2.0 -//Pentabarf//Schedule//EN PUBLISH 7PEBYD@@cfp.recon.cx -7PEBYD Opening ceremony en en 20260619T100000 0.03000 Opening ceremony PUBLIC CONFIRMED Short Talk https://cfp.recon.cx/recon-2026/talk/7PEBYD/ Grand Salon Opera PUBLISH YGP3RN@@cfp.recon.cx -YGP3RN I have to use AI, so what now? A skeptic guide to vibing RE/VR en en 20260619T103000 20260619T110000 0.03000 I have to use AI, so what now? A skeptic guide to vibing RE/VR PUBLIC CONFIRMED Short Talk https://cfp.recon.cx/recon-2026/talk/YGP3RN/ Grand Salon Opera Philippe Laulheret PUBLISH EZTMNB@@cfp.recon.cx -EZTMNB Click Once and Stay Forever: uncovering a new abuse of the ClickOnce technology en en 20260619T110000 20260619T120000 1.00000 Click Once and Stay Forever: uncovering a new abuse of the ClickOnce technology PUBLIC CONFIRMED Talk https://cfp.recon.cx/recon-2026/talk/EZTMNB/ Grand Salon Opera Mathilde Venault PUBLISH 8BJ3KP@@cfp.recon.cx -8BJ3KP FAT Chungus: CVE-2025-24857 - A Journey Through U-Boot Exploitation en en 20260619T130000 20260619T140000 1.00000 FAT Chungus: CVE-2025-24857 - A Journey Through U-Boot Exploitation lol AI summary: Key Topics Covered: The Vulnerability Root Cause: An integer underflow in U-Boot’s get_fatent() function triggered during file reads from attacker-controlled USB devices. Impact: Bypasses secure boot, enabling arbitrary code execution on otherwise hardened devices. Scope: Affects U-Boot versions prior to 2017.11, Qualcomm IPQ chipsets (IPQ4019, IPQ5018, etc.), and devices like Amazon eero routers. Discovery & Fuzzing Challenge: Fuzzing a 250MB FAT32 filesystem was impractical due to size constraints. Solution: Zombified U-Boot’s FAT reader into a Linux userland tool, embedding the entire FAT image for targeted sector fuzzing. Breakthrough: Crashes identified within minutes by focusing on the FAT header sector. Exploitation Chain Triggering the Bug: Manipulating the root_cluster parameter to force fatlength < startblock, causing getsize to underflow to ~UINT32_MAX. Memory Layout: Deterministic addresses in executable RAM (0x4a900000–0x4aa00000) with disabled NX-bit. Overflow Control: Using USB emulation (Facedancer/Cynthion) to send empty sector responses, triggering U-Boot’s recovery mode and enabling precise overflow length control. Code Execution: Hijacking U-Boot’s environment variable hash table via overflow to redirect execution to attacker-controlled shellcode. Payload Development Rust Implementation: Safe, panic-handled Rust code for heap restoration, interrupt disablement, and kernel loading. Heap Repair: Rebuilding DLMalloc linked lists and re-importing environment variables from eMMC. Bootargs Manipulation: Enabling root shell via systemd.wants=serial-getty@ttyMSM0.service. Responsible Disclosure & Mitigation Coordinated Response: Collaboration with CISA (Advisory ICSA-25-343-01), Qualcomm, and the U-Boot Project. Amazon’s Action: Patched tens of millions of eero routers via automatic, cryptographically signed updates by January 2025. Fix: Upgrade to U-Boot v2025.4 or later. PUBLIC CONFIRMED Talk https://cfp.recon.cx/recon-2026/talk/8BJ3KP/ Grand Salon Opera Tim Noise bryce case, jr./ytcracker PUBLISH PSNDXB@@cfp.recon.cx -PSNDXB SELECT * FROM binary — Vibe Reversing Across IDA, Ghidra, and Binary Ninja en en 20260619T140000 20260619T150000 1.00000 SELECT * FROM binary — Vibe Reversing Across IDA, Ghidra, and Binary Ninja Every major RE tool has a powerful but incompatible scripting API. Analysts must learn each one. AI agents can't easily drive them without tool-specific glue code. There is no common interface -- until now. idasql, ghidrasql, and bnsql expose the internals of IDA Pro, Ghidra, and Binary Ninja as live SQL virtual tables -- 30+ tables covering functions, cross-references, strings, types, disassembly, and decompilation. These tables are not read-only exports: analysts and AI agents can rename functions, annotate variables, apply types, set comments, and manage bookmarks through standard SQL INSERT/UPDATE/DELETE statements. Changes are reflected live in the RE tool. Because SQL is the one query language every LLM already speaks fluently, this turns any AI coding agent into a reverse engineering partner -- no IDAPython, no Ghidra scripts, no tool-specific plugins required. This talk covers: **One language, three tools.** The same SQL query runs against IDA, Ghidra, and Binary Ninja. We show how `SELECT name, size FROM funcs ORDER BY size DESC LIMIT 10` returns near-identical results across all three tools for the same binary -- and where the interesting differences are. **The decompiler as a database.** Decompiled pseudocode, AST nodes, local variables, and call arguments are all queryable tables. We demonstrate queries like "find all functions that call malloc without checking the return value" expressed as pure SQL joins across decompiler and cross-reference tables. **Read-write reverse engineering.** These tools don't just query -- they write back. We walk through a complete annotation workflow: the agent decompiles a function, renames variables to meaningful names, applies recovered struct types, adds comments explaining the logic, and bookmarks points of interest. All through SQL, all persisted to the database. **AI-driven analysis sessions.** Live demonstration of "vibe reversing": an analyst describes what they want in natural language, and the AI agent autonomously drives the RE tool. We show single-binary triage from scratch, cross-tool comparison of the same binary in IDA and Ghidra side by side, and multi-database campaigns where the agent cross-references findings across related malware samples. **Cross-tool annotation transfer.** An agent reads the annotations, variable names, and type definitions from one tool's database and applies them in another -- bridging the gap between analysts who use different RE tools on the same project. **Autonomous type recovery.** The agent reads decompiler output, identifies pointer arithmetic patterns and field access offsets, and constructs struct, union, and enum definitions through SQL -- creating types, adding members, and applying them to variables and function signatures. We show how an agent recovers a multi-level struct hierarchy from raw decompiler output and applies it across all functions that reference it. **Source recovery from binaries.** We show a complete end-to-end case: starting from a stripped binary, the agent iteratively decompiles, annotates, recovers types and structures, and produces compilable source code -- all driven by natural conversation. We also demonstrate guided recovery where the agent is given partial source code alongside a binary and reconstructs the missing pieces by correlating decompiler output against the known code. **Malware analysis in practice.** We walk through a real-world C2 malware sample with layered complexity: an outer loader, an inner DLL, and embedded plugin blobs, each requiring extraction and independent analysis. The agent autonomously identifies the layers, extracts the embedded components, opens them in separate database sessions, cross-references between them, and produces a complete annotated teardown of the malware's architecture. **Multi-database diffing.