Tim Blazytko
@mrphrazer.bsky.social
Binary Security Researcher & Trainer Website: https://synthesis.to
Thanks to VMRay for hosting today's webinar on agentic malware analysis! We covered tool-driven RE workflows, local LLMs, guardrails, validation, and more. Thanks for all the great questions! Recording: www.youtube.com/watch?v=xGJj... Slides: synthesis.to/presentation...
Agentic Malware Analysis: From Assistance to Automated Investigation
YouTube video by VMRay
youtube.com
Back in North America for a second training this year! 🥳 I'll be teaching "Software Deobfuscation Techniques for Automated and Agentic Reverse Engineering" at CanSecWest in Vancouver, September 26–29. www.secwest.net/csw26-dojos/...
Software Deobfuscation Techniques for Automated and Agentic Reverse Engineering by Tim Blazytko — secwest.net - secure virtual engagement
Software Deobfuscation Techniques for Automated and Agentic Reverse Engineering by Tim Blazytko at CanSecWest 2026 in Vancouver.
secwest.net
New Binary Cartography episode: Pinpointing Interesting Code in Binaries We cover heuristics for protocols, crypto routines, library functions, RC4, decryption loops -- and how these signals guide agents youtu.be/HQA3U5MnD5U Slides & samples: github.com/mrphrazer/bi...
Pinpointing Interesting Code in Binaries: Heuristics, Statistics, and Agents
YouTube video by Tim Blazytko
youtu.be
The new version of my #BinaryNinja plugin Obfuscation Detection now supports function tagging. This guides agents toward interesting functions such as protocol dispatchers or symmetric crypto. github.com/mrphrazer/ob... I've also released a Ghidra fork: github.com/mrphrazer/ob...
Premiering at this year's @hexacon.bsky.social: my reworked Software Deobfuscation Techniques training. It now combines deep technical know-how with agentic workflows to automate large-scale deobfuscation. www.hexacon.fr/trainer/soft...
The slides from our @reconmtl.bsky.social talk with @nicolo.dev on agentic deobfuscation are now online. Topics: commercial VMs, anti-cheat, DRM systems, malware, and anti-agentic obfuscation. Slides: synthesis.to/presentation...
Just finished my class on agentic deobfuscation at @reconmtl.bsky.social . Tomorrow, @nicolo.dev and I will continue the story with results from applying agentic RE workflows to SOTA software protections.
June 19, 3pm at @reconmtl.bsky.social : VMProtect, anti-cheats, DRM — how much of today's obfuscation survives agentic reverse engineering? Find out in our talk with @nicolo.dev : "Deobfuscation in the Age of Agentic Reverse Engineering" cfp.recon.cx/recon-2026/t...
Deobfuscation in the Age of Agentic Reverse Engineering Recon 2026
Agentic workflows are rapidly changing how we reverse engineer binaries. Large language models are no longer limited to explaining decompiler output or writing small helper scripts; when paired with real tooling, they can drive analysis, orchestrate workflows, and connect multiple analysis layers faster and at a larger scale than a human analyst alone. In this talk, we explore what this shift means for code deobfuscation, from deflattening, opaque-predicate removal, and string recovery to interprocedural and whole-program deobfuscation. We argue that the key advance is not that models suddenly understand obfuscated code perfectly, but that they can now coordinate the broader workflow around deobfuscation. We conclude by examining what kinds of obfuscation may remain resilient in the face of increasingly agentic reverse engineering.
cfp.recon.cx
The recording of my second Binary Cartography webinar is public: Agentic Malware Analysis: From Task Automation to Deep Analysis Topics: string decryption, API hashing, unpacking & pipeline building Recording: youtu.be/azej1P17w9E Slides & samples: github.com/mrphrazer/bi...
Agentic Malware Analysis: From Task Automation to Deep Analysis
YouTube video by Tim Blazytko
youtu.be
Talk w/ @nicolo.dev at @reconmtl.bsky.social : Deobfuscation in the Age of Agentic Reverse Engineering From control-flow cleanup to interprocedural analysis—and why human reasoning still matters. Details: cfp.recon.cx/recon-2026/t... Additional training on deobfuscation: recon.cx/2026/en/trai...
Thanks to @elykdeer.bsky.social and the @binary.ninja team for having me on the AI vs AI Binary Ninja stream. Great discussion on agentic RE, tooling, and feedback loops. www.youtube.com/watch?v=TBqB...
