Tim Blazytko’s Blog

Large language models have already become useful helpers in reverse engineering: they can clean up decompiler output, suggest better function names, answer focused questions about unfamiliar code, and write small helper scripts.

During my presentation “Unveiling Secrets in Binaries using Code Detection Strategies” at REcon 2023 (slides, recording, code), I showcased heuristics how to navigate in unknown binaries in various reverse engineering settings, such as malware analysis, v…

Statistical analysis is a set of methods which analyze and organize data to discover its underlying structure.

Let’s say we see the following arithmetic expression: ((x ^ y) + (2 * (x & y))) + ((x ^ z) + (2 * (x & z))) What does it compute?

After I recently gave a workshop on the Analysis of Virtualization-based Obfuscation at r2con2021 (slides, code & samples and the recording are available online), I would like to use this blog post for a brief summary on how to write disassemblers for VM-…

In a previous blog post, we already discussed that it is valuable to know which code areas are obfuscated; those areas often guard sensitive code and are worth a closer look.

Automation plays a crucial rule in reverse engineering, no matter whether we search for vulnerabilities in software, analyze malware or remove obfuscated layers from code.

Following my last blog post, I got a lot of questions about additional material on control-flow analysis.

Commercial businesses and malware authors often use code obfuscation to protect specific code areas to impede reverse engineering.