#ReverseEngineering

Today's Tutorial [October 24, 2026]

Lesson 335: Hacking RISC-V Course (Chapter 3: Hello, World)

This chapter covers creating your first project in PlatformIO and creating your first Assembler file to interact with your C environment.

#STEM #Embedded #RISCV #ReverseEngineering

https://github.com/mytechnotalent/Reverse-Engineering

Well. A gloomy day and being let go is not a reason to skip #NakedDieFriday so without further ado!

Today's sample is SMM6037, a chip or rather assembly by Skyworks. I did not find a datasheet for this one, but it seems to be equivalent/related MMM6027 by Freescale. The chip itself came from an e-waste pile on a mangled board, which likely was a Motorola branded phone but impossible to tell which one.

🧵

#electronics #reverseengineering

Todays Tutorial [October 23, 2026]

Lesson 334: Hacking RISC-V Course (Chapter 2: Setup Environment)

This chapter covers setting up your development environment including everything you need to purchase and download including setup.

#STEM #Embedded #RISCV #ReverseEngineering

https://github.com/mytechnotalent/Reverse-Engineering

Todays Tutorial [October 22, 2026]

Lesson 333: Hacking RISC-V Course (Chapter 1: Why RISC-V)

This chapter covers the why of learning RISC-V hacking as we discuss the rise of RISC-V and introduce our ESP32-C3 dev board.

#STEM #Embedded #RISCV #ReverseEngineering

https://github.com/mytechnotalent/Reverse-Engineering

Hi! Welcome a new Pwndbg release: 2026.10.22 !

We now support m86k arch, unknown archs, have better C++ support, added tutorials (https://pwndbg.re/dev/tutorials/debugging-cxx/, https://pwndbg.re/dev/tutorials/mangling/, https://pwndbg.re/dev/tutorials/pretty-printing/), `nearpc -o` shows opcode bytes, we have `libcinfo` for Android Bionic libc information, we added Objective-C class inspection commands (`objc show-class` and `objc list-classes`), improved `regs` command (`regs xmm0` and `regs eflags`), have better glibc discovery, added Linux kernel 7+ SLUB sheaf and barn inspection, added `setrlimit` command, improved LLDB support and more (like bug fixes)!

See https://github.com/pwndbg/pwndbg/releases/tag/2026.10.22

Please sponsor us at https://github.com/sponsors/pwndbg !

Thanks to everyone who made it possible!

#pwndbg #gdb #lldb #debugging #security #infosec #pwn #reverseengineering #linux

A petition for the reverse engineering folks: Please do something cool with the abandoned Pix4Dcapture app. There are a bunch of "old" drone models that can't be used anymore for photogrammetry due to Pix4D discontinuing the app (My Parrot Anafi being one of those). It will be great to have a FOSS desktop flight planning software that works with a bunch of drones models other than the DJI ones. #drones #reverseEngineering

Todays Tutorial [October 21, 2026]

Lesson 332: Hacking Bits Course (Chapter 10: STUXNET)

This chapter covers the development and reverse engineering of an servo motor in C including a mock STUXNET hack.

#STEM #Embedded #AVR #ReverseEngineering

https://github.com/mytechnotalent/Reverse-Engineering

----------------

🛠️ Tool: REA (Reverse Engineer Anything)
===================

Overview

REA is an MIT-licensed MCP server, distributed as the rea-agents package on npm, that exposes a reverse engineering toolset to any MCP-capable agent. The framing in the morluto/rea README is direct: inspect native binaries, JavaScript and Electron applications, .NET assemblies, and websites without their source code, and get explanations that carry supporting evidence and stated limitations rather than bare model summaries.

Key features
• One MCP surface across several target types: native binaries, JavaScript and Electron apps, .NET assemblies, websites
• Native analysis can build on an existing Hopper or Ghidra installation, instead of shipping yet another disassembly pipeline
• The same tools stay usable directly from the terminal, so agent access is optional, not mandatory
• Analysis runs locally; conclusions ship with their evidence and limitations, which is the right counterweight to overconfident agent output
• A generated tool catalog is published in the repository docs (mcp-contracts.md), so the exact tool surface an agent will see can be reviewed before wiring it up

Technical notes

The npm distribution and Node.js requirements suggest a standard Node-based MCP server. Setup registers REA with the agent and installs matching workflow instructions. The screenshots show an analysis bridge launching inside Hopper while it inspects a native binary, which implies the server drives the installed tooling rather than replacing it. The exact bridge mechanics, supported agent clients, and per-tool contracts remain unverified; the contracts document is where that check should start.