** With multiple databases open simultaneously, the agent compares two versions of the same binary -- identifying new functions, changed code paths, and patched vulnerabilities. This extends naturally to malware variant analysis, patch diffing, and firmware update comparison. **Practical limits and honest lessons.** Where LLMs excel at RE tasks (pattern matching, bulk annotation, cross-referencing, structure recovery), where they still struggle (complex control flow, novel obfuscation, very large functions), and what the SQL interface cannot yet capture. Attendees will leave with a concrete understanding of how to connect AI agents to their existing RE workflow across any of the three major platforms, and what "vibe reverse engineering" looks like in practice today. PUBLIC CONFIRMED Talk https://cfp.recon.cx/recon-2026/talk/PSNDXB/ Grand Salon Opera Elias Bachaalany PUBLISH A99GW9@@cfp.recon.cx -A99GW9 Deobfuscation in the Age of Agentic Reverse Engineering en en 20260619T150000 20260619T153000 0.03000 Deobfuscation in the Age of Agentic Reverse Engineering Large language models first entered reverse engineering as helpful assistants: improving decompiler output, suggesting names, answering questions about code, and generating small analysis scripts. Useful as these capabilities were, they largely remained confined to the role of a smart helper sitting next to the analyst. But reverse engineering has changed quickly. With tool-connected, agentic workflows, models are no longer limited to commenting on pseudocode. They can query disassemblers and decompilers, inspect cross-references and intermediate representations, generate custom scripts, patch binaries, rerun analyses, and iteratively refine hypotheses in a loop. The result is a fundamental shift: from LLM-assisted code reading to agentic reverse engineering. This shift is especially significant for deobfuscation. Rather than a single clever trick, deobfuscation is usually an iterative process of recovering structure, applying transformations, and reanalyzing the result until something meaningful emerges. Agentic workflows are unusually well matched to this style of work. They can automate common simplification steps, connect different analysis layers, and keep pushing the program toward something more understandable. Once deobfuscation becomes agentic, it also becomes more global. Instead of operating on one function at a time, agents can help identify core routines, propagate recovered semantics across the call graph, mine repeated obfuscation motifs, and apply transformations at interprocedural or whole-program scale. This changes the practical unit of work in reverse engineering: from manually attacking isolated functions to coordinating larger deobfuscation campaigns across an entire binary or malware family. In this talk, we revisit the state of LLM-assisted reverse engineering from our earlier work and examine how the landscape has evolved. We argue that the key breakthrough is not that models suddenly understand obfuscated code perfectly, but that they can now help orchestrate the broader workflow around deobfuscation: tool usage, reasoning, scripting, patching, and iterative refinement. This naturally leads to the defensive question as well. If reverse engineering is becoming agentic, what must obfuscation look like to remain resilient against attacks that are tool-driven, scriptable, and scalable? We close by exploring the emerging design space of anti-agentic obfuscation, including intertwined and global obfuscation layers, diversification, and structures that resist clean decomposition and large-scale automation. PUBLIC CONFIRMED Short Talk https://cfp.recon.cx/recon-2026/talk/A99GW9/ Grand Salon Opera Nicolò Altamura Tim Blazytko PUBLISH ECTXZH@@cfp.recon.cx -ECTXZH Chaining Microsoft binaries to get privileged primitives in Windows kernel en en 20260619T160000 20260619T170000 1.00000 Chaining Microsoft binaries to get privileged primitives in Windows kernel The goal of our research was to find undocumented pathways to escalate privileges to the Windows kernel while evading endpoint security solutions. For that end, we found a driver of Microsoft System Guard, which is shipped out of the box, that could be leveraged. Using it from user-space however had limitations. To overcome them, we are forced to run as PPL-WinTCB process, the highest protection level in Windows user-mode. To do that reliably, we showcase a new method to inject code into such a process. Our novel PPL injection technique leverages the IRundown COM interface to achieve code execution within the process WerFaultSecure.exe, which runs at the highest protection level (WinTCB), and is successfully tested on the latest version of Windows 11. What inspired us to target WerFaultSecure.exe specifically was a vulnerability introduced by James Forshaw in 2018. The vulnerability allowed for code injection into the WinTCB-signed WerFaultSecure.exe by abusing a code path in FaultRep.dll (a WerFaultSecure.exe dependency) to enable the IRundown COM interface. This code execution primitive has been widely abused to hijack threads through the DoCallback method. Similarly, in 2023 Clement Labro took advantage of an arbitrary pointer overwrite in ntdll.dll to force PPL processes to load unsigned dynamic libraries, thus achieving code execution in the context of protected processes. In response, Microsoft introduced several countermeasures to inhibit these attacks. During the talk we will showcase how to bypass these mitigations altogether. In particular, we will walk the audience through: The abuse of an old vulnerable version of WerFaultSecure which has a Dll Sideloading vulnerability, which we exploit to load an old version of FaultRep, which contains the COM vulnerability. We call this technique ‘Bring Your Own Vulnerable WerfaultSecure’; The abuse of a section object which is shared by WerFaultSecure.exe and its parent process. We will show how to construct a ROP chain on the shared memory which will be executed by the DoCallback method of the IRundown interface. This ROP chain is needed in order to give our shellcode the required execute permissions. How to retrieve and decrypt the secrets that are needed to remotely connect to the interface from PPL processes that are using this communication method. How to connect to the target interface and craft a ROP chain in the shared section aforementioned. This will enable us to pivot the execution from the ROP chain to custom shellcode. Last but not least, we will briefly discuss the concept of Control Flow Guard, or CFG, the need for admin privileges to disable it for the exploit to work, as well as ideas to bypass this requirement and new pathways to privilege escalation through PPL injection. After meeting the prerequisite - executing code at PPL-WinTCB level, we continue to achieve kernel-mode (ring 3) privileges. Microsoft System Guard is a Windows native