijack function translations, survive reboots, invisible to every default security layer. We release `prism-cache-parser`, detection rules, and annotated RE artifacts for all five Prism binaries.", "recording_license": "", "do_not_record": false, "persons": [{"code": "3SAY9F", "name": "Hugo", "avatar": null, "biography": "Security researcher with strong interest in Windows internals, RE tooling and automation. Previously spent two years at the French Ministry of Defense on vulnerability research and RE tooling. Currently works at Konvu on automated vulnerability triage. Lectures on cybersecurity at French engineering schools.", "public_name": "Hugo", "guid": "2df4b076-a793-5faf-a0d9-06f1689e6585", "url": "https://cfp.recon.cx/recon-2026/speaker/3SAY9F/"}], "links": [], "feedback_url": "https://cfp.recon.cx/recon-2026/talk/V3THYR/feedback/", "origin_url": "https://cfp.recon.cx/recon-2026/talk/V3THYR/", "attachments": [{"title": "Slides", "url": "/media/recon-2026/submissions/V3THYR/resources/Prism_Internals_REcon202_Jbeh30j.pdf", "type": "related"}]}, {"guid": "44710998-ed3a-5868-9588-4e6f77146ab6", "code": "BCKMJA", "id": 68, "logo": null, "date": "2026-06-20T13:00:00-04:00", "start": "13:00", "duration": "01:00", "room": "Grand Salon Opera", "slug": "recon-2026-68-rom-dump-descrambling-and-decryption-using-re-only-the-fully-analytical-method-fame-no-fib-no-guesses", "url": "https://cfp.recon.cx/recon-2026/talk/BCKMJA/", "title": "ROM Dump, Descrambling and Decryption using RE Only: the Fully Analytical MEthod (FAME), no FIB, no Guesses\u2026", "subtitle": "", "track": null, "type": "Talk", "language": "en", "abstract": "From quite manual to semi-automated, these are targeting the conversion of pictures into a proper binary that can then be analyzed using the usual tools.\r\nOne issue that is reportedly described is the presence of scrambling within the memory array making converting the pictures to something sensical a task involving trial and errors that can lead in the worst case scenario to a project halt if the scrambling scheme is not trivial.\r\nFurthermore, when encryption is used, there is no obvious option to try solving it. This is generally where fully invasive techniques become the method of choice, involving a much more equipped lab with an FIB and micro-probing station but also the need to analyze digital circuit and to  potentially bypass counter-measures such as security shields for example.\r\nThis lecture aims at showing that ROM dumps including descrambling and decryption can be done using a fully analytical methods where pictures of all of the layers of the memory including control circuitry, row and column decoders can be converted into a HDL langage which make it possible to simulate the memory to retrieve its content independent of internal scrambling schemes. By extension, the description will be pushed to decryption circuitry which is another bloc of logic that can be modeled and simulated accurately. \r\nThe lecture will include demonstrations of the method using simple to professional setups so as to clearly outline their benefits and limitations.", "description": "The talk will start with the context introduction and a classification of the ROM dump feasibility and difficulty from non-encrypted, non-scrambled to fully encrypted and scrambled.\r\nThen, the usual dump techniques will be reviewed quickly to introduce the proposed method which is generic to the various cases discussed previously. \r\nThe talk will include demos that are showing how the method can be accomplished using simple and affordable tools. A second demo will show how professional tools do the job in a blink of an eye. These two demos will be used to outline potential limitations and use cases.\r\nAs the method does not require expensive FIB, micro-probing station and other custom lab equipment, it will benefit to a wide range of Reverse-Engineer from \u201chobbyist\u201d to \u201cprofessional\u201d of the sector.", "recording_license": "", "do_not_record": false, "persons": [{"code": "3CMVJF", "name": "Olivier THOMAS - Texplained", "avatar": "https://cfp.recon.cx/media/avatars/3CMVJF_DGHju8R.webp", "biography": "Olivier\u2019s 21 years of expertise in the silicon domain began at the helm of one of the world\u2019s most elite Integrated Circuit (IC) Analysis Labs. Under his leadership, the facility focused on the dual mission of securing next-generation silicon and engineering robust countermeasures for current devices to neutralize piracy and counterfeiting threats.\r\nDuring this tenure, Olivier pioneered numerous innovative techniques for semi- and fully-invasive IC analysis. His deep mastery of Failure Analysis (FA) methodologies and specialized laboratory equipment allows him to pinpoint and access vulnerable logic on even the most hardened target devices.\r\nA pioneer in offensive hardware security, Olivier is redefining the limits of automated IC analysis. His methodologies transcend traditional low-complexity targets like smartcards, scaling effectively to modern System-on-Chips (SoCs) featuring millions of gates and advanced technology nodes.\r\nOlivier is also the architect of ChipJuice, a cutting-edge software toolchain designed to efficiently recover hardware designs regardless of their architecture, technology node, or Standard Cell Library.\r\nHe is the co-founder and CTO at Texplained.", "public_name": "Olivier THOMAS - Texplained", "guid": "f0994cd9-ee5a-5f99-ab88-c5ed2ce912f9", "url": "https://cfp.recon.cx/recon-2026/speaker/3CMVJF/"}], "links": [], "feedback_url": "https://cfp.recon.cx/recon-2026/talk/BCKMJA/feedback/", "origin_url": "https://cfp.recon.cx/recon-2026/talk/BCKMJA/", "attachments": []}, {"guid": "ea9561d3-3273-5b0e-b0b7-12c02af20289", "code": "QTLDLF", "id": 54, "logo": "https://cfp.recon.cx/media/recon-2026/submissions/QTLDLF/Joe_Grand_STM32_Hack_REcon_2026_e_sEPoQZv.webp", "date": "2026-06-20T14:00:00-04:00", "start": "14:00", "duration": "01:00", "room": "Grand Salon Opera", "slug": "recon-2026-54-failure-is-not-an-option-a-reliable-process-to-exploit-stm32f2-f4-microcontrollers", "url": "https://cfp.recon.cx/recon-2026/talk/QTLDLF/", "title": "Failure Is Not an Option: A Reliable Process to Exploit STM32F2/F4 Microcontrollers", "subtitle": "", "track": null, "type": "Talk", "language": "en", "abstract": "The STM32 family of microcontrollers is deployed in billions of embedded systems, making them desirable, high-value targets. In particular, the STM32F2 and STM32F4 series have been heavily scrutinized due to their use in popular cryptocurrency hardware wallets like the KeepKey, Trezor One, and Trezor Model T. Previous research has shown that fault injection can bypass protection mechanisms and enable flash memory extraction. However, those techniques can lead to device corruption or permanent loss of data.\r\n\r\nIn this talk, Joe and Lennert present three years of work refining and extending these attacks into a more repeatable and reliable process for extracting protected flash memory from STM32F2 and STM32F4 devices. They will discuss the practical engineering behind the work, including failures, breakthroughs, and new attack strategies. Using these techniques, they have recovered the cryptocurrency recovery seeds from dozens of customer-owned hardware wallets with a 100% success rate.", "description": "", "recording_license": "", "do_not_record": false, "persons": [{"code": "SDE8JM", "name": "Joe Grand", "avatar": "https://cfp.recon.cx/media/avatars/SDE8JM_ZKbQ1ow.webp", "biography": "Joe Grand, also known as Kingpin, is a computer engineer, hardware hacker, occasional YouTuber, creator of the first electronic badges for DEFCON, member of L0pht Heavy Industries, and former technological juvenile delinquent.", "public_name": "Joe Grand", "guid": "4a8b91b0-ef84-5890-94e3-a4e1e30dcd7e", "url": "https://cfp.recon.cx/recon-2026/speaker/SDE8JM/"}, {"code": "TTDZDC", "name": "Lennert Wouters", "avatar": null, "biography": "Lennert is a security researcher specializing in the security of embedded and connected devices. His research focuses on reverse engineering, physical attacks, and practical attacks on real-world systems. Among his recent high-profile projects are the development of a modchip for fault injection attacks on a Starlink user terminal, and uncovering vulnerabilities in Saflok hotel locks.", "public_name": "Lennert Wouters", "guid": "2d247ee7-a3c4-5c35-8efd-dff1f96a09d8", "url": "https://cfp.recon.cx/recon-2026/speaker/TTDZDC/"}], "links": [], "feedback_url": "https://cfp.recon.cx/recon-2026/talk/QTLDLF/feedback/", "origin_url": "https://cfp.recon.cx/recon-2026/talk/QTLDLF/", "attachments": []}, {"guid": "74c8078a-6952-5a08-8100-8c7ea537e774", "code": "AAPSD9", "id": 50, "logo": "https://cfp.recon.cx/media/recon-2026/submissions/AAPSD9/Screenshot_2026-03-12_at_17.04.05_quQmnFM.webp", "date": "2026-06-20T15:00:00-04:00", "start": "15:00", "duration": "00:30", "room": "Grand Salon Opera", "slug": "recon-2026-50-paper-werewolf-s-toolbox-reversing-xll-delivery-echogather-and-a-winrar-exploit-chain-targeting-russia", "url": "https://cfp.recon.cx/recon-2026/talk/AAPSD9/", "title": "Paper Werewolf's Toolbox: Reversing XLL Delivery, EchoGather, and a WinRAR Exploit Chain Targeting Russia", "subtitle": "", "track": null, "type": "Short Talk", "language": "en", "abstract": "Most threat intelligence treats Russia as a source of attacks. This talk examines Russia as a target. Paper Werewolf (aka GOFFEE) is a cyberespionage group with a sustained focus on Russian defense-industry and government organizations, and despite the group's activity level, it still flies under the radar. This talk presents a full technical teardown of a recent campaign, from the initial delivery mechanism to the implant, the exploitation chain, and the infrastructure that ties it to prior Paper Werewolf operations.\r\n\r\nThe loading mechanism is an XLL add-in, a delivery format that is not new but is rarely dissected in public research. We walk through the loader's DLL export structure, its time-delay sandbox evasion logic, and the unpacking chain leading to EchoGather, a backdoor we uncovered. We reverse EchoGather's XOR-encrypted string handling, C2 protocol, and command handler architecture. A parallel delivery chain exploits CVE-2025-8088, a WinRAR path traversal bug that abuses NTFS alternate data streams to silently drop a persistence script into the Windows Startup folder.