New #TinyTracer (4.0) is ready: github.com/hasherezade/... - refactored for compatibility with the latest PIN - and with some new features!
Hexacorn
@hexacorn.bsky.social
Red Brain, Blue Fingers Malware Analysis, Reverse Engineering, Threat Hunting, Detection Engineering, DFIR, Security Research, Programming, Curiosities, Software Archaeology, Puzzles, Bad dad jokes https://www.hexacorn.com/blog/ hexacorn@infosec.exchange
I don't usually link Zitron, but this one is *important*. It isn't the tech that will derail this hypetrain; it's the money. www.wheresyoured.at/the-subprime...
The Subprime AI Crisis Is Here
Hi! If you like this piece and want to support my independent reporting and analysis, why not subscribe to my premium newsletter? It’s $70 a year, or $7 a month, and in return you get a weekly newsletter that’s usually anywhere from 5,000 to 18,000 words,
wheresyoured.at
@hexacorn.bsky.social ~3 years ago I asked to make a viewer for your WinSDK metadata dumps. Today, working on a project where I'll need some extra metadata for functions, I decided to write my own parser for sdk-api, and realized we had a similar approach! Full circle github.com/cristeigabri...
GitHub - cristeigabriela/sparse: Parse Microsoft' Windows SDK API documentation (MSDN) fast, and locally! Export to stable JSON format.
Parse Microsoft' Windows SDK API documentation (MSDN) fast, and locally! Export to stable JSON format. - cristeigabriela/sparse
github.com
me reading Bill Gates caught STD mov cx,640 mov si, offset src mov di, offsed dst std <-- Bill catching STD (should be CLD) rep movsb
Beyond good ol’ Run key, Part 154 www.hexacorn.com/blog/2026/01...
#BinYars (write #YARA-X rules inside of #BinaryNinja) is now available in Binja's plugin manager! I want to give a special shout out to @cxiao.net (Thank You 🙏) who provided valuable feedback making the plugin experience better. Happy rule writing! Learn more @ github.com/xorhex/BinYars
Random experiment to see if cheating in school could be stopped by designing math problems for children that AI will refuse to handle. Results are mixed.
less known way to calculate sha256 of files on Windows disksnapshot -c -k -v c:\test will print out file info including sha256 for every file in the directory
Just when you think you know your way around Linux.. binfmt_misc: Hold my beer. dfir.ch/posts/today_...
Today I learned: binfmt_misc | dfir.ch
Technical blog by Stephan Berger (@malmoeb)
dfir.ch
'One Battle After Another' and 'Frankenstein' brought my wife and I back to the cinema in recent weeks and it was totally worth it. Nothing beats the experience of a full immersion that only cinema can deliver. It helps that both movies are long.
China Domain Name Scammers target Hexacorn www.hexacorn.com/blog/2025/10...
1 little known secret of help.exe www.hexacorn.com/blog/2025/10...
1 little known secret of nslookup.exe, part 2 www.hexacorn.com/blog/2025/10...
1 little known secret of wsreset.exe www.hexacorn.com/blog/2025/10...
@sixtyvividtails.bsky.social any idea what fdwReason=5 stands for? you can find it inside verifier.dll / AVrfpMiniLoadAttach call - lots of LdrQueryImageFileKeyOption checks
Close your eyes and ✨imagine: From a low-integrity process (from LPAC even), you can inject your data anywhere you want: privileged tasks, PPL/protected processes, the OS kernel itself, and VTL1 trustlets. Now open your eyes. It is not hypothetical. It is the reality. Read it on page 33.
pagedout.institute ← we've just released Paged Out! zine Issue #7 pagedout.institute/download/Pag... ← direct link lulu.com/search?page=... ← prints for zine collectors pagedout.institute/download/Pag... ← issue wallpaper Enjoy! Please please please share to spread the news - thank you!
Using .LNK files as lolbins www.hexacorn.com/blog/2025/10...
Enter Sandbox 30: Static Analysis gone wrong www.hexacorn.com/blog/2025/09...
Beyond good ol’ Run key, Part 151 www.hexacorn.com/blog/2025/09...
DLL ForwardSideloading, Part 2 www.hexacorn.com/blog/2025/09...
DLL ForwardSideloading www.hexacorn.com/blog/2025/08... using forwarded DLL functions for sideloading purposes
Beyond good ol’ Run key, Part 150 www.hexacorn.com/blog/2025/08...