Max &#x27;Libra&#x27; Kersten

brucon.orgreverse-engineering-ghidra | BruCON

25 Aug

In less than a month, I will give my two day reverse engineering training on code reuse detection with Ghidra at BruCON! You can book now with 15% discount using the code "Reverse15"! Do I see you on the 22nd and 23rd of September? You can find the syllabus here: www.brucon.org/training-det...

brucon.orgreverse-engineering-ghidra | BruCON

10 June

On the 22nd and 23rd of September, I will be giving the first edition of my "Reverse engineering and looking for code reuse in malware with Ghidra" training at BruCON! If you are interested in Ghidra, automation, LLMs, and code reuse, this is for you! More information: www.brucon.org/training-det...

maxkersten.nlMy impression of Botconf 2026 – Max Kersten

29 Apr

Its been two weeks since (my workshop at) @botconf.infosec.exchange.ap.brid.gy 2026, and last weekend I found some time to write about my experience: maxkersten.nl/2026/04/27/m...

8 Apr

Coming Tuesday, I'll give a workshop at @botconf.infosec.exchange.ap.brid.gy: Malware symbol recovery with Ghidra using Golang examples. Attendees will dive into real malware samples and learn how to recover missing symbols! If you are around, feel free to say hi!

maxkersten.nlThreatFox Java API client – Max Kersten

24 Jan

Aside from updating my Java API libraries, I also wrote a new library for Abuse.ch's ThreatFox! You can find all information about it here: maxkersten.nl/projects/api...

github.comThisIsLibra - RepositoriesMalware analyst and reverse engineer. Author of the Binary Analysis Course. - ThisIsLibra

24 Jan

Over the past years, as hobby projects, I made Java API libraries for Abuse.ch's Malware Bazaar and Yaraify, for RecordedFuture's Tria.ge, and for @malshare.com's API. Today, I updated all their updating dependencies, and I added some features! Find the repositories here: github.com/ThisIsLibra?...

19 Oct 2025

Libra.setAge(Libra.getAge() + 1);

29 Aug 2025

When I joined Trellix in June 2021, the only thing I knew was that I'd dig into malware and blog about it. That I did, over the past four and a bit years, I wrote 24 blogs. On average, that is just two months per blog! 1/2

29 Aug 2025

My first few years were under @christiaanbeek.bsky.social. Upon his resignation, John Fokker became my team lead. I'd like to thank them both for the past few years, as well as colleagues old and new. Today, I am resigning and moving on to a new adventure! 2/2

maxkersten.nlMy impression of BlackHat USA 2025 and DEFCON 33 – Max Kersten

18 Aug 2025

Had a great time meeting friends old and new at summercamp nearly two weeks ago! I've shared my experience while representing Trellix here: maxkersten.nl/2025/08/18/m...

events.humanitix.comAdvanced Ghidra Scripting & AutomationRegister on Humanitix - Advanced Ghidra Scripting & Automation hosted by DEF CON Workshops. DEF CON Workshops . Saturday August 9th 2025. Find event information.

16 July 2025

The workshop tickets for my Advanced Ghidra Scripting & Automation workshop at @defcon.bsky.social are live now: events.humanitix.com/dc33ws-n260-...

Ghidra, scripting, LLM, automagic automation. That should grab the attention for this thread. If you want to read the complete blog, you can do so here: www.trellix.com/blogs/resear... 1/n

Based on @struppigel.bsky.social's script, we propagate external function parameters in the disassembly listing, making life slightly easier! 9/n

github.comGitHub - advanced-threat-research/GhidraScripts: Scripts to run within Ghidra, maintained by the Trellix ARC teamScripts to run within Ghidra, maintained by the Trellix ARC team - advanced-threat-research/GhidraScripts

Questions and suggestions are always welcome! I'm happy to share back to the community with these scripts, all of which are open-source and can be found on GitHub. GitHub: github.com/advanced-thr... 10/10

Ghidra, scripting, LLM, automagic automation. That should grab the attention for this thread. If you want to read the complete blog, you can do so here: www.trellix.com/blogs/resear... 1/n

Those who worked with me before, know that visual art creation is not my strength. Visuals can, however, be very helpful during the analysis! And thus: graphic design is my (now) my passion! 7/n