\r\n\r\nBeyond the binaries, the campaign has two details worth examining in their own right. The decoy documents impersonating the Russian Ministry of Industry and Trade contain clear AI-generated artifacts, offering a fingerprinting angle on how threat actors are incorporating generative AI into their operations. And to accelerate our own infrastructure analysis, we built a lightweight script on top of the Validin API using Claude Code, turning a manual correlation process into a systematic one. We will share the script, the methodology, and previously undisclosed indicators discovered after our public blog post.", "description": "There is a persistent blind spot in public threat intelligence: the overwhelming focus on Russia as the origin of attacks leaves little analysis of groups targeting Russian targets. Paper Werewolf, also tracked as GOFFEE, is a cyberespionage actor that has been quietly running operations against Russian defense-industry and government organizations for years. It occasionally surfaces in Russian-language security reporting but receives almost no attention in Western research, which means its tooling, techniques, and infrastructure evolution are largely undocumented in English. This talk is a detailed technical examination of a recent Paper Werewolf campaign and an attempt to close some of that gap.\r\n\r\nThe campaign begins with an XLL add-in submitted to VirusTotal from Ukraine and Russia in late October 2025, with filenames referencing enemy targeting data in Russian. XLL abuse is not a new concept; Excel add-ins have been weaponized for years, but public reversing walkthroughs of XLL-based campaigns in the wild are genuinely rare. This sample is a clean, mature example of the format being used by a capable actor. We start with how Excel loads and executes the DLL exports that make an XLL work, then move on to the specifics of this loader: the time-delay evasion technique designed to outlast sandbox execution windows and the unpacking chain that leads to the embedded payload.\r\n\r\nThat payload is EchoGather, a backdoor we named. We reverse it in full: the XOR-based string decryption routine, the C2 communication protocol, and the command handler table. We cover what each handler does and discuss how the implant is designed for the operational requirements of a long-running espionage campaign rather than a smash-and-grab intrusion.\r\n\r\nA separate delivery chain discovered during analysis introduces a different technical angle. A RAR archive exploits CVE-2025-8088, a path-traversal vulnerability in WinRAR that exploits NTFS alternate data stream handling to write files outside the intended extraction path. The actor uses this to place a batch script directly in the Windows Startup folder, achieving persistence with no additional execution step required. We walk through the exploit mechanics at the file system level and connect it to the group's documented prior use of CVE-2025-6218, a related WinRAR vulnerability, showing how the exploitation tradecraft has evolved while the operational intent has stayed consistent.\r\n\r\nThe decoy documents dropped alongside EchoGather deserve their own section. Both impersonate official communications from the Russian Ministry of Industry and Trade, and both contain artifacts that point clearly to AI-assisted generation: a double-headed eagle emblem rendered with visible distortion errors, Cyrillic characters systematically substituted with visually similar Latin equivalents in ways a native speaker would never produce, and register inconsistencies throughout the text. We treat these documents as forensic artifacts and compare them against decoys from a previously reported Paper Werewolf campaign, showing how recurring mistakes and impersonation patterns function as a durable attribution signal even when the malware family or infrastructure rotates. The AI-generation angle is also worth discussing on its own terms: what does it tell us about how this actor is operationalizing generative AI, and what fingerprints does that leave behind?\r\n\r\nOn the analyst side, we used VirusTotal file relationship graphs and submission metadata to surface related samples and a broader campaign picture. For infrastructure correlation, we relied on Validin, using passive DNS records, banner hashes, and header fingerprints to connect domains and identify links to past Paper Werewolf activity. To make this repeatable, we built a lightweight script on top of the Validin API using Claude Code that systematizes the correlation process. We will show the tool, explain how it was built, and discuss how researchers can adapt the same approach for their own investigations. This is also a small but concrete illustration of using AI-assisted development to quickly build custom research tooling, something that is increasingly practical yet underutilized in the threat research community.\r\nThe talk will include previously undisclosed indicators and infrastructure findings developed after our public blog post, and all tools, YARA rules, and scripts used in the investigation will be shared with attendees.", "recording_license": "", "do_not_record": true, "persons": [{"code": "389VAQ", "name": "Nicole Fishbein", "avatar": "https://cfp.recon.cx/media/avatars/389VAQ_SeJtICC.webp", "biography": "Nicole Fishbein is a security researcher and malware analyst. Prior to Intezer, she was an embedded researcher in the Israel Defense Forces (IDF) Intelligence Corps. Nicole has been part of research that led to the discovery of previously unseen  APT malware and novel attacks on Linux-based cloud environments. Her current research focuses on the use of non-standard languages like .NET, Go,  and Rust by advanced threat actors.", "public_name": "Nicole Fishbein", "guid": "31fcd6a2-87cc-5bd7-828b-e522503b83c9", "url": "https://cfp.recon.cx/recon-2026/speaker/389VAQ/"}], "links": [], "feedback_url": "https://cfp.recon.cx/recon-2026/talk/AAPSD9/feedback/", "origin_url": "https://cfp.recon.cx/recon-2026/talk/AAPSD9/", "attachments": []}, {"guid": "b5d08ffd-88d4-54db-acb0-cecd8c4d8a84", "code": "QQZNHF", "id": 47, "logo": null, "date": "2026-06-20T16:00:00-04:00", "start": "16:00", "duration": "01:00", "room": "Grand Salon Opera", "slug": "recon-2026-47-from-bus-wires-to-badges-breaking-into-fermax-through-rfid", "url": "https://cfp.recon.cx/recon-2026/talk/QQZNHF/", "title": "From Bus Wires to Badges: Breaking Into FERMAX Through RFID", "subtitle": "", "track": null, "type": "Talk", "language": "en", "abstract": "When reverse engineering the proprietary DUOX PLUS intercom system dubbed the \u2018most secure in world\u2019 by Fermax, previously Kirils & friends focused on its digital 2-wire signalling and employed such tools like oscilloscopes, logic analyzers and breadboards.\r\n\r\nWhile these attacks are important as they shine light on the internal workings on the system, their application in the field is limited as one would need to acquire access to the 2-wire bus, which is only possible from the inside of the building.\r\n\r\nThen we noticed something that was right in front of our eyes - access control panels! These things are out there just on the perimeter! And, when installed on multi-tenant buildings, they have RFID reader modules installed. Fermax offers modules doing EM4100, MIFARE Classic, and MIFARE Desfire.\r\n\r\nIn this talk we give an overview of previous research and expand on it by exploring the possibilities of entering the perimeter by attacking the RFID dimension of these systems, and exploring card cloning, implanting, and cryptographic attacks together with Iceman. \r\n\r\nAttendees will gain insight into decoding and interacting with closed digital protocols, exposing vulnerabilities in real-world access control systems. They also get practically applying RFID attacks to real world systems in use right now.", "description": "", "recording_license": "", "do_not_record": false, "persons": [{"code": "DYCSUH", "name": "Iceman", "avatar": null, "biography": "Christian Herrmann, better known in the hacker community as \u201cIceman\u201d, is a co-founder of AuroraSec and RRG, and has helped develop many of today\u2019s most widely used RFID research tools, including the Proxmark3 RDV4 and the Chameleon Mini.\r\n\r\nHe is a well-known RFID hacking and Proxmark3 evangelist, serving the community as both a forum administrator and a major code contributor alongside other developers since 2013.\r\nChristian has spoken at hacker conferences around the world, including Troopers, Black Hat Asia, DEF CON, Hardwear IO, SSTIC, NullCon, Pass-the-Salt, BSides Tallinn, BlackAlps, TenguCon,  Balccon, TumpiCon, WHY and SaintCon.\r\nHe also runs a YouTube channel where he shares his knowledge of RFID hacking with the public.\r\n\r\nWith over 15 years of experience in bespoke software development, Christian specializes in .NET platforms and is a Certified MCPD Enterprise Architect.\r\n\r\nHe possesses near-unmatched expertise in the Proxmark3 architecture and various RFID technologies, and has served as an instructor for Red Team Alliance (RTA), including training sessions at Black Hat.", "public_name": "Iceman", "guid": "771739ac-663d-5703-9e34-ca8d2233b424", "url": "https://cfp.recon.cx/recon-2026/speaker/DYCSUH/"}, {"code": "QYN9SA", "name": "Kirils Solovjovs", "avatar": "https://cfp.recon.cx/media/avatars/QYN9SA_SjDSFEG.webp", "biography": "Kirils Solovjovs is Latvia's leading white-hat hacker and IT policy activist. He began programming at age 7, and by grade 9 was already writing machine code directly in a hex editor during lunch breaks. Renowned for uncovering and responsibly disclosing critical vulnerabilities in national and international systems, he is an expert in network flow analysis, reverse engineering, and social engineering. A lifelong command-line enthusiast, he uses bash daily for hacking, automation, and large-scale data processing.