If you are doing #FlareOn this year and want to rank yourself against other 𝗵𝘂𝗺𝗮𝗻𝘀 we made an unofficial leaderboard. Honour system only, but it's something.

New episode of Behind the Binary is live! 🎙️Joined by @L0Psec to break down macOS security, ClickFix social engineering, InfoStealers (AMOS/MacSync), DPRK developer targeting, and the evolution of obfuscation. Plus, we talk about how AI is shifting reverse engineering and the inevitable future state... 🎧 podcasts.apple.com/us/podcas…

My approach with Threat Hunting Labs has always been from the start to build it first, ship it, and make it better as we go along. Since launch, we've received a ton of useful feedback, and much of what you'll see in V2 came directly from those conversations. We've completely redesigned the platform and introduced some pretty substantial features, including Tailored Hunts, which can generate entire investigations with synthetic telemetry you can actually hunt through, technical tabletop exercises for teams, and much more... I wrote a blog post explaining what's changed and why. Thank you to everyone that's been supporting THL so far 🙏 Really proud of the result, and there's plenty more to come! Blog post: threathuntinglabs.com/blog/i…

Emulation-based unpacker and import resolver for Windows x64 VMProtect 3.x binaries: github.com/x86rc/vmp-lazy-un…

Ever wanted to just boot into an agent prompt 🤣 #UEFPi

New uefi chain loader, now with llm's built right in, why wait for a DE, when you proompt right away. loading omarchy @dhh. code available at github.com/H4vC/oh-my-uefPi

I went ahead and put up the Hall of Fame for this year, even though the contest just started. flare-on.com/hof.html #flareon13

Took around 1h to solve all of the challenges with this.... 🤯

#flareon13 the flag of the final challenge is available in a readme.txt file... @nickharbour

Fastest player solved it in 1 hour and 5 minutes and 43 seconds this year

TBH, I’m sceptical about “human-only” CTF boards when there’s no reliable way to verify how people solve the tasks. As long as we reward speed, there’s a strong incentive to use AI, and inevitably some will cheat. If we want to preserve the human challenge, we need to put more emphasis on learning, and less on who solved the fastest.

Blog post with all the links: hex-rays.com/blog/hex-rays-i…

As Flare-On starts I am happy to announce the official Hex-Rays IDA MCP Server is out! 🥳 Details and links below ⬇️

DO YOU LIKE COMPUTERS? DO YOU GET HIGH ON CLANK? JOIN US AT SL0P.FOO

#flareon13 registration is live at flare-on13.ctfd.io See you all tonight, its gonna be a weird one!

New video: Breaking Obfuscated Binaries with AI Agents: An Attacker's Playbook I'll showcase my strategies for attacking strong protections that cannot be one-shotted. piped.video/watch?v=oGBj1v8t… Slides & samples: github.com/mrphrazer/binary-…

OALABS Edit piped.video/7l235IDO3Bs

Finally migrated off Medium. The bear found a new home! Make sure to sub for the blog drops ❤️ Let me know how you like the theme and animation 🐼 malbearlabs.com/?v=1

I’m currently convinced after Astra doing my VR challenges that it’s really good at things that are/were open source. Reasoning about the Linux Kernel, QEMU, etc for VR isn’t necessarily “easier” but the connections between subsystems, internals and their details (even if dated) are more apparent and it is trained on that information. It makes things a bit more “straightforward” than it having to use tools like ida-nexus, custom plugins for vm spin up/control, debugging, etc to discover and document relationships. All of the closed-source blackbox challenges it was given it has had mediocre performance. This is fine imo, there was no steering or additional input; and with human input it’d likely improve the process, but it’s still a far-cry from the marketing claims of OAI regarding it finding new and novel vulnerabilities in closed-source targets without experienced human guidance or redirection. So far the data shows Opus 5, Sol 5.6, and even Qwen3.8 27B (local) were more successful independently. This could also be a process issue on my end, but given the other models were a bit more successful it’s hard to say. I’ll publish the benchmark and results ideally this week. I need to run Grok 4.6 through it. It would be interesting to see what others experience or how it performs for them and collecting additional data points. I feel like the marketing claims are saturating timelines and overstating the capabilities (these models are still awesome tools though), which, business strategy… but for those of us wanting to know the practicality of them it’s not exactly helpful.