infrastructure which validates operating system and device integrity by verifying that certain parts of kernel objects like drivers, devices, processes, threads have not been altered. It achieves this by leveraging an assertion engine running in VTL1 (SgrmEnclave_secure.dll), in combination with a kernel-mode driver - SgrmAgent.sys - which provides it with different facilities. Checks can be performed on the fields IntegrityLevel or TokenSource of the object _TOKEN owned by certain critical processes such as MsMpEng.exe for instance. This driver starts automatically at startup on every Windows 10 (and equivalent Server) release. SgrmAgent.sys enforces the following checks: The caller must be WinTCB-signed; The caller service security identifier (SID) must match a SID that is hardcoded within the driver; The driver can be initialized only once, meaning only one handle can be granted. SgrmBroker.exe is the only process which is allowed to acquire a handle to the driver by design. This is because it runs as a protected process, and its service SID matches the one the driver expects. Hence we leveraged our novel PPL injection to make WerFaultSecure execute a shellcode which opens the broker process and steals its handle to the driver, thus bypassing the checks altogether. We then use the stolen handle to communicate with the driver. Our research examined SgrmAgent.sys’s IOCTLs which yielded a treasure trove, subverting System Guard’s defensive purpose. We identified multiple ‘sub-IOCTLs’ within the ‘OctpMailboxDispatcher’ handler which enable the caller to: read kernel virtual memory and physical memory; map files and virtual memory of processes; read model-specific registers. These routines are used by the assertion engine to implement certain checks as one would expect. What is more surprising is that we also came across the thread-freezing sub-IOCTL - ‘OctpHandleFreezeThread’ - which can halt threads indefinitely by scheduling an ad-hoc kernel Asynchronous Procedure Call. This allows not only to access sensitive processes but even to bypass tampering protections enforced by 3rd party kernel drivers. We will run a live demo of the entire attack and discuss possible detection opportunities. While Microsoft does not consider admin-to-kernel a security boundary due to the fact that admin users can load 3rd party drivers, our research demonstrates that it is possible to escalate to the kernel with only Microsoft binaries and without loading a driver. References: https://googleprojectzero.blogspot.com/2018/11/injecting-code-into-windows-protected.html https://x.com/GabrielLandau/status/1683854578767343619 https://blog.scrt.ch/2023/03/17/bypassing-ppl-in-userland-again/ https://iamelli0t.github.io/2021/04/10/RPC-Bypass-CFG.html https://github.com/Slowerzs/PPLSystem https://infocon.org/mirrors/vx%20underground%20-%202025%20June/Papers/Windows/Internals%20and%20Analysis/2022-08-02%20-%20Inside%20Windows%20Defender%20System%20Guard%20Runtime%20Monitor.pdf https://www.microsoft.com/en-us/security/blog/2018/04/19/introducing-windows-defender-system-guard-runtime-attestation/ PUBLIC CONFIRMED Talk https://cfp.recon.cx/recon-2026/talk/ECTXZH/ Grand Salon Opera Angelo Frasca Caccia Alejandro Pinna PUBLISH 8TZSJN@@cfp.recon.cx -8TZSJN 8 Years of Reverse-Engineering Interpreters: Techniques, Automation, and One Framework en en 20260619T170000 20260619T180000 1.00000 8 Years of Reverse-Engineering Interpreters: Techniques, Automation, and One Framework PUBLIC CONFIRMED Talk https://cfp.recon.cx/recon-2026/talk/8TZSJN/ Grand Salon Opera Toshinori Usui PUBLISH SN8MYU@@cfp.recon.cx -SN8MYU The AI Reversing Panel: Are we all powerful, or out of a job? en en 20260619T183000 20260619T193000 1.00000 The AI Reversing Panel: Are we all powerful, or out of a job? PUBLIC CONFIRMED Panel https://cfp.recon.cx/recon-2026/talk/SN8MYU/ Grand Salon Opera John McIntosh Aaron Portnoy Marion Marschalek Gadi Evron PUBLISH V9XUD3@@cfp.recon.cx -V9XUD3 Basics of .NET Exploitation en en 20260619T130000 20260619T160000 3.00000 Basics of .NET Exploitation [X] Topics: Reversing .NET targets (static analysis, debugging, patching) Introduction to .NET vulnerabilities Basics of deserialization exploits in .NET Patch diffing and exploiting an Nday [X] Requirements: Windows 10 or 11 VM DO NOT bring an ARM laptop (MacBook) tools will not run on this CPU If you do not have a intel/amd laptop, try preparing a remote windows server (vps,ec2,etc) Basic knowledge of C# Basic of any reverse engineering is a must (x86, etc) PUBLIC CONFIRMED Workshop (3hrs) https://cfp.recon.cx/recon-2026/talk/V9XUD3/ Soprano A Sina Kheirkhah (@SinSinology) PUBLISH YACFKE@@cfp.recon.cx -YACFKE C++ Symbol and Type Recovery in Binary Ninja en en 20260619T130000 20260619T160000 3.00000 C++ Symbol and Type Recovery in Binary Ninja The 3-hour workshop will contain the following sections: - **C++ Foundation (35 minutes)**: We begin by discussing core C++ concepts, such as Object Oriented Programming, Runtime Type Information and Virtual Function Tables. We will then recover RTTI and VTable information in an example binary in Binary Ninja. - **Malware Triage and Manual C++ Reverse Engineering (60 minutes):** This section focuses on initial analysis of the target malware binary. We will identify the malware’s compiler and libraries using metadata like the Rich Header. Then we will manually reverse engineer **C Runtime (CRT)** boilerplate, argument parsing logic (```wmain```, ```lstrcmpiW```), and the "install" and "uninstall" execution paths for the malware. In addition we will analyze malware's techniques for establishing persistence, Windows service registration process and signal handling. - **Automated Context Recovery with WARP (30 minutes):** In contrast to the manual reversing process, you will learn how to use specialized tools for type identification and recovery. We will demonstrate how to identify standard C++ library functions (like those for ```std::vector``` and exception handling) and how to match the malware’s compilation environment to generate high-quality WARP analysis signatures based on C++ templates that automatically recover and rename these complex functions. - **Fuzzy Function Matching with BinDiff (35 minutes):** We conclude by leveraging binary diffing to fill the remaining gaps. You will see how the BinDiff tool and its fuzzy matching algorithms are used to compare the unknown malware against a known, clean reference binary. This technique allows more lenient matching of function names, data structures, and class types, allowing us to recover information that WARP has missed. We will also demonstrate porting missing types from the example compiled binary to the malware database using Binary Ninja type archives. - **Q&A and Resources (20 minutes):** Final thoughts and time for questions on integrating these techniques into your professional workflow. By the end of this session, you will learn robust, multi-faceted strategies for symbol and type recovery to assist with reverse engineering C++ malware in Binary Ninja