Malware analyst. Cofounder of @p4_team. No independent thought: ALL opinions belong to my employers, cats. and friends. [email protected] https://xitter.cf/t.co/AeZd6IJwQe
Joined February 2016
- Tweets139
- Following67
- Followers1.7K
- Likes376
Finally, some easy to use software for local CA/PKI management🙏.
Now live: a GUI for Step CA that allows to visualize all issued certificates; it also allows to create "invitations" to easily onboard (even non-technical) people onto your private CA through a friendly web-based flow.
GitHub icedevml/tinypki:
github.com/icedevml/tinypki
msm retweeted
We have just published a new blog article on the topic of ClickFix/fake CAPTCHA campaigns.
Step-by-step overview of the infection, malware analysis, IoCs and YARA rules to help secure your own infrastructure.
🔗 cert.pl/en/posts/2026/02/fak…
My short blog post on ClickFix threats (with focus on malware used in recent campaigns): cert.pl/en/posts/2026/02/fak…
msm retweeted
Logowanie do #KSeF z poziomu Pythona przez klucz zgodny z PKCS#11, np. podpis/pieczęć kwalifikowaną w formie karty, tokena USB albo HSMa. Umożliwia też hostowanie kluczy od certyfikatów wydanych przez KSeF w HSMie, albo kluczem na dysku w formacie PEM.
github.com/icedevml/pyksef
msm retweeted
🔍 Have you tried monitoring certificate transparency logs lately and found existing tools or libraries disappointing?
✅ Fear not! We're releasing a better one, with tiled format support, async operations, state persistence and an easy-to-use API.
🔗 github.com/CERT-Polska/ct-mo…
My new post about #malware #deobfuscation - cert.pl/en/posts/2025/04/pee…. I focus on the simple - but powerful - technique of local substitutions. Uses #ghidra and ghidralib. Thx @nazywam for review.
msm retweeted
I analyzed thousands of messages from 35+ suspected state-sponsored hacktivist groups using machine learning—uncovering hidden connections through writing styles, language and topics.
After a year of research, here’s what we found and how we did it. 👇
research.checkpoint.com/2025…
1/
Ghidralib development continues: py3 support, binary/asm patching, and symbolic propagation: github.com/msm-code/ghidrali…. I also write docs for people who want to try it. Newest chapter: emulation msm-code.github.io/ghidralib…
#ghidra #reverseengineering
No worries, it was easy to miss. Actually I forgot it was there and almost uploaded it for the second time. I hope it's useful. As for the band, hard question. Probably "Death" (the Chuck Schuldiner's band).
Sure! It's already there: msm.lt/re/ghidra/rulecompile…. (This is a small example binary with that obfuscation recreated, I can't share the original sample)
RULECOMPILE - Undocumented Ghidra decompiler rule language. A blog post about how frustration with poor decompilation led me to dive deep into Ghidra's decompiler to discover (and reverse-engineer) - an obscure, undocumented DSL
msm.lt/re/ghidra/rulecompile…
#reverseengineering #ghidra
ALT A image that shows a piece of code. On top there is an expression (param_1 & 1) * 2 + (param_1 ^ 1). On the bottom is a deobfuscated version, param_1 + 1. In the middle there is a custom Ghidra DSL, explained in the post.
🚀Excited to announce ghidralib - a library that makes #Ghidra scripts drastically shorter and easier to write. I've been using it daily for #reverseengineering and decided it’s time to share! Check it out: github.com/msm-code/ghidrali… And the docs: msm-code.github.io/ghidralib… #infosec
Hi #Ghidra users. I've created a quick search/command palette/launcher plugin called "Ctrl+P". You can search for functions, labels, data, bookmarks, focus windows, launch scripts and trigger available action.
github.com/msm-code/GhidraCt…
#reversing #reverseengineering #infosec
msm retweeted
🚨 Uwaga na fałszywe reklamy na dużych platformach internetowych!
Oszuści nadal skutecznie omijają mechanizmy weryfikacji, a platformy mają problem z ich powstrzymaniem.
Jakie są rodzaje oszustw i dlaczego te mechanizmy zawodzą? 🤔
🔍➡️ cert.pl/posts/2024/11/Oszust…
"skoro się pan na to zgodził, to chyba czuł pan, że są nie halo, prawda?" - jestem pod wrażeniem.
A: oddaj mi swój portfel albo dostaniesz!
B: [oddaje]
A: "skoro oddałeś portfel to chyba czułeś potrzebę podzielenia się, prawda?"
msm retweeted
[PL] Oprócz Paged Out!, wypuściliśmy dzisiaj też wywiad z 𝗣𝗼𝗹𝗮𝗻𝗱 𝗖𝗮𝗻 𝗜𝗻𝘁𝗼 𝗦𝗽𝗮𝗰𝗲, tj. (@p4_team + @DragonSectorCTF + przyjaciele) o HACK-A-SAT 4:
↓↓↓
youtube.com/watch?v=9Gl8ZZDb…
↑↑↑
Thanks! Yeah, I'm quite happy with it. IMO it's more robust than the technique Checkpoint used (research.checkpoint.com/2023…). DotRunpeX may be a state of the art .NET protector, but it's very hard for packers/protectors to evade dynamic analysis.
Slides (PL) from my yesterday's presentation at @OMHconf
#ohmyhack are here: tailcall.net/static/talks/om…. I've talked a bit about my recent research about stealers in a - hopefully - approachable way.
I had the pleasure to conduct a 1.5 day #workshop about Threat Intel Pipelines and CTI to a room full of security experts during the #ITU Interregional #Cyberdrill for Europe and Asia-Pacific. I hope everyone had fun and maybe see you at the next Cyberdrill.
