Software security antagonist. Currently hacking LLVM for pasta. @slazzarone@infosec.exchange
France
Joined April 2015
- Tweets121
- Following775
- Followers84
- Likes2.2K
Salvatore Lazzarone retweeted
x86 formal verification is coming!
The (first?) published machine-checked proof of a security property for the end-to-end execution of a Linux process running an x86 binary statically linked against glibc.
And we believe it scales!
A joint research project with @zellic_io 🧵👇
Salvatore Lazzarone retweeted
Unthemidator - a fully autonomous Themida / Code Virtualizer / Win License unpacker. Supports Themida/CV/WL v3.0 - v3.2.6.0 (latest), and CV v4.0. Unthemidator unpacks binaries, recovers imports, finds original entry point and unpacks compressed virtual machines too:
github.com/x86rc/unthemidato…
Salvatore Lazzarone retweeted
If you're on MacOS 27.0.1 and make a fresh Apple ID. You can now decrypt IPAs on MacOS and after a one-time enrollment also on Linux or Windows if needed. github.com/drwhax/ipatool more builds will be supported soon. No jailbreak needed.
Salvatore Lazzarone retweeted
"Security Through Obscurity Is Dead and LLMs Killed It."
@moyix's @UnpromptedAU talk: a cat pic you can’t photocopy and an emulated HP printer that "runs out" of toner. Send this to your friends and coworkers who think their secrets are safe inside a compiled binary:
unprompted.au/videos/securit…
![Security Through Obscurity Is Dead and LLMs Killed It · Brendan Dolan-Gavitt | [un]prompted.au 2026](https://pbs.twimg.com/card_img/2115106126010146816/sZ3KO7B3?format=jpg&name=800x419)
Salvatore Lazzarone retweeted
A few of us have been predicting saturation of adversarial contact points for a while, but this is first set of good graphs I’ve seen of it.
Imagine it will take owning agencies a very substantial amount of time to realize what is happening.
Salvatore Lazzarone retweeted
A new blog post "Ghidra + CBMC = Assembly Model Checker" philipzucker.com/asmc_cpp/ A fairly small tool can lift assembly to CBMC's GOTO IR enabling simple cross C-assembly model checking for many ISAs (Ghidra supports 20+ github.com/NationalSecurityA… ) #ghidra #assembly #verification
Salvatore Lazzarone retweeted
Unlocking everything on the AMD CPU with DRAM scrambling (@xoreaxeaxeax)
github.com/xoreaxeaxeax/skit…
#infosec
Salvatore Lazzarone retweeted
REA (Reverse Engineer Anything) by @morluto is now a skill in Computer.
Ask Computer to reverse-engineer an app and it inspects how the app works without its source code, then builds a working version.
Tasks that use /reverse-engineer are free through October 31, up to 10,000 credits per user.
Here are 5 apps Computer made with it, available to try for a limited time:
1) Figma: Design with layers and auto-layout, plus sign-in, cross-device sync, and multiplayer editing. Try it: ui-editing.pplx.app
Salvatore Lazzarone retweeted
I can independently verify these results are semi-correct. However there are a lot of issues with this output. I will cover it in this thread 👇
This binary is protected with CodeVirtualizer for context.
(Proper devirt on the left, vs AI on the right) func: 0x237F0
Devirtualized Easy Anti-Cheat (EAC) for Linux via Gemini 4 Argon and GPT 6.1 Sol using Hex-Rays IDA Assist's MCP: github.com/19h/eac-linux-dev…
Salvatore Lazzarone retweeted
Wrote up my attempt at deobfuscating Luraph-protected Lua: lifting Lua to LLVM IR , then using AI + partial evaluation to strip the VM, and checking it against the original.
nac-l.github.io/2026/10/12/d…
Salvatore Lazzarone retweeted
The final post of my decompilation project is out.
83% of the functions are byte exact. We're hitting diminishing returns. The game runs flawlessly, so we're calling it done here.
For obvious reasons, no code will be shared.
momo5502.com/posts/2026-10-0…
Salvatore Lazzarone retweeted
New Blog Post!
Introduction to ARM ETM Tracing for Reverse Engineers!
In this post we extract a live instruction trace from a running Xbox controller, enjoy!
voidstarsec.com/blog/arm-tra…
Salvatore Lazzarone retweeted
[1/2] This is the XOR algorithm that deobfuscates the on-device LLM weights found in Chrome's OptGuideOnDeviceModel. The XOR algorithm resets per encoded region. Once the weights are deobfuscated, they can be used to run inference outside of the Chrome sandbox.
Salvatore Lazzarone retweeted
The official IDA MCP Server is here. It's free, open source, and works with any LLM.
Your agent writes IDAPython, uses ~20% fewer tokens, and can share an IDB with you in real time.
𝚞𝚟𝚡 𝚒𝚍𝚊-𝚑𝚌𝚕𝚒 𝚖𝚌𝚙 𝚒𝚗𝚜𝚝𝚊𝚕𝚕
hex-rays.com/blog/hex-rays-i…
(copy-paste: uvx ida-hcli mcp install)
Salvatore Lazzarone retweeted
New video:
Breaking Obfuscated Binaries with AI Agents: An Attacker's Playbook
I'll showcase my strategies for attacking strong protections that cannot be one-shotted.
youtube.com/watch?v=oGBj1v8t…
Slides & samples:
github.com/mrphrazer/binary-…
Salvatore Lazzarone retweeted
huge if true.
// great job @moyix. easily my favourite talk at @UnpromptedAU.
Salvatore Lazzarone retweeted
Guys, I built a super fast Android decompiler called ASC.
It completely replaced Jadx MCP for me and lets me analyze 10+ APKs in parallel.
And this week my Agent use ASC found 2 RCE in Honor and Xiaomi!
This tool now accepted by BlackHat EU Arsenal
github.com/MG1937
#BHEU
Salvatore Lazzarone retweeted
The @reconmtl talk "SELECT * FROM binary - Vibe Reverse Engineering with IDA, Ghidra and Binary Ninja" is out.
youtube.com/watch?v=ADPoD7-_…