\r\nHe is the author of the jailbreak tool for MikroTik RouterOS and played a pivotal role in developing e-Saeima, the world's first fully remote legislative system used by the Latvian Parliament. Today, Kirils serves as lead researcher at Possible Security.", "public_name": "Kirils Solovjovs", "guid": "807004de-f993-5247-936f-cfa9313b0198", "url": "https://cfp.recon.cx/recon-2026/speaker/QYN9SA/"}], "links": [{"title": "slides", "url": "https://kirils.org/slides/2026-06-20_RFID-FERMAX-RECON_prod_post.pdf", "type": "related"}], "feedback_url": "https://cfp.recon.cx/recon-2026/talk/QQZNHF/feedback/", "origin_url": "https://cfp.recon.cx/recon-2026/talk/QQZNHF/", "attachments": []}, {"guid": "dec6272f-beeb-5675-8211-bf73b13a3915", "code": "TXLWRK", "id": 29, "logo": null, "date": "2026-06-20T17:00:00-04:00", "start": "17:00", "duration": "01:00", "room": "Grand Salon Opera", "slug": "recon-2026-29-breaking-the-backbone-of-global-isp-networks", "url": "https://cfp.recon.cx/recon-2026/talk/TXLWRK/", "title": "Breaking the Backbone of Global ISP Networks", "subtitle": "", "track": null, "type": "Talk", "language": "en", "abstract": "This talk presents a practical end-to-end attack chain against modern fiber access networks. By chaining multiple pre-authentication Remote Code Execution vulnerabilities, an attacker can compromise a GPON Optical Line Terminal and then pivot to the ISP\u2019s cloud-based management platform. This escalation enables centralized and persistent control over all deployed OLTs. Such an attack can lead to large-scale service disruption, long-term unauthorized network access, customer traffic interception, and mass surveillance. The scenario mirrors real-world incidents involving nation-state actors targeting telecommunications providers. Technical details are being responsibly disclosed to the vendor and will be fully revealed at the conference, along with a demonstration video.", "description": "In this talk, we present a practical, end-to-end attack chain against modern\r\nfiber access networks, demonstrating how multiple pre-authenticated Remote Code\r\nExecution (RCE) vulnerabilities can be chained to fully compromise an ISP\r\ninfrastructure.\r\n\r\nWe begin by exploiting three pre-authenticated RCE vulnerabilities on a GPON\r\nOptical Line Terminal (OLT), gaining initial access to a device that sits at a\r\ncritical point of ISP networks and directly handles customer traffic. From\r\nthe compromised OLT, we pivot into the ISP\u2019s cloud-based fleet management\r\nplatform via an additional pre-authenticated RCE, ultimately obtaining\r\ncentralized and persistent control over all deployed OLTs managed by the\r\nprovider.\r\n\r\nIn large-scale deployments, OLTs are remotely administered through centralized\r\nmanagement platforms, making them highly attractive targets. By chaining\r\nvulnerabilities between exposed edge devices and their associated cloud\r\nmanagement systems, an attacker can escalate from a single-device compromise to\r\nfull control over the access network infrastructure.\r\n\r\nThis attack path enables high-impact outcomes, including large-scale service\r\ndisruption, long-term unauthorized access to ISP networks, customer traffic\r\ninterception, and mass surveillance capabilities. These scenarios closely mirror\r\nrecent real-world disclosures involving nation-state actors covertly\r\ncompromising telecommunications providers in Western countries, where control\r\nover ISP infrastructure has been leveraged for strategic intelligence collection\r\nand population-scale monitoring.", "recording_license": "", "do_not_record": false, "persons": [{"code": "MAU3BQ", "name": "Mathieu Farrell", "avatar": "https://cfp.recon.cx/media/avatars/MAU3BQ_7OGPeRO.webp", "biography": "I'm Mathieu Farrell a member of Quarkslab's Adversary Simulation Team\r\nfocusing on vulnerability research and exploit development looking for\r\ninitial access vectors.", "public_name": "Mathieu Farrell", "guid": "19ef9b0b-b826-55e7-a86d-cbf9dd2ef237", "url": "https://cfp.recon.cx/recon-2026/speaker/MAU3BQ/"}], "links": [], "feedback_url": "https://cfp.recon.cx/recon-2026/talk/TXLWRK/feedback/", "origin_url": "https://cfp.recon.cx/recon-2026/talk/TXLWRK/", "attachments": []}], "Soprano A": [{"guid": "07445557-b232-5a74-b112-3155d88c0fb1", "code": "PYUVVA", "id": 74, "logo": null, "date": "2026-06-20T13:00:00-04:00", "start": "13:00", "duration": "02:00", "room": "Soprano A", "slug": "recon-2026-74-adapting-ghidra-and-its-decompiler-to-new-languages", "url": "https://cfp.recon.cx/recon-2026/talk/PYUVVA/", "title": "Adapting Ghidra and its Decompiler to new languages", "subtitle": "", "track": null, "type": "Workshop (2hrs)", "language": "en", "abstract": "A binary in a new language that suspiciously looks like it's designed to foil your static analysis tools:\r\nA new string format that breaks references and readability, virtual dispatch that masks which function is called where and a reference counting garbage collector so you can't even tell which object ends up where.\r\n\r\nParticipants will learn how to leverage Ghidra and P-Code to tackle the challenges that pop up when analyzing compiled high level languages.\r\nThe focus will be on the iterative workflow of assisting the decompiler: Understanding why it fails,\r\nassisting it with a custom analysis script that uses the P-Code emitted by the decompiler,\r\nand feeding the resulting information back to Ghidra and the decompiler via the right APIs,\r\nso that the decompiler can continue doing the heavy lifting, and provides better P-Code to tackle the next challenge.\r\n\r\nBy the end, participants will have a transferable toolbox for adapting Ghidra's decompiler to unfamiliar language runtimes by identifying runtime patterns, writing P-Code-driven analysis scripts or to feeding recovered types and dispatch targets back to the decompiler.", "description": "Ghidra's decompiler is powerful, but it needs help with unfamiliar language runtimes. Common issues are a wall of unnamed functions, new string formats, opaque indirect calls through some kind of dynamic dispatch, or noise from reference counting. And the decompiler doesn't know what any of it means.\r\n\r\nThis workshop teaches the basic toolbox for fixing that. Participants work through a series of modules, each targeting a specific failure mode of the decompiler and resolving it with a Ghidra script. Parsing metadata, to setup classes and layouts. Install call fixups to eliminate GC noise. Identify sources of type information, and feed it into the dataflow analysis. Analyze dataflow through P-Code to resolve virtual dispatch targets. Each module visibly improves the decompiler's output before moving to the next \u2014 and each builds on the results of the previous one.\r\n\r\nThe emphasis is not on the specific runtime but on the tools and techniques that transfer: understanding _why_ the decompiler produces bad output, identifying what information it's missing, extracting that information from P-Code, and feeding it back through the right Ghidra APIs so the decompiler can do the heavy lifting.\r\n\r\nWith LLMs it has become easy to generate Ghidra scripts, but you still need to know what to ask for \u2014 which API is the right one, what the decompiler actually needs, and where it expects the information to be. \r\n\r\nPrerequisites: Familiarity with Ghidra's UI and basic reverse engineering. No prior P-Code experience with needed. Bring a laptop with Ghidra 11+ and Java 21.\r\n\r\nMaterials: https://github.com/fmagin/pcode-workshop/releases/tag/recon2026", "recording_license": "", "do_not_record": false, "persons": [{"code": "9A3TQG", "name": "Florian Magin", "avatar": null, "biography": "Florian Magin is a Security Researcher at Fraunhofer Institute for Secure Information Technology (SIT) with 10 years of experience in getting distracted by subpar decompiler output.\r\n\r\nAfter an initial excursion into industry at ERNW Research GmbH, he switched to the kind of place where it's acceptable to spend months solving the  \r\ngeneral problem instead of 5 minutes in a debugger: an academic research institute.\r\n\r\nThere, he has been building analysis tooling to tackle the myriad languages cropping up in the iOS app store: Objective-C, Swift, Flutter, React    \r\nNative, and others.", "public_name": "Florian Magin", "guid": "c6e487ff-8860-5b59-b180-77395c94cbc1", "url": "https://cfp.recon.cx/recon-2026/speaker/9A3TQG/"}], "links": [], "feedback_url": "https://cfp.recon.cx/recon-2026/talk/PYUVVA/feedback/", "origin_url": "https://cfp.recon.cx/recon-2026/talk/PYUVVA/", "attachments": []}, {"guid": "51a01dd4-881a-5825-820e-46234fbfaa86", "code": "3LERJG", "id": 88, "logo": null, "date": "2026-06-20T16:00:00-04:00", "start": "16:00", "duration": "02:00", "room": "Soprano A", "slug": "recon-2026-88-mips-malware-reverse-engineering", "url": "https://cfp.recon.cx/recon-2026/talk/3LERJG/", "title": "MIPS Malware Reverse Engineering", "subtitle": "", "track": null, "type": "Workshop (2hrs)", "language": "en", "abstract": "Curious about expanding your reverse engineering skills to another architecture? Lets go learn MIPS! Both x86-64 and ARM reverse engineering knowledge transfer really well to MIPS, and with some basics and an instruction cheat sheet we're on our way in no time. We'll analyze AcidRain, a piece of MIPS-32 malware, a Russian wiper malware none the less. The sample is stripped, and we'll learn how to quickly recover essential libc functions, to then reconstruct the malware's code flow.", "description": "Workshop outline (45 min lecture / 45 min lab / 30 min discussion of solutions):\r\n\r\n- MIPS architecture 101 and a brief history\r\n- The MIPS pipeline\r\n- Delay slots\r\n- Instruction categories\r\n- MIPS registers and their purpose\r\n- The MIPS stack\r\n- The O32 calling convention \r\n- Syscall calling convention and numbering\r\n- Function prologues/epilogues\r\n- Other MIPS architectures and their calling conventions, briefly\r\n- Hands on: AcidRain\r\n-- Challenge 1: Understand daemonization\r\n-- Challenge 2: Reconstruct wiping code flow", "recording_license": "", "do_not_record": false, "persons": [{"code": "RU7R7R", "name": "Marion Marschalek", "avatar": "https://cfp.recon.cx/media/avatars/RU7R7R_PxNmbDT.webp", "biography": "Marion Marschalek is an independent security consultant and trainer with her consulting company Hack & Cheese. Prior to that she held senior positions at AWS and Intel, and different roles in the threat detection industry, as a malware reverse engineer and incident responder. Marschalek is a frequent speaker at major security conferences, including Black Hat, Defcon, HITB, RSA, and SyScan, among others. She used to teach malware