The slides from our @reconmtl.bsky.social talk with @nicolo.dev on agentic deobfuscation are now online. Topics: commercial VMs, anti-cheat, DRM systems, malware, and anti-agentic obfuscation. Slides: synthesis.to/presentation...
Nicolò Altamura
@nicolo.dev
Reverse Engineer focused on decompilation, disassembly, and software internals. Website: https://nicolo.dev/en/
June 19, 3pm at @reconmtl.bsky.social : VMProtect, anti-cheats, DRM — how much of today's obfuscation survives agentic reverse engineering? Find out in our talk with @nicolo.dev : "Deobfuscation in the Age of Agentic Reverse Engineering" cfp.recon.cx/recon-2026/t...
Deobfuscation in the Age of Agentic Reverse Engineering Recon 2026
Agentic workflows are rapidly changing how we reverse engineer binaries. Large language models are no longer limited to explaining decompiler output or writing small helper scripts; when paired with real tooling, they can drive analysis, orchestrate workflows, and connect multiple analysis layers faster and at a larger scale than a human analyst alone. In this talk, we explore what this shift means for code deobfuscation, from deflattening, opaque-predicate removal, and string recovery to interprocedural and whole-program deobfuscation. We argue that the key advance is not that models suddenly understand obfuscated code perfectly, but that they can now coordinate the broader workflow around deobfuscation. We conclude by examining what kinds of obfuscation may remain resilient in the face of increasingly agentic reverse engineering.
cfp.recon.cx
Join us at REcon 2026 for a deep dive into deobfuscation! @mrphrazer.bsky.social and I will share some insights on the evolving landscape. Stay tuned!
Tim Blazytko@mrphrazer.bsky.social · 3mo agoTalk w/ @nicolo.dev at @reconmtl.bsky.social : Deobfuscation in the Age of Agentic Reverse Engineering From control-flow cleanup to interprocedural analysis—and why human reasoning still matters. Details: cfp.recon.cx/recon-2026/t... Additional training on deobfuscation: recon.cx/2026/en/trai...
The recording of my talk "Challenges in Decompilation and Reverse Engineering of CUDA-based Kernels" at @re-verse.io is now online! Recording: www.youtube.com/watch?v=ns5j... Slides: nicolo.dev/files/pdf/re... Binary Ninja plugin: github.com/seekbytes/pt...
GitHub - seekbytes/ptxNinja: Binary Ninja plugin for reverse engineering PTX -- the virtual instruction set architecture of CUDA-based GPUs.
Binary Ninja plugin for reverse engineering PTX -- the virtual instruction set architecture of CUDA-based GPUs. - seekbytes/ptxNinja
github.com
The slides from my @re-verse.io talk, "Challenges in Decompilation and Reverse Engineering of CUDA-based Kernels", are now online! Slides: nicolo.dev/files/pdf/re... Plugin: github.com/seekbytes/pt...
Disassembly algorithms are often a trade-off. My new blog post analyzes linear sweep and recursive traversal, exploring their strengths and weaknesses in a self-built disassemblers. nicolo.dev/en/blog/disa...
Disassembling a binary: linear sweep and recursive traversal
Building your own set of analysis tools is a great exercise for those who already have some basics and allows you to later move on to implement more targeted analyses in reverse engineering. Even just...
nicolo.dev
I’ll be speaking at RE//verse 2026 about reverse engineering CUDA-based kernels. Don’t miss the opportunity to learn more about CUDA and challenges for decompilation!
RE//verse@re-verse.io · 7mo agoNicolò Altamura digs into decompiling CUDA kernels at RE//verse 2026! He takes a look at how GPU execution and NVIDIA’s IRs change the usual assumptions for decompilers and shows early work on a Binary Ninja PTX plugin aimed at real CUDA reversing. Don't miss out: shop.binary.ninja/collections/...
It was a great honor to share the stage with Tim to present MBA deobfuscation using our powerful BinaryNinja plugin. An incredible experience at REcon 2025 — thank you to everyone who made it unforgettable! Check out the recording!
Tim Blazytko@mrphrazer.bsky.social · 10mo agoThe recording of our (CC @nicolo.dev ) talk "Breaking Mixed Boolean-Arithmetic Obfuscation in Real-World Applications" at @reconmtl.bsky.social is now online! Recording: www.youtube.com/watch?v=QxSG... Slides: synthesis.to/presentation... #BinaryNinja Plugin: github.com/mrphrazer/ob...
