On the 22nd and 23rd of September, I will be giving the first edition of my "Reverse engineering and looking for code reuse in malware with Ghidra" training at BruCON! If you are interested in Ghidra, automation, LLMs, and code reuse, this is for you! More information: www.brucon.org/training-det...

reverse-engineering-ghidra | BruCON

brucon.org

Its been two weeks since (my workshop at) @botconf.infosec.exchange.ap.brid.gy 2026, and last weekend I found some time to write about my experience: maxkersten.nl/2026/04/27/m...

Coming Tuesday, I'll give a workshop at @botconf.infosec.exchange.ap.brid.gy: Malware symbol recovery with Ghidra using Golang examples. Attendees will dive into real malware samples and learn how to recover missing symbols! If you are around, feel free to say hi!

Aside from updating my Java API libraries, I also wrote a new library for Abuse.ch's ThreatFox! You can find all information about it here: maxkersten.nl/projects/api...

Over the past years, as hobby projects, I made Java API libraries for Abuse.ch's Malware Bazaar and Yaraify, for RecordedFuture's Tria.ge, and for @malshare.com's API. Today, I updated all their updating dependencies, and I added some features! Find the repositories here: github.com/ThisIsLibra?...

ThisIsLibra - Repositories

Malware analyst and reverse engineer. Author of the Binary Analysis Course. - ThisIsLibra

github.com

Libra.setAge(Libra.getAge() + 1);

When I joined Trellix in June 2021, the only thing I knew was that I'd dig into malware and blog about it. That I did, over the past four and a bit years, I wrote 24 blogs. On average, that is just two months per blog! 1/2

Had a great time meeting friends old and new at summercamp nearly two weeks ago! I've shared my experience while representing Trellix here: maxkersten.nl/2025/08/18/m...

The workshop tickets for my Advanced Ghidra Scripting & Automation workshop at @defcon.bsky.social are live now: events.humanitix.com/dc33ws-n260-...

Ghidra, scripting, LLM, automagic automation. That should grab the attention for this thread. If you want to read the complete blog, you can do so here: www.trellix.com/blogs/resear... 1/n

This year's @botconf.infosec.exchange.ap.brid.gy edition was a great experience! I wrote about it in my most recent blog: maxkersten.nl/2025/05/27/m...

Tuesday's workshop @botconf.infosec.exchange.ap.brid.gy went well with very engaged and enthusiastic attendees!

Coming Tuesday I will represent Trellix at @botconf.infosec.exchange.ap.brid.gy in Angers with a four hour workshop on Ghidra automation!

Ghidra has multiple types of comments you can set, but when can you best use which comment? You'll find the explanation in my Ghidra tip of the month: maxkersten.nl/2025/04/15/g...

Two weeks ago, @re-verse.io happened! I wrote about my experience at the conference in my most recent blog: maxkersten.nl/2025/03/12/m...

What do you wear at @re-verse.io? A Ghidra tshirt and Hex Rays cap, with @psifertex.bsky.social rocking the Binary Ninja tshirt, hoodie, and cap!

This Friday, I will represent Trellix at @re-verse.io and I will talk about code reuse, attribution, and the dangers thereof. Looking forward to it, and to meet the Vector 35 folks! The full abstract can be found at: re-verse.sessionize.com/session/754398

My reverse engineering workflows survey is still ongoing! In less than 3 minutes, you can fill it in and help out: docs.google.com/forms/d/e/1F...

Reverse Engineering Survey

My name is Max 'Libra' Kersten and I'm a malware analyst. This survey will collect the answers you provide without the need for any personal information. The goal of this survey is to get a better und...

docs.google.com

Ever ran a script in Ghidra that you wanted to cancel, only to find out that the script would not let you? The TaskMonitor handles the cancellation event, December's Ghidra tip dives into the details: maxkersten.nl/2024/12/31/g...

Ghidra can do a lot, but some tasks are best outsourced to (micro)services! How? This month's tip helps you along: maxkersten.nl/2024/11/27/g...

Interested in technical malware analysis content and news? This is your (continuously updated) starter pack: go.bsky.app/BLY75TZ