with open source tools. All attendees will receive the workshop manual, slides, the sample binaries, pre-built WARP signatures, Bindiff files and a reference cheat sheet for the techniques covered. #### Prerequisites & Preparation Attendees should have basic familiarity with x86/x64 assembly and have Binary Ninja installed (a free license is sufficient). Prior malware analysis experience is helpful but not required. As we will be working with malware, please install Binary Ninja and BinDiff within a Virtual Machine for this workshop. PUBLIC CONFIRMED Workshop (3hrs) https://cfp.recon.cx/recon-2026/talk/YACFKE/ Soprano B Joshua Reynolds PUBLISH HARHBR@@cfp.recon.cx -HARHBR Beyond XNU: Anatomy of the Secure Kernel & Exclaves on Apple Silicon en en 20260620T100000 20260620T110000 1.00000 Beyond XNU: Anatomy of the Secure Kernel & Exclaves on Apple Silicon Apple Silicon introduced a guarded world alongside XNU. That environment started with SPTM and TXM, and today it also includes a CL4 microkernel, the Secure Kernel, which hosts Exclaves. Exclaves are isolated components that XNU can communicate with through defined interfaces, and that boundary is where a lot of interesting engineering decisions and security relevant behavior lives. This talk goes in depth on how the Secure Kernel and Exclaves actually work on modern iOS and macOS. We will cover the execution model and privilege separation, how communication is structured (IPC plus shared memory), and which parts of the stack tend to be responsible for validation and policy decisions. The goal is to make the system understandable enough that you can reason about it like any other target, rather than treating it as an opaque blob. Topics include: • Secure Kernel internals (task model, isolation, lifecycles) • Tightbeam (endpoints, transports, message formats) • XRT scheduler messages • Exclave resources and Conclaves • IPC + shared memory semantics (ownership, lifetimes, validation points) • Security implications: bug classes and mitigation bypass angles PUBLIC CONFIRMED Talk https://cfp.recon.cx/recon-2026/talk/HARHBR/ Grand Salon Opera Stefan Esser PUBLISH V3THYR@@cfp.recon.cx -V3THYR Prism Internals: Reversing Microsoft's x86-to-ARM64 Binary Translator en en 20260620T110000 20260620T120000 1.00000 Prism Internals: Reversing Microsoft's x86-to-ARM64 Binary Translator Every Windows on ARM machine ships Prism, a binary translator that JIT-compiles x86 and x64 to ARM64 at runtime. Five binaries, ~11K functions, no symbols, no documentation. We reversed all of it: the translation pipeline from opcode decoding to ARM64 emission, the CHPE/ARM64X hybrid loading mechanism that ties the two JIT engines together across architectures, and the undocumented `.jc` translation cache format (validated against 341 real files from a Snapdragon X install). We found that the x64se "strict" variant runs CRC32C integrity checks on translated code while the x86 variant does not, and that the cache service validates `.jc` files with four structural checks and nothing else. We demonstrate cache poisoning: drop a crafted file, hijack function translations, survive reboots, invisible to every default security layer. We release `prism-cache-parser`, detection rules, and annotated RE artifacts for all five Prism binaries. PUBLIC CONFIRMED Talk https://cfp.recon.cx/recon-2026/talk/V3THYR/ Grand Salon Opera Hugo PUBLISH BCKMJA@@cfp.recon.cx -BCKMJA ROM Dump, Descrambling and Decryption using RE Only: the Fully Analytical MEthod (FAME), no FIB, no Guesses… en en 20260620T130000 20260620T140000 1.00000 ROM Dump, Descrambling and Decryption using RE Only: the Fully Analytical MEthod (FAME), no FIB, no Guesses… The talk will start with the context introduction and a classification of the ROM dump feasibility and difficulty from non-encrypted, non-scrambled to fully encrypted and scrambled. Then, the usual dump techniques will be reviewed quickly to introduce the proposed method which is generic to the various cases discussed previously. The talk will include demos that are showing how the method can be accomplished using simple and affordable tools. A second demo will show how professional tools do the job in a blink of an eye. These two demos will be used to outline potential limitations and use cases. As the method does not require expensive FIB, micro-probing station and other custom lab equipment, it will benefit to a wide range of Reverse-Engineer from “hobbyist” to “professional” of the sector. PUBLIC CONFIRMED Talk https://cfp.recon.cx/recon-2026/talk/BCKMJA/ Grand Salon Opera Olivier THOMAS - Texplained PUBLISH QTLDLF@@cfp.recon.cx -QTLDLF Failure Is Not an Option: A Reliable Process to Exploit STM32F2/F4 Microcontrollers en en 20260620T140000 20260620T150000 1.00000 Failure Is Not an Option: A Reliable Process to Exploit STM32F2/F4 Microcontrollers PUBLIC CONFIRMED Talk https://cfp.recon.cx/recon-2026/talk/QTLDLF/ Grand Salon Opera Joe Grand Lennert Wouters PUBLISH AAPSD9@@cfp.recon.cx -AAPSD9 Paper Werewolf's Toolbox: Reversing XLL Delivery, EchoGather, and a WinRAR Exploit Chain Targeting Russia en en 20260620T150000 20260620T153000 0.03000 Paper Werewolf's Toolbox: Reversing XLL Delivery, EchoGather, and a WinRAR Exploit Chain Targeting Russia There is a persistent blind spot in public threat intelligence: the overwhelming focus on Russia as the origin of attacks leaves little analysis of groups targeting Russian targets. Paper Werewolf, also tracked as GOFFEE, is a cyberespionage actor that has been quietly running operations against Russian defense-industry and government organizations for years. It occasionally surfaces in Russian-language security reporting but receives almost no attention in Western research, which means its tooling, techniques, and infrastructure evolution are largely undocumented in English. This talk is a detailed technical examination of a recent Paper Werewolf campaign and an attempt to close some of that gap. The campaign begins with an XLL add-in submitted to VirusTotal from Ukraine and Russia in late October 2025, with filenames referencing enemy targeting data in Russian. XLL abuse is not a new concept; Excel add-ins have been weaponized for years, but public reversing walkthroughs of XLL-based campaigns in the wild are genuinely rare. This sample is a clean, mature example of the format being used by a capable actor. We start with how Excel loads and executes the DLL exports that make an XLL work, then move on to the specifics of this loader: the time-delay evasion technique designed to outlast sandbox execution windows and the unpacking chain that leads to the embedded payload. That payload is EchoGather, a backdoor we named. We reverse it in full: the XOR-based string decryption routine, the C2 communication protocol, and the command handler table. We cover what each handler does and discuss how the implant is designed for the operational requirements of a long-running espionage campaign rather than a smash-and-grab intrusion. A separate delivery chain discovered during analysis introduces a