We just presented our new Binary Ninja plugin for deobfuscation of Mixed Boolean Arithmetic expressions at REcon25. Check it out!
Tim Blazytko@mrphrazer.bsky.social · last yr.The slides from our @reconmtl.bsky.social talk, "Breaking Mixed Boolean-Arithmetic Obfuscation in Real-World Applications" (CC @nicolo.dev ), are now online! Slides: synthesis.to/presentation... Plugin: github.com/mrphrazer/ob...
We just presented our new Binary Ninja plugin for deobfuscation of Mixed Boolean Arithmetic expressions at REcon25. Check it out!
Tim Blazytko@mrphrazer.bsky.social · last yr.The slides from our @reconmtl.bsky.social talk, "Breaking Mixed Boolean-Arithmetic Obfuscation in Real-World Applications" (CC @nicolo.dev ), are now online! Slides: synthesis.to/presentation... Plugin: github.com/mrphrazer/ob...
Control Flow Graph is a critical element for any binary analysis framework, but its role has been underestimated sometimes (I'm looking at you, Ghidra!). nicolo.dev/en/blog/role...
The Role of the Control Flow Graph in Static Analysis
The flow control graph is an important building block in static program analysis for applying a variety of analyses that consider the flow of a program. The “flow”, described informally, represents the evolution of the program during execution time, that is, at which the CPU jumps in order to continue program execution. The graph (also called CFG for brevity) allows the first high-level elements of software to be derived in a general way from a low- or medium-level representation (we cite as an example assembly code or intermediate code). High-level elements include high-level loops (while or for loops) and execution branches (switch, if, else) that can be critical in identifying how execution evolves over time.
nicolo.dev
New #BinaryNinja plugin: Obfuscation Analysis Simplifies arithmetic obfuscation (MBA) directly in the decompiler (see demo below). Also identifies functions with corrupted disassembly. Co-authored by @nicolo.dev; available in the plugin manager. github.com/mrphrazer/ob...
Excited to announce that together with Tim Blazytko, our talk has been accepted to REcon 2025! Don't miss this opportunity to learn how to break Mixed Boolean Arithmetic expressions :)
Tim Blazytko@mrphrazer.bsky.social · last yr.At @reconmtl.bsky.social, @nicolo.dev and I discuss the current state of MBA (de)obfuscation and their applications. We’ll also introduce a new #BinaryNinja plugin for simplifying MBAs in the decompiler. Details: cfp.recon.cx/recon-2025/f... I'll also give a training: recon.cx/2025/trainin...
Excited to announce that together with Tim Blazytko, our talk has been accepted to REcon 2025! Don't miss this opportunity to learn how to break Mixed Boolean Arithmetic expressions :)
Tim Blazytko@mrphrazer.bsky.social · last yr.At @reconmtl.bsky.social, @nicolo.dev and I discuss the current state of MBA (de)obfuscation and their applications. We’ll also introduce a new #BinaryNinja plugin for simplifying MBAs in the decompiler. Details: cfp.recon.cx/recon-2025/f... I'll also give a training: recon.cx/2025/trainin...
At @reconmtl.bsky.social, @nicolo.dev and I discuss the current state of MBA (de)obfuscation and their applications. We’ll also introduce a new #BinaryNinja plugin for simplifying MBAs in the decompiler. Details: cfp.recon.cx/recon-2025/f... I'll also give a training: recon.cx/2025/trainin...
Control Flow Graph is a critical element for any binary analysis framework, but its role has been underestimated sometimes (I'm looking at you, Ghidra!). nicolo.dev/en/blog/role...
The Role of the Control Flow Graph in Static Analysis
The flow control graph is an important building block in static program analysis for applying a variety of analyses that consider the flow of a program. The “flow”, described informally, represents the evolution of the program during execution time, that is, at which the CPU jumps in order to continue program execution. The graph (also called CFG for brevity) allows the first high-level elements of software to be derived in a general way from a low- or medium-level representation (we cite as an example assembly code or intermediate code). High-level elements include high-level loops (while or for loops) and execution branches (switch, if, else) that can be critical in identifying how execution evolves over time.
nicolo.dev
Disassembly algorithms are often a trade-off. My new blog post analyzes linear sweep and recursive traversal, exploring their strengths and weaknesses in a self-built disassemblers. nicolo.dev/en/blog/disa...
Disassembling a binary: linear sweep and recursive traversal
Building your own set of analysis tools is a great exercise for those who already have some basics and allows you to later move on to implement more targeted analyses in reverse engineering. Even just...
nicolo.dev