AI vs AI - Binary Ninja Live Stream
YouTube video by VECTOR 35
youtube.com
This Thursday I'm joining @binary.ninja's live to put LLM-powered reverse-engineering workflows head-to-head. We compare Binja's client-side LLM integrations vs. fully headless agents Expect practical workflow comparisons, lots of fun, and a bit of chaos.
Binary Ninja@binary.ninja · 4mo agoJoin @mrphrazer.bsky.social with us on Thursday @4pm ET to pit AI versus AI! We'll be comparing LLM options for both assisted and fully-automatic reverse engineering, including different CLIs, MCPs, plugins, and agents. Don't miss reversing's biggest battle yet: www.youtube.com/live/TBqBpaq...
The recording of my first Binary Cartography webinar is now public: Agentic Reverse Engineering: How AI Agents Are Changing Binary Analysis Topics: keygenning, cracking & anti-tamper removal Recording: www.youtube.com/watch?v=DZcD... Slides/code/samples: github.com/mrphrazer/bi...
Agentic Reverse Engineering: How AI Agents Are Changing Binary Analysis
YouTube video by mr_phrazer
youtube.com
Agentic reverse engineering can do a lot, but obfuscation still breaks many analysis workflows in malware and commercial software. If you want to learn how to build & steer automation for analyzing protected code, check out my training at @reconmtl.bsky.social : recon.cx/2026/en/trai...
Software Deobfuscation Techniques - REcon 2026 Training
4-day code deobfuscation training. Master VM-based obfuscation analysis, symbolic execution, SMT solving, and program synthesis.
recon.cx
Tim Blazytko@mrphrazer.bsky.social · 6mo agoHappy to bring my Software Deobfuscation Techniques training back to @reconmtl.bsky.social - June 15–18, 2026 in Montreal! Learn systematic approaches to defeating modern obfuscation found in DRM/anti-tamper & APT malware. recon.cx/2026/en/trai...
New blog post: Building a Pipeline for Agentic Malware Analysis Agentic RE + malware analysis with custom skills, MCP tooling, and persistent case state to automate intial triage Link: synthesis.to/2026/03/18/a... Github: github.com/mrphrazer/ag...
I also published my Ghidra Headless MCP that follows similar design principles: github.com/mrphrazer/gh...
GitHub - mrphrazer/ghidra-headless-mcp: Headless Ghidra MCP server — giving AI agents deep reverse-engineering capabilities.
Headless Ghidra MCP server — giving AI agents deep reverse-engineering capabilities. - mrphrazer/ghidra-headless-mcp
github.com
Tim Blazytko@mrphrazer.bsky.social · 5mo agoRecently my RE workflow moved into sandboxed VMs where agents have full control over the environment. I needed an MCP server that runs headless in the same sandbox and exposes way more of the #BinaryNinja API than others. Here's the release: github.com/mrphrazer/bi...
Recently my RE workflow moved into sandboxed VMs where agents have full control over the environment. I needed an MCP server that runs headless in the same sandbox and exposes way more of the #BinaryNinja API than others. Here's the release: github.com/mrphrazer/bi...
GitHub - mrphrazer/binary-ninja-headless-mcp: Headless Binary Ninja MCP server — giving AI agents deep reverse-engineering capabilities via 180 tools.
Headless Binary Ninja MCP server — giving AI agents deep reverse-engineering capabilities via 180 tools. - mrphrazer/binary-ninja-headless-mcp
github.com
New chapter: I've transitioned to a part-time Chief Scientist role at @emproofsecurity.bsky.social . I’m shifting my focus to my independent work in reverse engineering: trainings • consulting • tooling • research Details: synthesis.to
Happy to bring my Software Deobfuscation Techniques training back to @reconmtl.bsky.social - June 15–18, 2026 in Montreal! Learn systematic approaches to defeating modern obfuscation found in DRM/anti-tamper & APT malware. recon.cx/2026/en/trai...
Happy to share that later today (Friday, Nov 14, at 10:00 PM CET / 16:00 ET), I’ll be live on the #BinaryNinja livestream to talk about (anti-)reverse engineering & code (de)obfuscation. I'll also showcase some of my plugins. www.youtube.com/watch?v=GQtX...
Binary Ninja Live Stream: Nov 14th, 2025
YouTube video by VECTOR 35
youtube.com
Impressive reverse engineering kung fu against widevine L3 by Felipe (x.com/_localo_) ! #hacklu Cc @mrphrazer.bsky.social
localo (@_localo_) / X
localo (@_localo_) / X
x.com
Neodyme@neodyme.io · 10mo agoCheck out our new blog post on a research-driven look at software-only DRM. Explore how the Qiling emulation framework can be used to analyze Widevine and how Differential Fault Analysis (DFA) and emulation aid de-obfuscation. ▶️ Read more: neodyme.io/en/blog/wide...