analysis and reverse engineering classes at University of Applied Sciences St. Poelten, from where she graduated in 2011 with a Master's Degree in Information Security. In 2015 she started a hacker bootcamp for women titled BlackHoodie, which over the years established itself as a global initiative to attract more diverse talent to the security industry. In her spare time she enjoys long distance running.", "public_name": "Marion Marschalek", "guid": "178ccf17-09d0-548a-a1d0-43140cc832af", "url": "https://cfp.recon.cx/recon-2026/speaker/RU7R7R/"}], "links": [{"title": "Github link to materials", "url": "https://github.com/pinkflawd/MIPSReverseEngineeringWorkshop", "type": "related"}, {"title": "Github link to materials", "url": "https://github.com/pinkflawd/MIPSReverseEngineeringWorkshop", "type": "related"}], "feedback_url": "https://cfp.recon.cx/recon-2026/talk/3LERJG/feedback/", "origin_url": "https://cfp.recon.cx/recon-2026/talk/3LERJG/", "attachments": [{"title": "MIPS Reverse Engineering Workshop Slides", "url": "/media/recon-2026/submissions/3LERJG/resources/MIPS_Reverse_Engineering_UHZBOv4.pdf", "type": "related"}]}], "Soprano B": [{"guid": "24e60812-aa31-5d30-8436-1ddd3bda08aa", "code": "SHYHKM", "id": 10, "logo": "https://cfp.recon.cx/media/recon-2026/submissions/SHYHKM/1_6xZaAj3lxnx8dbWF-GwSPA_H27YpGD__6lBDoRm.webp", "date": "2026-06-20T13:00:00-04:00", "start": "13:00", "duration": "03:00", "room": "Soprano B", "slug": "recon-2026-10-agentic-reverse-engineering-building-custom-ai-skills-with-coding-agents", "url": "https://cfp.recon.cx/recon-2026/talk/SHYHKM/", "title": "Agentic Reverse Engineering: Building Custom AI \"Skills\" with Coding Agents", "subtitle": "", "track": null, "type": "Workshop (3hrs)", "language": "en", "abstract": "Agent Skills are now an open format and the latest evolution in agentic workflows, enabling coding agents to execute multi\u2011step reverse\u2011engineering tasks with high accuracy and minimal prompting. This workshop teaches participants to design, build, and iterate custom Skills using coding agents such as Claude Code, OpenCode, and Mistral Vibe. Through guided exercises, attendees will build a multi\u2011platform driver\u2011analysis Skill that automates IOCTL mapping, platform\u2011specific dispatch analysis, code\u2011flow analysis, and workflow capture across Windows, macOS, and Linux. The workshop blends conceptual foundations with extensive hands\u2011on practice, ensuring participants leave with both the understanding and practical experience needed to implement agentic RE Skills in their own workflows.", "description": "# **Description**  \r\nAgentic reverse engineering blends interactive reversing with autonomous agent workflows. Building on last year\u2019s RECON workshop on MCP\u2011based Ghidra integration, this session introduces Agent Skills - structured bundles of instructions, scripts, and resources that coding agents can discover and execute. Skills introduce workflow capture and progressive disclosure, enabling agents to perform complex RE tasks with far less context overhead.\r\n\r\n**Sign up**: [Agentic RE Skills Workshop Recon 2026 Sign up](https://l.clearseclabs.com/agentic-re-skills-recon2026)\r\n\r\nParticipants will learn how coding agents operate through iterative loops (generate \u2192 execute \u2192 inspect \u2192 refine) and how Skills plug directly into these loops to automate analysis. The workshop emphasizes practical application: attendees will build a multi\u2011platform driver\u2011analysis Skill that supports IOCTL enumeration, platform\u2011specific dispatch\u2011flow analysis (Windows IRPs, Linux file operations, macOS IOKit user\u2011client methods), code\u2011flow analysis, and reproducible workflow capture.\r\n\r\n---\r\n\r\n# **Learning Objectives**  \r\nBy the end of this workshop, participants will be able to:\r\n\r\n- Understand the Agent Skills framework and how it extends MCP concepts  \r\n- Build custom reverse\u2011engineering Skills using coding agents  \r\n- Create interactive, agent\u2011driven workflows for multi\u2011platform driver analysis  \r\n- Implement progressive disclosure to reduce context size and improve agent performance  \r\n- Capture expert RE heuristics and encode them into reusable Skills  \r\n- Integrate Skills with existing RE tools and workflows  \r\n\r\n---\r\n\r\n# **Outline**\r\n\r\n### **1. Foundations of Agentic Reverse Engineering**\r\n- Skills framework vs. MCP  \r\n- Coding agent capabilities (Claude Code, OpenCode, Mistral Vibe)  \r\n- Environment setup  \r\n- Workflow capture and progressive disclosure  \r\n- How Skills integrate into agent loops  \r\n\r\n### **2. Skill Building: Architecture, Workflows, and Iteration**\r\n- Designing RE Skill architecture and folder structure  \r\n- Implementing analysis workflows  \r\n- Adding domain knowledge, heuristics, and resources  \r\n- Designing structured output schemas  \r\n- Testing and validating Skills  \r\n- Improving agent performance and reducing unnecessary context  \r\n\r\n### **3. Hands\u2011On Build: Driver Analysis Skill**\r\n- Multi\u2011platform driver analysis: Windows `.sys`, macOS `.kext`, Linux modules  \r\n- IOCTL enumeration and mapping  \r\n- Dispatch\u2011flow analysis (IRPs, file ops, IOKit)  \r\n- Code\u2011flow analysis using callgraphs and xrefs  \r\n- Applying workflow capture in a real Skill  \r\n- Scaffolding and integrating Skill components  \r\n\r\n### **4. Interactive RE with Agent Automation**\r\n- Combining manual reversing with agentic automation  \r\n- Offloading repetitive tasks and validating hypotheses  \r\n\r\n### **5. Extending and Iterating Skills**\r\n- Adding workflows, tests, and examples  \r\n- Integrating tutorials, blog posts, and prior research  \r\n- Strategies for long\u2011term Skill evolution  \r\n\r\n### **6. Wrap\u2011Up**\r\n- Review of completed Skill  \r\n- Next steps for building agentic RE automation  \r\n\r\n---\r\n\r\n# **Requirements**  \r\nParticipants must bring a laptop capable of running at least one of:\r\n\r\n- OpenCode: https://opencode.ai/docs/  \r\n- Claude Code: https://code.claude.com/docs/en/overview  \r\n\r\nAdditional requirements:\r\n\r\n- Ability to `git clone` workshop materials  \r\n- Basic familiarity with reverse engineering concepts  \r\n\r\n---\r\n\r\n#### **Prior Work / References**\r\n- *Offensive Security Tool Development with Ghidra & MCP* (RECON 2025) - https://www.clearseclabs.com/blog/offensive-security-tool-development-with-ghidra-recon-2025 \r\n\r\n- *Supercharging Ghidra: Build Your Own Private Local LLM RE Stack* (Ringzer0 2025)  - https://www.clearseclabs.com/blog/supercharging-ghidra-re-llms-ringzer0-countermeasure-2025\r\n\r\n- Agent Skills specification  \r\n  [https://agentskills.io/home](https://agentskills.io/home)\r\n\r\n### Target Audience\r\n\r\nThis workshop is designed for:\r\n- Reverse engineers looking to automate their workflows\r\n- Security researchers interested in AI-assisted analysis\r\n- Tool developers wanting to understand agentic AI capabilities\r\n- Anyone who attended last year's MCP workshop and wants to explore the next evolution\r\n\r\n\r\n---", "recording_license": "", "do_not_record": false, "persons": [{"code": "7Q8BGY", "name": "John McIntosh", "avatar": "https://cfp.recon.cx/media/avatars/7Q8BGY_VsENv6N.webp", "biography": "John McIntosh (@clearbluejar) is a security researcher at ClearSecLabs specializing in reverse engineering and offensive security. His expertise spans binary analysis, patch diffing, and vulnerability discovery, with multiple open-source security tools for vulnerability research available on his GitHub. His website, https://clearbluejar.github.io/, features detailed write-ups on reversing recent CVEs and building RE tooling with Ghidra.\r\n\r\nJohn has delivered advanced reverse engineering and vulnerability discovery talks at leading international security conferences worldwide, including Black Hat, REcon, Insomnihack, Ringzer0, SecTor, 44CON, and DEF CON. His sessions emphasize systematic, reproducible workflows and hands-on, AI-augmented analysis, consistently recognized for clarity and technical depth. A distinguished presenter and educator, John maintains a fervent commitment to sharing cutting-edge research, advancing binary analysis, and fostering collaboration within the global security community.", "public_name": "John McIntosh", "guid": "a86723a0-d43e-5cdc-bea2-78bcf82dc47d", "url": "https://cfp.recon.cx/recon-2026/speaker/7Q8BGY/"}], "links": [], "feedback_url": "https://cfp.recon.cx/recon-2026/talk/SHYHKM/feedback/", "origin_url": "https://cfp.recon.cx/recon-2026/talk/SHYHKM/", "attachments": []}]}}, {"index": 3, "date": "2026-06-21", "day_start": "2026-06-21T04:00:00-04:00", "day_end": "2026-06-22T03:59:00-04:00", "rooms": {"Grand Salon Opera": [{"guid": "7f753de7-696c-55ef-a3a4-0149d740130a", "code": "PDEBQ8", "id": 48, "logo": "https://cfp.recon.cx/media/recon-2026/submissions/PDEBQ8/SmallWorld_CP0BwLC.svg", "date": "2026-06-21T10:00:00-04:00", "start": "10:00", "duration": "01:00", "room": "Grand Salon Opera", "slug": "recon-2026-48-smallworld", "url": "https://cfp.recon.cx/recon-2026/talk/PDEBQ8/", "title": "SmallWorld", "subtitle": "", "track": null, "type": "Talk", "language": "en", "abstract": "Have you ever wanted to just run that damn code you are looking at in IDA Pro? You are not alone. Even assuming you can find a working emulator for the required processor, execution requires setting up enough of a complete initial runtime environment and that is by no means easy. There are many puzzle pieces to assemble and put in the right places including register and memory contents, operating system information, libraries, and peripheral models. SmallWorld is designed to make all of that easy, in addition to supporting popular dynamic analysis platforms like Unicorn, angr and others for dynamic analysis. You can even readily move machine state between such platforms. In short, SmallWorld makes code harnessing and dynamic analysis fast and easy. We will explain all of this in detail and present three demonstrations of common but juicy use cases.", "description": "Dynamic analysis often breaks down precisely where it\u2019s needed most: code that can\u2019t be easily executed because its runtime environment is unknown or incomplete. SmallWorld is a framework built to close that gap. At the heart of the problem is the need for an execution environment \u2014 everything besides your code that it depends on to run, such as the operating system, system libraries, peripherals, or initial memory state.