Using the same graph theory code as used in GhidrAI, we can define which functions are the (least) complex. The most complex function calls are marked bright red, lesser complex functions are darker shades of red. This helps you identify interesting functions when no symbols are present! 8/n

Ghidra, scripting, LLM, automagic automation. That should grab the attention for this thread. If you want to read the complete blog, you can do so here: www.trellix.com/blogs/resear... 1/n

Based on research by @mrphrazer.bsky.social and @mu00d8.bsky.social, presented at RECon 2024, I used graph theory code from Ghidra's codebase to select the order in which functions are sent to the LLM, ensuring as much context as possible is retained. The script is aptly named GhidrAI! 5/n

That is not to say the LLM will generate perfect function and variable names, as well as function summaries. But it cant hurt to try! The result gives you, the analyst, a lot more context and insight! 6/n

Ghidra, scripting, LLM, automagic automation. That should grab the attention for this thread. If you want to read the complete blog, you can do so here: www.trellix.com/blogs/resear... 1/n

My new research focuses on an improved version of this workflow, while putting my money where my mouth is by providing ready-to-use scripts for all steps along the way! 3/n

The usage of BSim to rename functions automatically is something I dove into last year (see post two in this thread). The new Automagic script allows you to include multiple BSim databases to use per file, while specifying different similarity values per database! Granularity! 4/n

Ghidra, scripting, LLM, automagic automation. That should grab the attention for this thread. If you want to read the complete blog, you can do so here: www.trellix.com/blogs/resear... 1/n

Last year, I blogged about the recovery of symbols in my "No Symbols, No Problem" blog and subsequent DEFCON 32 talk. This resulted in a workflow, as shown in the attached image. Blog: www.trellix.com/blogs/resear... Talk: www.youtube.com/watch?v=-re_... 2/n

maxkersten.nlMy impression of Botconf 2025 – Max Kersten

27 May 2025

This year's @botconf.infosec.exchange.ap.brid.gy edition was a great experience! I wrote about it in my most recent blog: maxkersten.nl/2025/05/27/m...

22 May 2025

Tuesday's workshop @botconf.infosec.exchange.ap.brid.gy went well with very engaged and enthusiastic attendees!

16 May 2025

Coming Tuesday I will represent Trellix at @botconf.infosec.exchange.ap.brid.gy in Angers with a four hour workshop on Ghidra automation!

maxkersten.nlGhidra Tip 0x0A: Comments – Max Kersten

30 Apr 2025

Ghidra has multiple types of comments you can set, but when can you best use which comment? You'll find the explanation in my Ghidra tip of the month: maxkersten.nl/2025/04/15/g...

maxkersten.nlMy impression of RE//VERSE 2025 – Max Kersten

12 Mar 2025

Two weeks ago, @re-verse.io happened! I wrote about my experience at the conference in my most recent blog: maxkersten.nl/2025/03/12/m...

1 Mar 2025

What do you wear at @re-verse.io? A Ghidra tshirt and Hex Rays cap, with @psifertex.bsky.social rocking the Binary Ninja tshirt, hoodie, and cap!

25 Feb 2025

This Friday, I will represent Trellix at @re-verse.io and I will talk about code reuse, attribution, and the dangers thereof. Looking forward to it, and to meet the Vector 35 folks! The full abstract can be found at: re-verse.sessionize.com/session/754398

docs.google.comReverse Engineering SurveyMy name is Max 'Libra' Kersten and I'm a malware analyst. This survey will collect the answers you provide without the need for any personal information. The goal of this survey is to get a better und...

16 Jan 2025

My reverse engineering workflows survey is still ongoing! In less than 3 minutes, you can fill it in and help out: docs.google.com/forms/d/e/1F...

maxkersten.nlGhidra Tip 0x09: TaskMonitor – Max Kersten

7 Jan 2025

Ever ran a script in Ghidra that you wanted to cancel, only to find out that the script would not let you? The TaskMonitor handles the cancellation event, December's Ghidra tip dives into the details: maxkersten.nl/2024/12/31/g...

maxkersten.nlGhidra Tip 0x08: Scripting with microservices – Max Kersten

27 Nov 2024

Ghidra can do a lot, but some tasks are best outsourced to (micro)services! How? This month's tip helps you along: maxkersten.nl/2024/11/27/g...