different technical angle. A RAR archive exploits CVE-2025-8088, a path-traversal vulnerability in WinRAR that exploits NTFS alternate data stream handling to write files outside the intended extraction path. The actor uses this to place a batch script directly in the Windows Startup folder, achieving persistence with no additional execution step required. We walk through the exploit mechanics at the file system level and connect it to the group's documented prior use of CVE-2025-6218, a related WinRAR vulnerability, showing how the exploitation tradecraft has evolved while the operational intent has stayed consistent. The decoy documents dropped alongside EchoGather deserve their own section. Both impersonate official communications from the Russian Ministry of Industry and Trade, and both contain artifacts that point clearly to AI-assisted generation: a double-headed eagle emblem rendered with visible distortion errors, Cyrillic characters systematically substituted with visually similar Latin equivalents in ways a native speaker would never produce, and register inconsistencies throughout the text. We treat these documents as forensic artifacts and compare them against decoys from a previously reported Paper Werewolf campaign, showing how recurring mistakes and impersonation patterns function as a durable attribution signal even when the malware family or infrastructure rotates. The AI-generation angle is also worth discussing on its own terms: what does it tell us about how this actor is operationalizing generative AI, and what fingerprints does that leave behind? On the analyst side, we used VirusTotal file relationship graphs and submission metadata to surface related samples and a broader campaign picture. For infrastructure correlation, we relied on Validin, using passive DNS records, banner hashes, and header fingerprints to connect domains and identify links to past Paper Werewolf activity. To make this repeatable, we built a lightweight script on top of the Validin API using Claude Code that systematizes the correlation process. We will show the tool, explain how it was built, and discuss how researchers can adapt the same approach for their own investigations. This is also a small but concrete illustration of using AI-assisted development to quickly build custom research tooling, something that is increasingly practical yet underutilized in the threat research community. The talk will include previously undisclosed indicators and infrastructure findings developed after our public blog post, and all tools, YARA rules, and scripts used in the investigation will be shared with attendees. PUBLIC CONFIRMED Short Talk https://cfp.recon.cx/recon-2026/talk/AAPSD9/ Grand Salon Opera Nicole Fishbein PUBLISH QQZNHF@@cfp.recon.cx -QQZNHF From Bus Wires to Badges: Breaking Into FERMAX Through RFID en en 20260620T160000 20260620T170000 1.00000 From Bus Wires to Badges: Breaking Into FERMAX Through RFID PUBLIC CONFIRMED Talk https://cfp.recon.cx/recon-2026/talk/QQZNHF/ Grand Salon Opera Iceman Kirils Solovjovs PUBLISH TXLWRK@@cfp.recon.cx -TXLWRK Breaking the Backbone of Global ISP Networks en en 20260620T170000 20260620T180000 1.00000 Breaking the Backbone of Global ISP Networks In this talk, we present a practical, end-to-end attack chain against modern fiber access networks, demonstrating how multiple pre-authenticated Remote Code Execution (RCE) vulnerabilities can be chained to fully compromise an ISP infrastructure. We begin by exploiting three pre-authenticated RCE vulnerabilities on a GPON Optical Line Terminal (OLT), gaining initial access to a device that sits at a critical point of ISP networks and directly handles customer traffic. From the compromised OLT, we pivot into the ISP’s cloud-based fleet management platform via an additional pre-authenticated RCE, ultimately obtaining centralized and persistent control over all deployed OLTs managed by the provider. In large-scale deployments, OLTs are remotely administered through centralized management platforms, making them highly attractive targets. By chaining vulnerabilities between exposed edge devices and their associated cloud management systems, an attacker can escalate from a single-device compromise to full control over the access network infrastructure. This attack path enables high-impact outcomes, including large-scale service disruption, long-term unauthorized access to ISP networks, customer traffic interception, and mass surveillance capabilities. These scenarios closely mirror recent real-world disclosures involving nation-state actors covertly compromising telecommunications providers in Western countries, where control over ISP infrastructure has been leveraged for strategic intelligence collection and population-scale monitoring. PUBLIC CONFIRMED Talk https://cfp.recon.cx/recon-2026/talk/TXLWRK/ Grand Salon Opera Mathieu Farrell PUBLISH PYUVVA@@cfp.recon.cx -PYUVVA Adapting Ghidra and its Decompiler to new languages en en 20260620T130000 20260620T150000 2.00000 Adapting Ghidra and its Decompiler to new languages Ghidra's decompiler is powerful, but it needs help with unfamiliar language runtimes. Common issues are a wall of unnamed functions, new string formats, opaque indirect calls through some kind of dynamic dispatch, or noise from reference counting. And the decompiler doesn't know what any of it means. This workshop teaches the basic toolbox for fixing that. Participants work through a series of modules, each targeting a specific failure mode of the decompiler and resolving it with a Ghidra script. Parsing metadata, to setup classes and layouts. Install call fixups to eliminate GC noise. Identify sources of type information, and feed it into the dataflow analysis. Analyze dataflow through P-Code to resolve virtual dispatch targets. Each module visibly improves the decompiler's output before moving to the next — and each builds on the results of the previous one. The emphasis is not on the specific runtime but on the tools and techniques that transfer: understanding _why_ the decompiler produces bad output, identifying what information it's missing, extracting that information from P-Code, and feeding it back through the right Ghidra APIs so the decompiler can do the heavy lifting. With LLMs it has become easy to generate Ghidra scripts, but you still need to know what to ask for — which API is the right one, what the decompiler actually needs, and where it expects the information to be. Prerequisites: Familiarity with Ghidra's UI and basic reverse engineering. No prior P-Code experience with needed. Bring a laptop with Ghidra 11+ and Java 21. Materials: https://github.com/fmagin/pcode-workshop/releases/tag/recon2026 PUBLIC CONFIRMED Workshop (2hrs) https://cfp.recon.cx/recon-2026/talk/PYUVVA/ Soprano A Florian Magin PUBLISH 3LERJG@@cfp.recon.cx -3LERJG MIPS Malware Reverse Engineering en en 20260620T160000 20260620T180000 2.00000 MIPS Malware Reverse Engineering Workshop outline (45 min lecture / 45 min lab / 30 min discussion of solutions): - MIPS architecture 101 and a brief