\r\n\r\nSmallWorld lets you construct that environment incrementally, specifying only what the code actually needs. By separating environment modeling from analysis tooling, it enables dynamic analysis of previously unreachable binary code in a tool-agnostic way. SmallWorld, furthermore, lets you run *just* the code you care about, starting execution arbitrarily deep in a binary and stubbing out or modeling functions or code snippets that you don't care to submit to analysis.\r\n\r\nThe framework currently supports 13 ISAs and integrates with 5 dynamic analysis tools, making it practical for everything from reverse engineering to vulnerability research. It contains models for a healthy fraction of libc and POSIX. Further, SmallWorld's notion of the concrete state used to initialize an emulator prior to beginning execution works as a lingua franca, allowing one to move state between dynamic analysis worlds. You can start analyzing in Unicorn, transfer state at some point to angr for symbolic execution, and later return the state to pick up emulation in Unicorn, etc.\r\n\r\nIn the first half of this talk, we\u2019ll walk through the design and implementation of SmallWorld as well as explaining how it enables analyses that were previously infeasible. The second half of the talk will be demonstrations of salient use cases: harnessing and fuzzing of code from an embedded system, harnessing of firmware unpacking code let loose on a corpus of firmware downloads, and interactive type recovery of input parsing code.\r\n\r\nISAs supported include:\r\n\u2022\taarch64\r\n\u2022\tamd64\r\n\u2022\tarm32\r\n\u2022\ti386\r\n\u2022\tla64\r\n\u2022\tm68k (coming soon)\r\n\u2022\tmips32r2\r\n\u2022\tmips64r2\r\n\u2022\tmsp430\r\n\u2022\tppc32\r\n\u2022\tppc64\r\n\u2022\triscv64\r\n\u2022\txtensa\r\n\r\nSupported Dynamic Analysis Tools:\r\n\u2022\tUnicorn\r\n\u2022\tangr\r\n\u2022\tPANDA-ng\r\n\u2022\tGhidra\r\n\u2022\tAFL++\r\n\r\nSmallWorld is open source and available at https://github.com/smallworld-re/smallworld.", "recording_license": "", "do_not_record": false, "persons": [{"code": "N3ZR8W", "name": "Andy", "avatar": null, "biography": "Andy has been working at MIT Lincoln Laboratory for 14 years researching program analysis and reverse engineering.", "public_name": "Andy", "guid": "da558df9-f70c-5f56-98c0-a979ebdb968b", "url": "https://cfp.recon.cx/recon-2026/speaker/N3ZR8W/"}, {"code": "GE8LJG", "name": "William Janelle", "avatar": "https://cfp.recon.cx/media/avatars/GE8LJG_aMxqFnR.webp", "biography": "Cybersecurity researcher and software engineer at MIT Lincoln Laboratory.", "public_name": "William Janelle", "guid": "48e88485-bc8e-53ab-afeb-b9ef37a7f3e4", "url": "https://cfp.recon.cx/recon-2026/speaker/GE8LJG/"}], "links": [], "feedback_url": "https://cfp.recon.cx/recon-2026/talk/PDEBQ8/feedback/", "origin_url": "https://cfp.recon.cx/recon-2026/talk/PDEBQ8/", "attachments": [{"title": "slides", "url": "/media/recon-2026/submissions/PDEBQ8/resources/presentation_mCNsTZJ.pdf", "type": "related"}]}, {"guid": "0cd0e288-a8fe-54d6-a64a-903a0b732fc5", "code": "GG7SEM", "id": 80, "logo": null, "date": "2026-06-21T11:00:00-04:00", "start": "11:00", "duration": "01:00", "room": "Grand Salon Opera", "slug": "recon-2026-80-how-real-world-malware-disables-edr-systems", "url": "https://cfp.recon.cx/recon-2026/talk/GG7SEM/", "title": "How real-world malware disables EDR systems", "subtitle": "", "track": null, "type": "Talk", "language": "en", "abstract": "Endpoint Detection and Response (EDR) solutions are widely considered a cornerstone of modern enterprise defense. However, recent malware campaigns show adversaries increasingly focus on actively disabling security controls. Disabling EDR systems is not a trivial task, as adversaries must bypass and evade multiple detection and protection layers before they can successfully neutralize them.\r\n\r\nThis talk examines a recent intrusion chain associated with the Qilin ransomware ecosystem, where a dedicated EDR killer is deployed early in the attack lifecycle. The analyzed malware is able to identify and disable hundreds of EDR drivers from multiple vendors, effectively removing visibility and response capabilities from the target environment. The initial execution relies on DLL sideloading of a trojanized msimg32.dll, which acts as a PE loader for the EDR killer payload. The execution flow is deliberately convoluted using SEH/VEH-based control flow manipulation, effectively breaking linear disassembly and complicating static analysis. The sample further minimizes its user-mode footprint by dynamically resolving APIs and selectively switching to direct and indirect syscalls to evade userland hooks commonly used by EDR solutions. In parallel, it tampers with ETW providers to degrade telemetry visibility.\r\n\r\nAttendees will gain a deep understanding of how modern EDR killers are engineered, including their use of undocumented APIs, kernel object manipulation, and advanced obfuscation strategies. The talk will bridge low-level reverse engineering insights with practical detection opportunities, highlighting weaknesses in current defensive models and offering concrete ideas for improving resilience against malware that targets the defenders themselves. The race is on.", "description": "", "recording_license": "", "do_not_record": false, "persons": [{"code": "FFC7BL", "name": "Holger Unterbrink", "avatar": "https://cfp.recon.cx/media/avatars/FFC7BL_ffyLjtF.webp", "biography": "Holger is a long-time security enthusiast with over 25 years of experience in the information security industry. He began his career as a penetration tester and now works at Cisco Talos as a technical leader in malware and threat hunting. His work focuses on discovering emerging threats and analyzing their inner workings.\r\n\r\nHolger has presented at international security conferences including Recon, Black Hat, Hack In The Box, ISC, NorthSec, and Cisco Live, among others. He is also the author of several offensive and defensive security tools and won the IDA Plugin Contest in 2020 with his Dynamic Data Resolver (DDR) plugin.\r\n\r\nMore recently, his research has focused on reversing Nim binaries (Recon 2023), VMProtect (Recon 2024), and dynamic binary instrumentation (Recon 2025).", "public_name": "Holger Unterbrink", "guid": "66e998c3-4418-5207-a5de-48bfed31ba8c", "url": "https://cfp.recon.cx/recon-2026/speaker/FFC7BL/"}], "links": [], "feedback_url": "https://cfp.recon.cx/recon-2026/talk/GG7SEM/feedback/", "origin_url": "https://cfp.recon.cx/recon-2026/talk/GG7SEM/", "attachments": [{"title": "EDR Killer", "url": "/media/recon-2026/submissions/GG7SEM/resources/HU_EDR-Killer_K4LKvFs.pdf", "type": "related"}]}, {"guid": "4479a72e-4948-554c-8657-3f512a66fb45", "code": "KZCARU", "id": 67, "logo": null, "date": "2026-06-21T13:00:00-04:00", "start": "13:00", "duration": "01:00", "room": "Grand Salon Opera", "slug": "recon-2026-67-forgotten-tee-keys-in-plain-sight", "url": "https://cfp.recon.cx/recon-2026/talk/KZCARU/", "title": "Forgotten TEE keys in plain sight", "subtitle": "", "track": null, "type": "Talk", "language": "en", "abstract": "How safe is the data on your phone? On modern Android phones, all OS data except a minimal boot image is encrypted on the flash memory in a way that is device-bound, so that if we take out the flash and dump it we get nothing of interest. But encrypted with what?\r\n\r\nThis talk presents our research on cold-storage security on Android against an attacker with physical access. In the process, we uncovered a decade-old vulnerability on Mediatek-based Android phones (CVE-2026-20435), which allows us to recover the PIN and all user data (including Keystore content) from the flash memory of a switched-off phone. Depending on the models, it only takes a USB access and a few minutes, which we will demonstrate during the talk.", "description": "For this research, we investigated the security behind the \"device binding\" encryption on Android, on a Mediatek phone where a trusted execution environment (TEE) is used for security.\r\n\r\nThe talk is about how we reversed the Mediatek bootchain and the third party TEE (Trustonic's Kinibi, used on most Mediatek phones), but also Mediatek proprietary USB flashing protocol. This allowed us to establish exactly what the TEE uses as cryptographic root and what it does with it. This means that, from this root, we can cryptographically derive everything that needs a device binding in the TEE: flash decryption keys (metadata & FBE keys), PIN encryption mechanism and the Android Keystore.\r\n\r\nWe still need to get this root, and we found out the following vulnerability: we can just ask the phone for all the data required to derive the cryptographic root with the Mediatek flashing protocol via USB, without any authentication. This impacts most Mediatek phones with a TEE.\r\n\r\nNow, we also need an initial read of the (encrypted) flash for getting the data, which we can always do the hard way by opening the phone and reading the flash with special tooling, or for some models we can find \"download agents\" (DAs) which are Mediatek flash software addons that can readback the flash (which is supposedly harmless since it is encrypted).