Recon 2025 - Breaking Obfuscated .NET Malware with Profiler Based Dynamic Binary Instrumentation

Presenters: Lars Wallenborn, Tillmann Werner, Sebastian Walla, Steffen Haas

As malware authors increasingly adopt .NET for its ease of development and stability…

By Michele Campa Overview In this blog post we take a look at a race condition we found in Microsoft Windows Cloud Minifilter (i.e. cldflt.sys ) in March 2024. This vulnerability was patched in October 2025 and assigned CVE-2025-55680 . The vulnerability…

A .NET assembly tracer using Harmony for runtime method interception. - eversinc33/NetRunner

Gain insights into COM/DCOM implementations that may be vulnerable using an automated approach and make it easy to visualize the data. By following this approach, a security researcher will hopeful...

This is a guest entry written by Holger Unterbrink from Cisco Talos. His views and opinions are his own and not those of Hex-Rays. Any technical or mainten

Check Point Research succeeded in understanding the infamous malware family, Xloader, by leveraging Generative AI

x64DbgMCPServer made from c# with Claude, Windsurf and Cursor support - AgentSmithers/x64DbgMCPServer

At Hexacon 2023, we presented our Windows kernel security research, uncovering CVE-2023-28218, a heap overflow in afd.sys. Read our exploit analysis and methodology. | Vulnerability Research

Assisting Go Analysis and Reversing. Contribute to junron/agar development by creating an account on GitHub.

Security Researcher | i like All OS Internals, Malware & Reverse Engineering, C++, Intel/ARM Assembly and cool things.

Reverse engineering AMSI internals

The basics of WinDbg and Time Travel Debugging necessary to start incorporating it into your analysis.

This is an abridged version of https://www.pnfsoftware.com/reversing-wasm.pdf. For additional details, including footnotes, as well as…

Unmasking APT35 (Charming Kitten). New report analyzes leaked internal documents, revealing their operational profile, Exchange attack chains (ProxyShell, EWS), and quota-driven compromise strategies.

Using SourcePoint’s JTAG debugger to investigate the implementation of Intel CET Shadow Stacks in kernel-mode on Windows