ADD / XOR / ROL

On bug disclosure and contact with vendors After reading HDM's blog entry on interaction with MS on one of the recent bugs, I guess I sh...

I really enjoyed reading Ilfak's blog post today :-) -- it always makes me happy to see clever abstractions and the results they produc...

Compression, Statistics and such In the process of doing the usual stuff that I do when I do not struggle with my studies, I ran into the pr...

Some shameless self-promotion: Rolf and me are going to teach a special one-day class on BinDiff 2 at BlackHat Las Vegas this year: http://w...

Extra extra: Google/Sun discover the existence of integer overflows :)

My prediction for the next two years: Apple, Symantec, McAffee, Oracle etc. will get pounded into the ground by lots of bugs being found and...

MSASN1 is hard to read these days -- the code makes heavy use of carry-flag-dependent arithmetic (adc, rlc etc) to check for integer overflo...

The Vodafone virus dropped by today and brought us some mobile viruses to play with - thanks ! :-) So cross-platform diffing can be fun -- R...

Quote from Lock, Stock and Two Smoking Barrels: "I don't care who you use as long as they are not complete muppets". Having MS...

For those that are into malware classification, here's some code that one can include in a piece of malware to skew the Levenshtein dist...

Behavioural classification of malware Today is a good day: I got my math homework done before it has to be handed in, and that leaves me som...

Microsofts built-in firewall has some really annoying things to it. I am running a laptop connected to an untrusted network and an instanc...

Important German saying: "Wer keine Probleme hat macht sich welche" "Those that do not have any problems will create some for...

More on automated malware classification and naming So after having posted some graphs without further explanation yesterday, I think it is ...

Also, Rolf has created a shockwave where he shows how to use BinDiff to find GPL violations. Check it here...

Automated classification of malware is easier than it seems once you have the right infrastructure -- in our case consisting of the BinDiff2...

I am in a state of brainfry. Which I guess is good. Exhaustion can be fun. I think I haven't worked as hard as I am working at the momen...

Quote from the Matasano Blog: "We are so funded now" ^^ Classic :)

Language in thought and action or "what's correct vs. what's right" Everybody should IMO, at some point of his life, have ...

http://teh-win.blogspot.com/ has (as usual) an amusing read up, which at one step harps on a point that I can't support enough: 0days !=...