\r\n\r\nSince we found a DA for our research phone, we were able to develop a PoC that, with only a USB access and a few minutes, is able to compute the cryptographic root, decrypt the flash, bruteforce the user PIN and access all the data of the phone.", "recording_license": "", "do_not_record": false, "persons": [{"code": "PKAPKQ", "name": "Florent TARDIF", "avatar": null, "biography": "I am doing vulnerability research and reverse-engineering in the Donjon, Ledger's product security team.", "public_name": "Florent TARDIF", "guid": "7242b4d1-2ac5-5442-98c1-2a1fb23b7d38", "url": "https://cfp.recon.cx/recon-2026/speaker/PKAPKQ/"}], "links": [], "feedback_url": "https://cfp.recon.cx/recon-2026/talk/KZCARU/feedback/", "origin_url": "https://cfp.recon.cx/recon-2026/talk/KZCARU/", "attachments": [{"title": "slides", "url": "/media/recon-2026/submissions/KZCARU/resources/slides_recon2026_BFoos2K.pdf", "type": "related"}]}, {"guid": "b3d47339-9278-5376-a7c8-659080bc5d57", "code": "LAWUEN", "id": 65, "logo": null, "date": "2026-06-21T14:00:00-04:00", "start": "14:00", "duration": "00:30", "room": "Grand Salon Opera", "slug": "recon-2026-65-iron-giant-when-the-vault-becomes-the-victim", "url": "https://cfp.recon.cx/recon-2026/talk/LAWUEN/", "title": "IRON GIANT: When The Vault Becomes The Victim", "subtitle": "", "track": null, "type": "Short Talk", "language": "en", "abstract": "The Local Security Authority Subsystem Service (LSASS) sits at the core of Windows security, handling critical functions like authentication, credential management, and security policy enforcement. Despite the sensitive nature of the data it guards, the LSASS exposes a surprisingly wide attack surface through various legacy and modern interfaces. This talk presents the results of a comprehensive research campaign targeting three distinct vectors against this \"Iron Giant\".", "description": "First, we examine the Security Support Provider Interface (SSPI). Applications rely on SSPI for security features, such as authentication, and use the interface to send requests to the LSASS. This opens up a large attack surface for malicious applications and has been the source of  several security vulnerabilities over the years. We will dissect the architecture of these providers and reveal several new memory corruption vulnerabilities. \r\n\r\nSecond, we explore the risks of the LSASS acting as a client. Server applications often trigger outgoing connections in scenarios that are frequently overlooked. We will demonstrate how forcing a target server to connect to a malicious endpoint exposes the SSPI client handshake code to attack. The presentation will detail these connection triggers and unveil two new Denial of Service (DoS) bugs that allow unauthenticated attackers to exhaust server resources.\r\n\r\nFinally, we target the Remote Procedure Call (RPC) interfaces exposed within domain networks. While many of the RPC endpoints require authentication, several remain exposed to anonymous or unprivileged users. We will analyze these open interfaces and deep-dive into CVE-2025-33056, a logic vulnerability that allows unprivileged accounts to modify LSA database permissions.\r\n\r\nIn summary, we will map the diverse vulnerability surface that the LSASS exposes in modern environments, covering five distinct findings: two local memory corruptions, two remote DoS primitives, and one reliable remote Elevation of Privilege. Ultimately, we demonstrate that even the most hardened process in Windows can still be toppled if you know exactly where to push.", "recording_license": "", "do_not_record": false, "persons": [{"code": "9XF7UJ", "name": "Erik Egsgard", "avatar": "https://cfp.recon.cx/media/avatars/9XF7UJ_j8LYnVz.webp", "biography": "Erik Egsgard is a Principal Security Developer with Field Effect. With over 20 years experience in the computer security field he has found vulnerabilities across a wide range of software and operating systems including Windows, MacOS, iOS and Android.", "public_name": "Erik Egsgard", "guid": "f4f06417-c1b9-5c65-a94b-560c1a9b7f0f", "url": "https://cfp.recon.cx/recon-2026/speaker/9XF7UJ/"}], "links": [], "feedback_url": "https://cfp.recon.cx/recon-2026/talk/LAWUEN/feedback/", "origin_url": "https://cfp.recon.cx/recon-2026/talk/LAWUEN/", "attachments": [{"title": "IRONGIANT Slides", "url": "/media/recon-2026/submissions/LAWUEN/resources/IronGiant-Recon_H0HO8oB.pdf", "type": "related"}]}, {"guid": "4b280b42-450d-585a-b1a5-bde807b89835", "code": "DZUQYU", "id": 103, "logo": "https://cfp.recon.cx/media/recon-2026/submissions/DZUQYU/Todd-Manning-REcon-Title-Image_qG_cDXVzvU.webp", "date": "2026-06-21T14:30:00-04:00", "start": "14:30", "duration": "01:00", "room": "Grand Salon Opera", "slug": "recon-2026-103-putting-the-genie-back-in-the-bottle-agentic-reverse-engineering-of-claude-s-security-architecture", "url": "https://cfp.recon.cx/recon-2026/talk/DZUQYU/", "title": "Putting the Genie Back in the Bottle: Agentic Reverse Engineering of Claude's Security Architecture", "subtitle": "", "track": null, "type": "Talk", "language": "en", "abstract": "The proliferation of AI agents is quickly becoming one of the foremost concerns of security teams. Engineering teams are clamoring for the increase in velocity afforded by AI coding agents. Non-technical teams have noticed, and employees of all job types are asking for agentic AI tools to facilitate their work. Security teams need to have a clear understanding of how these tools operate, what their security features are, and where the security failures lie. Armed with this knowledge, security teams can enable these new agentic work paradigms while protecting all the things.\r\n\r\nThis talk presents the complete reverse engineering of Anthropic's Claude Code, Claude Desktop, and Claude Cowork. The recent release of Claude Cowork provides the LLM agent with extraordinary host privileges -- spawning VMs, mounting host directories, taking screenshots, typing into terminals, automating browsers and applications -- all decided by a language model one prompt injection away from hostile intent. We take a look at the two personalities of Claude Cowork. One component of Cowork is Claude Code, running inside a Linux VM using multiple isolation strategies to constrain LLM agent access to user resources, and another is Claude with agentic access to dive the desktop user interface, with capabilities for reading and interacting with anything on the screen.\r\n\r\nIn this talk, we also present the power of agent-assisted research and development for not only understanding the features and attack surface of these Claude agents, but we demonstrate newly-discovered vulnerabilities in components of Claude. We also identify attack surfaces that in some cases are obvious to see, and other attack surfaces that are completely surprising to discover.\r\n\r\nWe investigate binaries spanning multiple languages, including Swift, Rust, Go; two JavaScript runtimes; recovering the complete VM hardware configuration from decompiled Swift; the full vsock RPC protocol from a stripped Go guest agent; examine Claude's cloud based and local configuration systems; perform analyses of the Linux VM container isolation strategies; and uncover a hidden BLE hardware companion protocol that provides auto-approve capabilities (effectively 'dangerous permission mode') for every tool request the model makes. We present confirmed vulnerabilities in multiple subsystems.\r\n\r\nFinally, we draw some conclusions about the security architecture of Claude Desktop as a whole, identifying some glaring gaps in which threats the architecture prioritizes, and which seem to have been woefully ignored. We investigate strategies for improving isolation of the agent, and consider where these might fall short.", "description": "", "recording_license": "", "do_not_record": false, "persons": [{"code": "P83TYB", "name": "Todd Manning", "avatar": "https://cfp.recon.cx/media/avatars/P83TYB_Sx5Zfr1.webp", "biography": "I have extensive experience across diverse industry verticals such as automotive, banking, medical, mobile, embedded, industrial control, public utilities, oil & gas, wired and wireless networking, telecommunications, cloud computing, and AI.\r\n\r\nAs a key member of advanced security research teams at BreakingPoint Systems, Accuvant Labs, Optiv Security, Duo Security, Trend Micro, Atredis Partners, and Together AI, I have successfully delivered hardware and software products, security research, and consulting services to customers and the wider security community.\r\n\r\nI attended the conference a couple of times in the 2008-2012 time frame. You don't need me to tell you how great REcon is. It's really great.", "public_name": "Todd Manning", "guid": "acb8ba98-43bc-57df-8553-401d3fe6ea58", "url": "https://cfp.recon.cx/recon-2026/speaker/P83TYB/"}], "links": [], "feedback_url": "https://cfp.recon.cx/recon-2026/talk/DZUQYU/feedback/", "origin_url": "https://cfp.recon.cx/recon-2026/talk/DZUQYU/", "attachments": [{"title": "Todd Manning Slides for Putting the Genie Back in the Bottle", "url": "/media/recon-2026/submissions/DZUQYU/resources/Claude-minimized_cSMz8wG.pdf", "type": "related"}]}, {"guid": "a1bf8257-4609-5c61-a8f9-0e0b1e966bc8", "code": "3WVX3F", "id": 90, "logo": null, "date": "2026-06-21T16:00:00-04:00", "start": "16:00", "duration": "00:30", "room": "Grand Salon Opera", "slug": "recon-2026-90-black-box-deobfuscation-reverse-engineering-binaries-with-your-eyes-closed-or-almost", "url": "https://cfp.recon.cx/recon-2026/talk/3WVX3F/", "title": "Black-box deobfuscation: reverse engineering binaries with your eyes closed (or almost)", "subtitle": "", "track": null, "type": "Short Talk", "language": "en", "abstract": "Reverse engineering is fun and profitable, but can become tedious when the code is obfuscated, especially if done by hand. Under strong obfuscation, even automated analyses based on taint or symbolic reasoning fail, becoming quickly too imprecise. Fortunately, a new hope arises with black-box deobfuscation. This is an emerging paradigm for automated deobfuscation that leverages program synthesis to simplify local, highly obfuscated code snippets. Black-box deobfuscation is especially promising because it is not affected by the syntactic complexity introduced by obfuscation. Hence, it scales to strong obfuscation, where taint or symbolic reasoning would typically fail. The Xyntia framework is the state-of-the-art of black-box deobfuscation. It is backed by recent publications in international academic conferences (ACM CCS 2021 & 2025). This presentation will provide an overview of its internals and describe practical examples of successful deobfuscation with Xyntia. In particular, we will show how Xyntia can be used to deobfuscate virtual machine handlers or MBA expressions found in real code (e.g., Snapchat).", "description": "This presentation is based on publications that are joint works with Gr\u00e9goire Menguy (presenter), S\u00e9bastien Bardin, Vidal Attias, Nicolas Bellec, Jean-Yves Marion, Richard Bonichon and Cauim de Souza Lima.", "recording_license": "", "do_not_record": false, "persons": [{"code": "YRTQBX", "name": "Gr\u00e9goire Menguy", "avatar": null, "biography": "Gr\u00e9goire Menguy is a researcher at CEA