Use cases
• Feature archaeology: the flagship scenario from the README, ask the agent how another application implements a feature, get a documented, evidence-backed explanation. Worth noting that rebuilding a proprietary feature lives in uncertain legal territory.
• Triage support for unknown files when static analysis with receipts matters more than a quick verdict
• Terminal-only use for scripted pipelines where an agent adds nothing

Limitations
• Claims come from the project README only; nothing here has been independently tested
• Capability depth depends on which underlying tools are installed and licensed, particularly for native analysis
• The README is polished and badge-heavy, so treat the published tool contracts, not the landing page, as the source of truth for what the server actually exposes
• One sensible warning is included: fetch REA only from the official repository, the rea.tools website, or the rea-agents npm package, since lookalike repository names or copied readmes do not make a download official. For anything plugged into an agent, that is a baseline requirement, not paranoia.

References

Repository: morluto/rea. Website: rea.tools. Package: rea-agents on npm. Tool contracts: docs/mcp-contracts.md in the repository.

🔹 tool #MCP #ReverseEngineering #BinaryAnalysis #Ghidra

🔗 Source: https://github.com/morluto/rea

I’ve published an independent technical investigation into Hirudo, an Android banking RAT, focusing on its Indonesian banking-app replacement workflow, recovered APK artifacts, and associated infrastructure. This independent investigation was inspired by the research published by ThreatFabric. Motivated by their findings, I conducted a separate static reverse-engineering investigation focusing on Indonesian banking-app replacement artifacts, MQTT-based RAT communications, and additional infrastructure indicators. Sharing these findings with the cybersecurity community Cyber Defense Indonesia & Surabaya Hacker Link, to contribute to technical knowledge-sharing and further research into Android banking malware.

LINK:https://jeffanzos.medium.com/reverse-engineering-hirudo-indonesian-banking-targets-apk-replacement-and-rat-infrastructure-2b2890f0e4ca

Findings include: Banking app replacement (Recovered samples) associated with m-BCA, myBCA, BNI, BRI, BTN, Livin, JakOne, and BSI.

RAT infrastructure: Hardcoded C2 references and MQTT broker configurations recovered from DEX code, including 134[.]122.153[.]8:18085 and 134[.]122.153[.]8:1884.

APK internals: Hooking-engine artifacts, shared trigger-file mechanisms, certificate-substitution evidence, and embedded development paths.

Infrastructure pivots: Additional API endpoints, APK-processing panels, and certificate/DNS correlations for further investigation. The analysis is based primarily on static reverse engineering and supporting OSINT evidence. Live infrastructure behavior, several suspected relationships, and threat-actor attribution remain unverified. The objective is to document reproducible technical evidence and provide additional pivots for malware researchers, threat hunters, and incident responders.

#CyberSecurity #ThreatIntelligence #MalwareAnalysis #ReverseEngineering #DFIR #ThreatHunting #AndroidSecurity #DigitalForensics #InfoSec #InformationSecurity #CyberDefense #FinancialSecurity

Exploiting Reversing (ER) Series | Article 11: Windows: Missing Bounds in the Print Spooler.

The article has 60 pages, free. A user-mode target this time instead of a kernel one, worked end to end: from a missing bound check to a SYSTEM shell, with the service still running afterwards.

Published on:

https://www.blackstormsecurity.com/research/

What it covers:

[+] The bug: a heap overflow (CWE-122) in the Print Spoolers form-enumeration path, reachedthrough InternalEnumForms → CopyIniFormToFormInfo → PackStrings → memcpy.

[+] It is still unpatched. I submitted it to Microsoft in March 2026 and MSRC assessed it as below the bar for immediate servicing, because the PoC requires administrative rights. Re-confirmed working in October against current mainstream and Canary builds.

[+] The exploitation, which is two thirds of the article, with four stages: groom, corrupt, control, execute. The process never crashes: spoolsv.exe is left running and the planted form deleted.

[+] Important note: I had already notified the MSRC months ago that I would write an article about the vulnerability and publish it.

This article will be published on https://exploitreversing.com/ next week.

Hope you enjoy the read!

#Windows #PrintSpooler #VulnerabilityResearch #ExploitDevelopment #ReverseEngineering #HeapExploitation

Has anyone used a decent foundation model to do that whole decompiling thing everybody's into on those Flock bits that were brought down by the Department of Secrets or whatever they are called? It seems like that would be a useful endeavor. If no one has done it, I will.

#flock #reverseengineering

Todays Tutorial [October 20, 2026]

Lesson 331: Hacking Bits Course (Chapter 9: IO Driver in C)

This chapter covers the development and reverse engineering of an IO driver in C.

#STEM #Embedded #AVR #ReverseEngineering

https://github.com/mytechnotalent/Reverse-Engineering