The recording of our (CC @nicolo.dev ) talk "Breaking Mixed Boolean-Arithmetic Obfuscation in Real-World Applications" at @reconmtl.bsky.social is now online! Recording: www.youtube.com/watch?v=QxSG... Slides: synthesis.to/presentation... #BinaryNinja Plugin: github.com/mrphrazer/ob...
Recon 2025 - Breaking Mixed Boolean-Arithmetic Obfuscation in Real-World Applications
YouTube video by Recon Conference
youtube.com
The new version of my #BinaryNinja plugin Obfuscation Analysis (v1.2) adds recursive function inlining in the decompiler. It collapses call-heavy code into a single function; analysis, constant propagation, DCE and other analyses work across boundaries. github.com/mrphrazer/ob...
We at @emproofsecurity.bsky.social open-sourced a free firmware reverse engineering workshop for self-study. Topics: ELF analysis, cracking, malware triage, embedded-Linux, bare-metal, crypto-key extraction, anti-analysis. Docker setup and solutions included. github.com/emproof-com/...
GitHub - emproof-com/workshop_firmware_reverse_engineering: Workshop on firmware reverse engineering
Workshop on firmware reverse engineering. Contribute to emproof-com/workshop_firmware_reverse_engineering development by creating an account on GitHub.
github.com
Reminder: If you’re interested in learning how to analyze and deal with obfuscated code, you’re welcome to join my training at @hexacon.bsky.social from October 6-9. You can still register here: www.hexacon.fr/trainer/blaz...
Hexacon - Software Deobfuscation Techniques
Offensive security conference organized by seasoned professionals, in the heart of Paris. 10-11th October 2025, save the date!
hexacon.fr
Tim Blazytko@mrphrazer.bsky.social · last yr.Excited to teach my class on software deobfuscation in Paris at @hexacon.bsky.social , Oct 6–9, 2025! Learn advanced techniques to defeat state-of-the-art obfuscation in DRMs & APT malware. www.hexacon.fr/trainer/blaz...
Based on research by @mrphrazer.bsky.social and @mu00d8.bsky.social, presented at RECon 2024, I used graph theory code from Ghidra's codebase to select the order in which functions are sent to the LLM, ensuring as much context as possible is retained. The script is aptly named GhidrAI! 5/n
The slides from our @reconmtl.bsky.social talk, "Breaking Mixed Boolean-Arithmetic Obfuscation in Real-World Applications" (CC @nicolo.dev ), are now online! Slides: synthesis.to/presentation... Plugin: github.com/mrphrazer/ob...
Tomorrow at 3:30 pm, @nicolo.dev and I will present our talk “Breaking Mixed Boolean-Arithmetic Obfuscation in Real-World Applications” at @reconmtl.bsky.social ! Details: cfp.recon.cx/recon-2025/t... Plugin release: github.com/mrphrazer/ob...
Breaking Mixed Boolean-Arithmetic Obfuscation in Real-World Applications Recon 2025
From gaming anti-cheat and DRM solutions to malware, Mixed Boolean-Arithmetic (MBA) obfuscation hides critical computations behind intricate Boolean and arithmetic transformations. In this talk, we de...
cfp.recon.cx
Reminder: If you’re interested in code deobfuscation, you’re welcome to join my training at @reconmtl.bsky.social Montréal from June 24-27. You can still register here: recon.cx/2025/trainin...
Recon Training - Software Deobfuscation Techniques by Tim Blazytko
REcon # Montreal Security Conference # Reverse Engineering Training
recon.cx
Tim Blazytko@mrphrazer.bsky.social · last yr.My class on code deobfuscation at REcon Montreal (June 24-27) is now open for registration! Learn how to analyze obfuscated code and break it by writing custom tools using symbolic execution, SMT solving, and program synthesis. Details & Register: recon.cx/2025/trainin...
Honored to join @jstrosch.bsky.social on his podcast "Behind the Binary"! We discussed my RE journey, identifying & analyzing obfuscated code, software protection in industry vs malware, the dynamic between building & breaking protections, and others. open.spotify.com/episode/7yJB...
Josh Stroschein | The Cyber Yeti@jstrosch.bsky.social · last yr.🔒 Ever wonder how software stays secure? On Behind the Binary, Tim Blazytko, Chief Scientist at Emproof, explores code obfuscation, anti-reverse engineering, and modern defense strategies. Discover the challenges, trade-offs, and defender's mindset! 🎧 open.spotify.com/episode/7yJB...