LIST in the Binsec team, where he works on new reverse engineering methods to help code understanding and malware analysis. He is the lead researcher and developer of Xyntia, a state-of-the-art black-box deobfuscation framework for binary code. He received his PhD in 2023 for his work on symbolic AI for reverse and program comprehension.", "public_name": "Gr\u00e9goire Menguy", "guid": "6b1824a2-1708-5825-a593-f77053699e0b", "url": "https://cfp.recon.cx/recon-2026/speaker/YRTQBX/"}], "links": [{"title": "Xyntia github", "url": "https://github.com/binsec/xyntia", "type": "related"}, {"title": "Slides", "url": "https://binsec.github.io/assets/publications/slides/2026-recon.pdf", "type": "related"}], "feedback_url": "https://cfp.recon.cx/recon-2026/talk/3WVX3F/feedback/", "origin_url": "https://cfp.recon.cx/recon-2026/talk/3WVX3F/", "attachments": []}, {"guid": "de7c482c-0f6a-58dc-b735-897ffefeada5", "code": "SZE7UX", "id": 107, "logo": null, "date": "2026-06-21T16:30:00-04:00", "start": "16:30", "duration": "00:30", "room": "Grand Salon Opera", "slug": "recon-2026-107-mixed-boolean-arithmetic-obfuscation-what-we-build-what-we-break-and-what-we-can-t", "url": "https://cfp.recon.cx/recon-2026/talk/SZE7UX/", "title": "Mixed Boolean-Arithmetic Obfuscation: What We Build, What We Break, and What We Can\u2019t", "subtitle": "", "track": null, "type": "Short Talk", "language": "en", "abstract": "Mixed Boolean-Arithmetic (MBA) obfuscation has drawn substantial work in both construction and simplification. Yet the conversation often conflates distinct problems: linear MBA results read as general, restricted-operator techniques read as full-space solutions, benchmarks built by the same techniques they evaluate. Progress is real, but much of it has happened inside a narrow region of a much larger design space.\r\n\r\nThis talk is a benevolent rant: an attempt to map the space well enough to ask the right questions, including ones whose answers may be unwelcome (infeasibility, hard limits). It organizes the discussion around three: what we build, what we break, what we don\u2019t know (and probably can\u2019t), and argues the third is larger than the literature treats it.\r\n\r\nOn the construction side, we attempt to lay out a formal hierarchy of expressions, separate the operators used to build an expression from those targeted by simplification, and look at how identity equivalences are generated (iteratively, compositionally, otherwise).\r\n\r\nOn the simplification side, once an MBA expression is in hand, much of what real binaries contain is reachable with existing tools: not because the problem is solved, but because constructions in the wild align with how current attacks decompose them. The real difficulty lies in expression retrieval: MBA split across blocks or functions, destructured by optimizers, mangled by lifters, and in general entangled with virtualization and other obfuscation transformations.\r\n\r\nWe close on foundational obstacles: normal forms, what \u201csimpler\u201d even means. We observe that stronger constructions sit in the unexplored part of the map (with no reason to expect current tools would handle them), and ask what we\u2019d need to push past that, with some opinionated takes on directions worth pursuing.", "description": "", "recording_license": "", "do_not_record": false, "persons": [{"code": "AMSRFC", "name": "Arnau G\u00e0mez i Montolio", "avatar": "https://cfp.recon.cx/media/avatars/AMSRFC_KcUJ7dR.webp", "biography": "Arnau is a hacker, security researcher and mathematician with over a decade of experience across academia and industry, spanning software protection research and practical defenses in anti-malware and anti-cheating.\r\n\r\nHe is a Principal Research Engineer/Scientist at Hex-Rays, where he works on advancing binary semantic analysis within IDA. He is also Founder of Fura Labs, a boutique firm specializing in software protection and reverse engineering consulting and training, and an external PhD researcher at the University of London.\r\n\r\nArnau is a regular speaker and trainer at international security conferences.", "public_name": "Arnau G\u00e0mez i Montolio", "guid": "e22b11c7-054f-5ca5-8045-1f8cbe4cfaaf", "url": "https://cfp.recon.cx/recon-2026/speaker/AMSRFC/"}], "links": [{"title": "Slides", "url": "https://github.com/arnaugamez/talks/tree/main/2026/00_recon", "type": "related"}], "feedback_url": "https://cfp.recon.cx/recon-2026/talk/SZE7UX/feedback/", "origin_url": "https://cfp.recon.cx/recon-2026/talk/SZE7UX/", "attachments": []}, {"guid": "98b4bdc9-7430-5190-a3bc-63ce149ca83f", "code": "DGELBZ", "id": 106, "logo": null, "date": "2026-06-21T17:00:00-04:00", "start": "17:00", "duration": "00:30", "room": "Grand Salon Opera", "slug": "recon-2026-106-closing-ceremony", "url": "https://cfp.recon.cx/recon-2026/talk/DGELBZ/", "title": "Closing ceremony", "subtitle": "", "track": null, "type": "Short Talk", "language": "en", "abstract": "Closing ceremony", "description": "", "recording_license": "", "do_not_record": false, "persons": [], "links": [], "feedback_url": "https://cfp.recon.cx/recon-2026/talk/DGELBZ/feedback/", "origin_url": "https://cfp.recon.cx/recon-2026/talk/DGELBZ/", "attachments": []}], "Soprano A": [{"guid": "539aa85f-a6f4-5863-aa6e-17addc8bad22", "code": "U3DWWA", "id": 38, "logo": null, "date": "2026-06-21T13:00:00-04:00", "start": "13:00", "duration": "03:00", "room": "Soprano A", "slug": "recon-2026-38-reversing-framework-mobile-applications-with-open-source-tools", "url": "https://cfp.recon.cx/recon-2026/talk/U3DWWA/", "title": "Reversing Framework Mobile Applications with Open Source Tools", "subtitle": "", "track": null, "type": "Workshop (3hrs)", "language": "en", "abstract": "As malware authors shift tactics, they increasingly hide malicious functionality within popular mobile application frameworks, allowing them to evade static and dynamic analysis. This workshop will introduce participants to some of the more popular frameworks used in App development as well as techniques leveraging open source tools to approach reverse engineering said mobile applications for malware analysis and defensive threat intelligence.\r\n\r\nThe workshop will comprise two sections, one for Flutter and Unity. Both will begin with a quick foundational overview of the respective framework, including the basics on the Dart and Unity programming languages as well as a high-level overview of the Dart VM, its compilation models, and the resulting \"snapshot\" artifacts that analysts encounter. We then explain how both frameworks present unique obstacles for reverse engineering and walk through different techniques and tools (Il2CPPDumper and Blutter) used to produce higher-level code, as well as their shortcomings and limitations.\r\n\r\nStudents attending will get hands-on practice reversing In-the-Wild Android malware built with each respective framework, and be exposed to more advanced anti-analysis techniques employed by framework malware to impede dynamic analysis.", "description": "Students attending this workshop should come prepared with a laptop (Linux, or Windows + WSL/Ubuntu) with the following tools installed:\r\n- A working terminal\r\n- Git\r\n- Ghidra\r\n- Blutter: https://github.com/worawit/blutter\r\n- il2cppdumper: https://github.com/Perfare/Il2CppDumper\r\n- ilspy/dnspy: https://github.com/dnSpy/dnSpy \r\n- Maybe Python if you're feeling scripty.", "recording_license": "", "do_not_record": false, "persons": [{"code": "JF3GSJ", "name": "Nick Anderson, Roy Tu", "avatar": "https://cfp.recon.cx/media/avatars/JF3GSJ_DUUU5G3.webp", "biography": "Nick is a member of the Android Anti-Malware Team at Google where he focuses on off-market malware and phishing applications. When Nick isn\u2019t reversing malware he\u2019s day-dreaming about endpoint detection strategies, lockpicking, and carbs (mostly beer, but bread too). An interesting fact about Nick is that he has an eclectus parrot who keeps escaping from his house in Seattle.", "public_name": "Nick Anderson, Roy Tu", "guid": "2851aa0a-8ab6-515d-be07-336233df6a9b", "url": "https://cfp.recon.cx/recon-2026/speaker/JF3GSJ/"}, {"code": "BWGSFX", "name": "Roy Tu", "avatar": null, "biography": "Roy Tu is a security engineer for the Android Anti-Malware Team at Google, specializing in static code decompilation of non-standard Android apps. Previously, Roy worked as a pentester for 4 years for NCC Group. His interests include binary reverse engineering, control flow lifting, LLVM/MLIR and hardware hacking.", "public_name": "Roy Tu", "guid": "654c3721-edba-55e0-9825-337868b7b279", "url": "https://cfp.recon.cx/recon-2026/speaker/BWGSFX/"}], "links": [], "feedback_url": "https://cfp.recon.cx/recon-2026/talk/U3DWWA/feedback/", "origin_url": "https://cfp.recon.cx/recon-2026/talk/U3DWWA/", "attachments": [{"title": "Slides", "url": "/media/recon-2026/submissions/U3DWWA/resources/recon_frameworks_slides_LUiAMwq.pdf", "type": "related"}]}], "Soprano B": [{"guid": "2a651af8-a650-59a5-9714-9cb700583ed4", "code": "Y7Z98G", "id": 15, "logo": null, "date": "2026-06-21T13:00:00-04:00", "start": "13:00", "duration": "03:00", "room": "Soprano B", "slug": "recon-2026-15-orchestrating-chaos-defeating-guloader-s-veh-and-obfuscation-with-unicorn", "url": "https://cfp.recon.cx/recon-2026/talk/Y7Z98G/", "title": "Orchestrating Chaos: Defeating Guloader's VEH and Obfuscation with Unicorn", "subtitle": "", "track": null, "type": "Workshop (3hrs)", "language": "en", "abstract": "Standard sandboxes and automated scanners fall short when faced with the modern state of **Guloader**. Its reliance on **Vectored Exception Handling (VEH)** to redirect control flow through intentional exceptions creates a \"black box\" for traditional debuggers and linear disassemblers. This 3 hour workshop bypasses the basics and dives straight into the heavy lifting of modern malware deobfuscation.\r\n\r\nWe will perform a deep-dive dissection of a multi-stage infection chain, moving rapidly through PowerShell loaders into the core of the matter: **multi-layered shellcode**. Participants will reverse-engineer the \"exception soup\" of Guloader, mapping out how it uses various CPU instructions and a custom handler to mask its code flow.