history - The MIPS pipeline - Delay slots - Instruction categories - MIPS registers and their purpose - The MIPS stack - The O32 calling convention - Syscall calling convention and numbering - Function prologues/epilogues - Other MIPS architectures and their calling conventions, briefly - Hands on: AcidRain -- Challenge 1: Understand daemonization -- Challenge 2: Reconstruct wiping code flow PUBLIC CONFIRMED Workshop (2hrs) https://cfp.recon.cx/recon-2026/talk/3LERJG/ Soprano A Marion Marschalek PUBLISH SHYHKM@@cfp.recon.cx -SHYHKM Agentic Reverse Engineering: Building Custom AI "Skills" with Coding Agents en en 20260620T130000 20260620T160000 3.00000 Agentic Reverse Engineering: Building Custom AI "Skills" with Coding Agents # **Description** Agentic reverse engineering blends interactive reversing with autonomous agent workflows. Building on last year’s RECON workshop on MCP‑based Ghidra integration, this session introduces Agent Skills - structured bundles of instructions, scripts, and resources that coding agents can discover and execute. Skills introduce workflow capture and progressive disclosure, enabling agents to perform complex RE tasks with far less context overhead. **Sign up**: [Agentic RE Skills Workshop Recon 2026 Sign up](https://l.clearseclabs.com/agentic-re-skills-recon2026) Participants will learn how coding agents operate through iterative loops (generate → execute → inspect → refine) and how Skills plug directly into these loops to automate analysis. The workshop emphasizes practical application: attendees will build a multi‑platform driver‑analysis Skill that supports IOCTL enumeration, platform‑specific dispatch‑flow analysis (Windows IRPs, Linux file operations, macOS IOKit user‑client methods), code‑flow analysis, and reproducible workflow capture. --- # **Learning Objectives** By the end of this workshop, participants will be able to: - Understand the Agent Skills framework and how it extends MCP concepts - Build custom reverse‑engineering Skills using coding agents - Create interactive, agent‑driven workflows for multi‑platform driver analysis - Implement progressive disclosure to reduce context size and improve agent performance - Capture expert RE heuristics and encode them into reusable Skills - Integrate Skills with existing RE tools and workflows --- # **Outline** ### **1. Foundations of Agentic Reverse Engineering** - Skills framework vs. MCP - Coding agent capabilities (Claude Code, OpenCode, Mistral Vibe) - Environment setup - Workflow capture and progressive disclosure - How Skills integrate into agent loops ### **2. Skill Building: Architecture, Workflows, and Iteration** - Designing RE Skill architecture and folder structure - Implementing analysis workflows - Adding domain knowledge, heuristics, and resources - Designing structured output schemas - Testing and validating Skills - Improving agent performance and reducing unnecessary context ### **3. Hands‑On Build: Driver Analysis Skill** - Multi‑platform driver analysis: Windows `.sys`, macOS `.kext`, Linux modules - IOCTL enumeration and mapping - Dispatch‑flow analysis (IRPs, file ops, IOKit) - Code‑flow analysis using callgraphs and xrefs - Applying workflow capture in a real Skill - Scaffolding and integrating Skill components ### **4. Interactive RE with Agent Automation** - Combining manual reversing with agentic automation - Offloading repetitive tasks and validating hypotheses ### **5. Extending and Iterating Skills** - Adding workflows, tests, and examples - Integrating tutorials, blog posts, and prior research - Strategies for long‑term Skill evolution ### **6. Wrap‑Up** - Review of completed Skill - Next steps for building agentic RE automation --- # **Requirements** Participants must bring a laptop capable of running at least one of: - OpenCode: https://opencode.ai/docs/ - Claude Code: https://code.claude.com/docs/en/overview Additional requirements: - Ability to `git clone` workshop materials - Basic familiarity with reverse engineering concepts --- #### **Prior Work / References** - *Offensive Security Tool Development with Ghidra & MCP* (RECON 2025) - https://www.clearseclabs.com/blog/offensive-security-tool-development-with-ghidra-recon-2025 - *Supercharging Ghidra: Build Your Own Private Local LLM RE Stack* (Ringzer0 2025) - https://www.clearseclabs.com/blog/supercharging-ghidra-re-llms-ringzer0-countermeasure-2025 - Agent Skills specification [https://agentskills.io/home](https://agentskills.io/home) ### Target Audience This workshop is designed for: - Reverse engineers looking to automate their workflows - Security researchers interested in AI-assisted analysis - Tool developers wanting to understand agentic AI capabilities - Anyone who attended last year's MCP workshop and wants to explore the next evolution --- PUBLIC CONFIRMED Workshop (3hrs) https://cfp.recon.cx/recon-2026/talk/SHYHKM/ Soprano B John McIntosh PUBLISH PDEBQ8@@cfp.recon.cx -PDEBQ8 SmallWorld en en 20260621T100000 20260621T110000 1.00000 SmallWorld Dynamic analysis often breaks down precisely where it’s needed most: code that can’t be easily executed because its runtime environment is unknown or incomplete. SmallWorld is a framework built to close that gap. At the heart of the problem is the need for an execution environment — everything besides your code that it depends on to run, such as the operating system, system libraries, peripherals, or initial memory state. SmallWorld lets you construct that environment incrementally, specifying only what the code actually needs. By separating environment modeling from analysis tooling, it enables dynamic analysis of previously unreachable binary code in a tool-agnostic way. SmallWorld, furthermore, lets you run *just* the code you care about, starting execution arbitrarily deep in a binary and stubbing out or modeling functions or code snippets that you don't care to submit to analysis. The framework currently supports 13 ISAs and integrates with 5 dynamic analysis tools, making it practical for everything from reverse engineering to vulnerability research. It contains models for a healthy fraction of libc and POSIX. Further, SmallWorld's notion of the concrete state used to initialize an emulator prior to beginning execution works as a lingua franca, allowing one to move state between dynamic analysis worlds. You can start analyzing in Unicorn, transfer state at some point to angr for symbolic execution, and later return the state to pick up emulation in Unicorn, etc. In the first half of this talk, we’ll walk through the design and implementation of SmallWorld as well as explaining how it enables analyses that were previously infeasible. The second half of the talk will be demonstrations of salient use cases: harnessing and fuzzing of code from an embedded system, harnessing of firmware unpacking code let loose on a corpus of firmware downloads, and interactive type recovery of input parsing code. ISAs supported include: • aarch64 • amd64 • arm32 • i386 • la64 • m68k (coming soon) • mips32r2 • mips64r2 • msp430 • ppc32 • ppc64 • riscv64 • xtensa Supported Dynamic Analysis Tools: • Unicorn • angr • PANDA-ng • Ghidra • AFL++ SmallWorld is open source and available at https://github.com/smallworld-re/smallworld. PUBLIC CONFIRMED Talk https://cfp.recon.cx/recon-2026/talk/PDEBQ8/ Grand Salon Opera Andy William Janelle PUBLISH GG7SEM@@cfp.recon.cx -GG7SEM How real-world malware disables EDR systems en en 20260621T110000 20260621T120000 1.00000 How real-world malware disables EDR systems PUBLIC CONFIRMED Talk https://cfp.recon.cx/recon-2026/talk/GG7SEM/ Grand Salon Opera Holger Unterbrink PUBLISH KZCARU@@cfp.recon.cx -KZCARU Forgotten TEE keys in plain sight en en 20260621T130000 20260621T140000 1.00000 Forgotten TEE keys in plain sight For this research, we investigated the security behind the "device binding" encryption on Android, on a Mediatek phone where a trusted execution environment (TEE) is used for security. The talk is about how we reversed the Mediatek bootchain and the third party TEE (Trustonic's Kinibi, used on most Mediatek phones), but also Mediatek proprietary USB flashing protocol. This allowed us to establish exactly what the TEE uses as cryptographic root and what it does with it. This means that, from this root, we can cryptographically derive everything that needs a device binding in the TEE: flash decryption keys (metadata & FBE keys), PIN encryption mechanism and the Android Keystore. We still need to get this root, and we found out the following vulnerability: we can just ask the phone for all the data required to derive the cryptographic root with the Mediatek flashing protocol via USB, without any authentication. This impacts most Mediatek phones with a TEE. Now, we also need an initial read of the (encrypted) flash for getting the data, which we can always do the hard way by opening the phone and reading the flash with special tooling, or for some models we can find "download agents" (DAs) which are Mediatek flash software addons that can readback the flash (which is supposedly harmless since it is encrypted). Since we found a DA for our research phone, we were able to develop a PoC that, with only a USB access and a few minutes, is able to compute the cryptographic root, decrypt the flash, bruteforce the user PIN and access all the data of the phone. PUBLIC CONFIRMED Talk https://cfp.recon.cx/recon-2026/talk/KZCARU/ Grand Salon Opera Florent TARDIF PUBLISH LAWUEN@@cfp.recon.cx -LAWUEN IRON GIANT: When The Vault Becomes The Victim en en 20260621T140000 20260621T143000 0.03000 IRON GIANT: When The Vault Becomes The Victim First, we examine the Security Support Provider Interface (SSPI). Applications rely on SSPI for security features, such as authentication, and use the interface to send requests to the LSASS. This opens up a large attack surface for malicious applications and has been the source of several security vulnerabilities over the years. We will dissect the architecture of these providers and reveal several new memory corruption vulnerabilities. Second, we explore the risks of the LSASS acting as a client. Server applications often trigger outgoing connections in scenarios that are frequently overlooked. We will demonstrate how forcing a target server to connect to a malicious endpoint exposes the SSPI client handshake code to attack. The presentation will detail these connection triggers and unveil two new Denial of Service (DoS) bugs that allow unauthenticated attackers to exhaust server resources. Finally, we target the Remote Procedure Call (RPC) interfaces exposed within domain networks. While many of the RPC endpoints require authentication, several remain exposed to anonymous or unprivileged users. We will analyze these open interfaces and deep-dive into CVE-2025-33056, a logic vulnerability that allows unprivileged accounts to modify LSA database permissions. In summary, we will map the diverse vulnerability surface that the LSASS exposes in modern environments, covering five distinct findings: two local memory corruptions, two remote DoS primitives, and one reliable remote Elevation of Privilege. Ultimately, we demonstrate that even the most hardened process in Windows can still be toppled if you know exactly where to push. PUBLIC CONFIRMED Short Talk https://cfp.recon.cx/recon-2026/talk/LAWUEN/ Grand Salon Opera Erik Egsgard PUBLISH DZUQYU@@cfp.recon.cx -DZUQYU Putting the Genie Back in the Bottle: Agentic Reverse Engineering of Claude's Security Architecture en en 20260621T143000 20260621T153000 1.00000 Putting the Genie Back in the Bottle: Agentic Reverse Engineering of Claude's Security Architecture PUBLIC CONFIRMED Talk https://cfp.recon.cx/recon-2026/talk/DZUQYU/ Grand Salon Opera Todd Manning PUBLISH 3WVX3F@@cfp.recon.cx -3WVX3F Black-box deobfuscation: reverse engineering binaries with your eyes closed (or almost) en en 20260621T160000 20260621T163000 0.03000 Black-box deobfuscation: reverse engineering binaries with your eyes closed (or almost) This presentation is based on publications that are joint works with Grégoire Menguy (presenter), Sébastien Bardin, Vidal Attias, Nicolas Bellec, Jean-Yves Marion, Richard Bonichon and Cauim de Souza Lima. PUBLIC CONFIRMED Short Talk https://cfp.recon.cx/recon-2026/talk/3WVX3F/ Grand Salon Opera Grégoire Menguy PUBLISH SZE7UX@@cfp.recon.cx -SZE7UX Mixed Boolean-Arithmetic Obfuscation: What We Build, What We Break, and What We Can’t en en 20260621T163000 20260621T170000 0.03000 Mixed Boolean-Arithmetic Obfuscation: What We Build, What We Break, and What We Can’t PUBLIC CONFIRMED Short Talk https://cfp.recon.cx/recon-2026/talk/SZE7UX/ Grand Salon Opera Arnau Gàmez i Montolio PUBLISH DGELBZ@@cfp.recon.cx -DGELBZ Closing ceremony en en 20260621T170000 20260621T173000 0.03000 Closing ceremony PUBLIC CONFIRMED Short Talk https://cfp.recon.cx/recon-2026/talk/DGELBZ/ Grand Salon Opera PUBLISH U3DWWA@@cfp.recon.cx -U3DWWA Reversing Framework Mobile Applications with Open Source Tools en en 20260621T130000 20260621T160000 3.00000 Reversing Framework Mobile Applications with Open Source Tools Students attending this workshop should come prepared with a laptop (Linux, or Windows + WSL/Ubuntu) with the following tools installed: - A working terminal - Git - Ghidra - Blutter: https://github.com/worawit/blutter - il2cppdumper: https://github.com/Perfare/Il2CppDumper - ilspy/dnspy: https://github.com/dnSpy/dnSpy - Maybe Python if you're feeling scripty. PUBLIC CONFIRMED Workshop (3hrs) https://cfp.recon.cx/recon-2026/talk/U3DWWA/ Soprano A Nick Anderson, Roy Tu Roy Tu PUBLISH Y7Z98G@@cfp.recon.cx -Y7Z98G Orchestrating Chaos: Defeating Guloader's VEH and Obfuscation with Unicorn en en 20260621T130000 20260621T160000 3.00000 Orchestrating Chaos: Defeating Guloader's VEH and Obfuscation with Unicorn **Key Technical Deep-Dives:** * **The VEH Maze:** Bypassing exception-based control flow flattening. * Extracting secrets hidden via **Constant Unfolding** * **Emulation-Based Solution:** Using Python and Unicorn to automate the extraction of C2 and multiple encrypted strings from obfuscated DWORDS. * **Indirect