\r\n\r\nThe highlight of the session is a transition from manual analysis to **programmatic automation**. We will leverage the **Unicorn emulator framework** to build a custom configuration extractor capable of reconstructing non-contiguous encrypted payloads that stay hidden from static analysis.", "description": "**Key Technical Deep-Dives:**\r\n\r\n* **The VEH Maze:** Bypassing exception-based control flow flattening.  \r\n* Extracting secrets hidden via **Constant Unfolding**  \r\n* **Emulation-Based Solution:** Using Python and Unicorn to automate the extraction of C2 and multiple encrypted strings from obfuscated DWORDS.  \r\n* **Indirect Syscalls:** Identifying and neutralizing EDR-evasion techniques within shellcode.\r\n\r\n## Workshop Focus\r\n\r\n* **Recent variants of real-world malware samples**: Unlike theoretical exercises, this workshop utilizes live, updated malware samples of **Guloader**. This immersive approach ensures that participants gain experience with the actual challenges posed by modern threats.  \r\n* **Chained Attack Scenarios**: The workshop will simulate a multi-stage attack where **Guloader** acts as the initial entry vector, deploying and executing payload. This chained scenario highlights how different malware types collaborate in complex attacks, providing a holistic view of the threat landscape.  \r\n* **Practical, Hands-On Experience**: The entire workshop is fundamentally practical. Attendees will actively engage in analyzing malware, utilizing industry-standard tools and techniques. This hands-on methodology fosters deep understanding and skill development.  \r\n* **The ratio of presentation to hands-on training**: **90% hands-on**\r\n\r\n## Workshop Outline\r\n\r\n1. **Phase 1: Shellcode Extraction & Context Reconstruction**  (10 min)  \r\n* **Recon-Exclusive:** PowerShell obfuscation analysis is **removed**. Attendees are provided a de-obfuscated script solely to extract the shellcode.  \r\n* **Vector Isolation:** Isolate the specific Windows callback and their parameters used for execution transfer to replicate the initial register state for the loader.\r\n\r\n\r\n2. **Phase 2: Defeating Indirect Syscalls & Loader Internals** (30min)  \r\n* **Heuristic Analysis:** Identifying and bypassing \"Hell's Gate\" and related indirect syscall techniques used to blind EDRs.  \r\n* **Gadget Hunting:** Manually locating the \"gadgets\" the loader uses to construct syscalls, rather than relying on automated tool output.  \r\n* **Opaque Predicates:** Analyzing and defeating the unpacking loops that guard the next-stage shellcode, preparing the binary for the core VEH analysis.\r\n\r\nBreak (10 min)\r\n\r\n3. **Phase 3: Windows Internals & The VEH State Machiner** (60 min)  \r\n     \r\n   *This section represents the core \"Delta\" from previous workshops, focusing on undocumented Windows structures.*  \r\n     \r\n   * **Manual Traversal of Windows 10 Structure:** Instead of relying on conventional debugger commands, participants will manually locate the registered Vector Exception Handler (VEH) function. This involves writing an IDA script to walk the undocumented `_LdrpVectorHandlerList` structure in memory and overcoming pointer encoding challenges.  \r\n   * **Reversing `AddVectoredExceptionHandler`:** A deep dive into the kernel32 implementation of exception registration to understand how Guloader hijacks this mechanism.  \r\n   * **Context Manipulation & RIP Hijacking:** Analyzing how the handler modifies the `PCONTEXT` structure (specifically `Eip`/`Rip`) to \"skip\" variable-length junk bytes and resume execution at dynamically calculated offsets.  \r\n   * **Anti-Debug Logic:** Decompiling the handler\u2019s logic to see how it inspects Hardware Breakpoints (DR0-DR7) within the context record to detect analysis tools.  \r\n     \r\n\r\nBreak (10 min)\r\n\r\n4. **Phase 4: Advanced Emulation & Custom Instrumentation** (60 min)  \r\n   *Moving beyond \"using Unicorn,\" this phase focuses on \"fixing Unicorn\" to handle hostile code.*  \r\n   * **Solving the Halting Problem:** Participants will write a custom Unicorn harness that handles `UC_MEM_READ_UNMAPPED` and `UC_HOOK_INTR` events to emulate the OS loader's exception dispatching behavior.  \r\n   * **Configuration Extraction:** Automating the decryption of non-contiguous strings and C2 configurations, effectively bypassing the need for a fully functional debugger.  \r\n   * **Optimization:** mitigating the performance penalties of Python-based emulation when handling millions of instructions.  \r\n     \r\n\r\nDetailed explanations and working solutions will be provided for all exercises to support attendees' learning.\r\n\r\n## Take away from this workshop\r\n\r\n* **A Weaponized Emulation Harness:** Walk away with a robust, custom-built Python-Unicorn harness specifically engineered to bridge the gap between static emulation and dynamic Windows Exception Handling (VEH). You will own the code to simulate complex OS-level callbacks that standard emulators fail on.  \r\n* **Automated Deobfuscation Logic:** Master the implementation of a custom hook management within Unicorn to trace, intercept, and defeat junk code and control-flow flattening without touching the debugger.  \r\n* **Genericizing the Solution:** Learn how to transform a specific Guloader solution into a reusable methodology for defeating other exception-based obfuscators (like those found in modern Dridex or Ursnif variants) by leveraging purely emulated execution traces.\r\n\r\n## What audience needs to bring to this workshop\r\n\r\n* Laptops that have at least **8GB RAM** and **100GB of free SSD space**  \r\n* Due to EULA of various software. Each student is to set up a Windows 10 VM prior to the workshop. This VM has to contain the following tools:  \r\n  * Latest version of Visual Studio Code with Powershell extension (from Microsoft)  \r\n  * IDA Free 9.2+ (Note: All scripts utilized in this workshop have been strictly tested to work on IDA Pro and Free 9.2+).  \r\n  * Python 3.13 (x64)  \r\n  * Unicorn Framework python module ([https://www.unicorn-engine.org/](https://www.unicorn-engine.org/))  \r\n  * SystemInformer (for dumping memory pages)  \r\n  * Decompiler will not be necessary for this workshop\r\n\r\n## Target Audience\r\n\r\n* Mid to senior-level cybersecurity practitioners  \r\n* Malware analysts, incident responders, threat hunters  \r\n* Professionals seeking hands-on malware analysis skills\r\n\r\n## Skills required\r\n\r\n* **Fluent x86/x64 Assembly:** Must be comfortable manually tracing control flow, stack operations, and register states without relying exclusively on decompilers (as the obfuscation renders Hex-Rays/Ghidra ineffective).  \r\n* **Intermediate Python Scripting:** Ability to write functional scripts using external libraries. Familiarity with Python's `struct` module or memory mapping concepts is critical for the emulation phase.  \r\n* **Windows Internals Fundamentals:** A conceptual understanding of how Windows handles exceptions (VEH/SEH), Context Records, and hardware breakpoints is highly recommended.  \r\n* **IDA Pro Proficiency:** Standard navigation skills (following cross-references, patching bytes, defining code/data) are assumed.", "recording_license": "", "do_not_record": false, "persons": [{"code": "GA3PSC", "name": "Mark Lim", "avatar": "https://cfp.recon.cx/media/avatars/GA3PSC_u2j2X3c.webp", "biography": "**Mark Lim** has been in the cybersecurity domain for close to 20 years. Currently, he is a principal malware reverse engineer at Palo Alto Networks. He focuses on analysing malware samples and developing detection mechanisms. Mark constantly looks for opportunities to improve his reverse engineering skills by sharing experiences with others. Mark believes every piece of binary contains a story waiting for a reverse engineer to tell it. Before working at Palo Alto Networks he spent 10 years as a blue teamer at the Singapore government. Mark has spoken at VirusBulletin 2023, 2024 and 2025 and JSAC 2026.", "public_name": "Mark Lim", "guid": "d1ee2506-f67d-5941-965f-56d75547a393", "url": "https://cfp.recon.cx/recon-2026/speaker/GA3PSC/"}], "links": [{"title": "Exercises used for this workshop", "url": "https://github.com/peta909/RECON2026_Chaos", "type": "related"}], "feedback_url": "https://cfp.recon.cx/recon-2026/talk/Y7Z98G/feedback/", "origin_url": "https://cfp.recon.cx/recon-2026/talk/Y7Z98G/", "attachments": [{"title": "Slides for workshop", "url": "/media/recon-2026/submissions/Y7Z98G/resources/Orchestrating_Chaos__Def_CRiNUpZ.pdf", "type": "related"}]}], "Soprano C": [{"guid": "1b351a67-dae3-5ca3-ba69-5d35fe5e2420", "code": "B7GUGA", "id": 113, "logo": null, "date": "2026-06-21T13:00:00-04:00", "start": "13:00", "duration": "03:00", "room": "Soprano C", "slug": "recon-2026-113-bnsql-idasql-ghidrasqk-hands-on-agentic-and-automatic-reverse-engineer", "url": "https://cfp.recon.cx/recon-2026/talk/B7GUGA/", "title": "BNSQL/IDASQL/GhidraSQK hands on: Agentic and automatic reverse engineer", "subtitle": "", "track": null, "type": "Workshop (3hrs)", "language": "en", "abstract": "Why have to reverse engineer by hand anymore? It is now a waste of time to use any user interfaces?\r\nIn this age and era, it is not important at all, just focus on prompting, work on your instruction files and custom skills.\r\nJoin me in this hands on session on how to setup and configure the tool of your choice IDASQL (AI), BNSQL (Binary Ninja), or GhidraSQL (for Ghidra).\r\nI will teach you how to use these xSQL tools with your coding harness of choice.", "description": "Why have to reverse engineer by hand anymore? It is now a waste of time to use any user interfaces?\r\nIn this age and era, it is not important at all, just focus on prompting, work on your instruction files and custom skills.\r\nJoin me in this hands on session on how to setup and configure the tool of your choice IDASQL (AI), BNSQL (Binary Ninja), or GhidraSQL (for Ghidra).\r\nI will teach you how to use these xSQL tools with your coding harness of choice.", "recording_license": "", "do_not_record": false, "persons": [{"code": "CYSJ9X", "name": "Elias", "avatar": null, "biography": null, "public_name": "Elias", "guid": "72fd5695-358d-52fc-8371-6c3daf2a981a", "url": "https://cfp.recon.cx/recon-2026/speaker/CYSJ9X/"}], "links": [], "feedback_url": "https://cfp.recon.cx/recon-2026/talk/B7GUGA/feedback/", "origin_url": "https://cfp.recon.cx/recon-2026/talk/B7GUGA/", "attachments": []}]}}]}}}