Syscalls:** Identifying and neutralizing EDR-evasion techniques within shellcode. ## Workshop Focus * **Recent variants of real-world malware samples**: Unlike theoretical exercises, this workshop utilizes live, updated malware samples of **Guloader**. This immersive approach ensures that participants gain experience with the actual challenges posed by modern threats. * **Chained Attack Scenarios**: The workshop will simulate a multi-stage attack where **Guloader** acts as the initial entry vector, deploying and executing payload. This chained scenario highlights how different malware types collaborate in complex attacks, providing a holistic view of the threat landscape. * **Practical, Hands-On Experience**: The entire workshop is fundamentally practical. Attendees will actively engage in analyzing malware, utilizing industry-standard tools and techniques. This hands-on methodology fosters deep understanding and skill development. * **The ratio of presentation to hands-on training**: **90% hands-on** ## Workshop Outline 1. **Phase 1: Shellcode Extraction & Context Reconstruction** (10 min) * **Recon-Exclusive:** PowerShell obfuscation analysis is **removed**. Attendees are provided a de-obfuscated script solely to extract the shellcode. * **Vector Isolation:** Isolate the specific Windows callback and their parameters used for execution transfer to replicate the initial register state for the loader. 2. **Phase 2: Defeating Indirect Syscalls & Loader Internals** (30min) * **Heuristic Analysis:** Identifying and bypassing "Hell's Gate" and related indirect syscall techniques used to blind EDRs. * **Gadget Hunting:** Manually locating the "gadgets" the loader uses to construct syscalls, rather than relying on automated tool output. * **Opaque Predicates:** Analyzing and defeating the unpacking loops that guard the next-stage shellcode, preparing the binary for the core VEH analysis. Break (10 min) 3. **Phase 3: Windows Internals & The VEH State Machiner** (60 min) *This section represents the core "Delta" from previous workshops, focusing on undocumented Windows structures.* * **Manual Traversal of Windows 10 Structure:** Instead of relying on conventional debugger commands, participants will manually locate the registered Vector Exception Handler (VEH) function. This involves writing an IDA script to walk the undocumented `_LdrpVectorHandlerList` structure in memory and overcoming pointer encoding challenges. * **Reversing `AddVectoredExceptionHandler`:** A deep dive into the kernel32 implementation of exception registration to understand how Guloader hijacks this mechanism. * **Context Manipulation & RIP Hijacking:** Analyzing how the handler modifies the `PCONTEXT` structure (specifically `Eip`/`Rip`) to "skip" variable-length junk bytes and resume execution at dynamically calculated offsets. * **Anti-Debug Logic:** Decompiling the handler’s logic to see how it inspects Hardware Breakpoints (DR0-DR7) within the context record to detect analysis tools. Break (10 min) 4. **Phase 4: Advanced Emulation & Custom Instrumentation** (60 min) *Moving beyond "using Unicorn," this phase focuses on "fixing Unicorn" to handle hostile code.* * **Solving the Halting Problem:** Participants will write a custom Unicorn harness that handles `UC_MEM_READ_UNMAPPED` and `UC_HOOK_INTR` events to emulate the OS loader's exception dispatching behavior. * **Configuration Extraction:** Automating the decryption of non-contiguous strings and C2 configurations, effectively bypassing the need for a fully functional debugger. * **Optimization:** mitigating the performance penalties of Python-based emulation when handling millions of instructions. Detailed explanations and working solutions will be provided for all exercises to support attendees' learning. ## Take away from this workshop * **A Weaponized Emulation Harness:** Walk away with a robust, custom-built Python-Unicorn harness specifically engineered to bridge the gap between static emulation and dynamic Windows Exception Handling (VEH). You will own the code to simulate complex OS-level callbacks that standard emulators fail on. * **Automated Deobfuscation Logic:** Master the implementation of a custom hook management within Unicorn to trace, intercept, and defeat junk code and control-flow flattening without touching the debugger. * **Genericizing the Solution:** Learn how to transform a specific Guloader solution into a reusable methodology for defeating other exception-based obfuscators (like those found in modern Dridex or Ursnif variants) by leveraging purely emulated execution traces. ## What audience needs to bring to this workshop * Laptops that have at least **8GB RAM** and **100GB of free SSD space** * Due to EULA of various software. Each student is to set up a Windows 10 VM prior to the workshop. This VM has to contain the following tools: * Latest version of Visual Studio Code with Powershell extension (from Microsoft) * IDA Free 9.2+ (Note: All scripts utilized in this workshop have been strictly tested to work on IDA Pro and Free 9.2+). * Python 3.13 (x64) * Unicorn Framework python module ([https://www.unicorn-engine.org/](https://www.unicorn-engine.org/)) * SystemInformer (for dumping memory pages) * Decompiler will not be necessary for this workshop ## Target Audience * Mid to senior-level cybersecurity practitioners * Malware analysts, incident responders, threat hunters * Professionals seeking hands-on malware analysis skills ## Skills required * **Fluent x86/x64 Assembly:** Must be comfortable manually tracing control flow, stack operations, and register states without relying exclusively on decompilers (as the obfuscation renders Hex-Rays/Ghidra ineffective). * **Intermediate Python Scripting:** Ability to write functional scripts using external libraries. Familiarity with Python's `struct` module or memory mapping concepts is critical for the emulation phase. * **Windows Internals Fundamentals:** A conceptual understanding of how Windows handles exceptions (VEH/SEH), Context Records, and hardware breakpoints is highly recommended. * **IDA Pro Proficiency:** Standard navigation skills (following cross-references, patching bytes, defining code/data) are assumed. PUBLIC CONFIRMED Workshop (3hrs) https://cfp.recon.cx/recon-2026/talk/Y7Z98G/ Soprano B Mark Lim PUBLISH B7GUGA@@cfp.recon.cx -B7GUGA BNSQL/IDASQL/GhidraSQK hands on: Agentic and automatic reverse engineer en en 20260621T130000 20260621T160000 3.00000 BNSQL/IDASQL/GhidraSQK hands on: Agentic and automatic reverse engineer Why have to reverse engineer by hand anymore? It is now a waste of time to use any user interfaces? In this age and era, it is not important at all, just focus on prompting, work on your instruction files and custom skills. Join me in this hands on session on how to setup and configure the tool of your choice IDASQL (AI), BNSQL (Binary Ninja), or GhidraSQL (for Ghidra). I will teach you how to use these xSQL tools with your coding harness of choice. PUBLIC CONFIRMED Workshop (3hrs) https://cfp.recon.cx/recon-2026/talk/B7GUGA/ Soprano C Elias