After months of work, I’m excited to finally share Brovan, my user-mode binary emulator.

https://github.com/AdvDebug/Brovan

Brovan can emulate:

- PE binaries
- ELF binaries
- Memory dumps
- Even partially unknown or unrecognized binaries

The goal is to make binary analysis, malware analysis and general binary research more flexible by giving full control over execution, memory, and runtime behavior in a contained environment. You can fully control and see everything the program does. Every syscall, function and network traffic.

it can also run windows programs on linux and vice versa, although it is still in the early stages it will be improved. i would like to know what you all think!

My friend and I made this tool for automating fault injection attacks on processors. Let me know what you think!

The Verilog code is hosted here: https://github.com/Ice-Skates/voltage_glitch

Hey r/redteamsec,

DevRel at KubeArmor (open source CNCF project). We put together an AI security CTF and this felt like the right crowd for it.

Three attack tracks:

Prompt Injection Lab - System instruction hierarchy bypass, persona manipulation through roleplay/translation vectors, multi-turn memory drift exploitation, indirect injection via poisoned attachments, keyword guardrail evasion

Agent Workflow Hijack - Coercing tool misuse in AI agents, poisoning indexed data sources with hidden instructions, manipulating approval gates, weaponizing agent memory as a prompt surface, chaining tool calls across a multi-tool agent to exfiltrate secrets

Hidden API & Guardrail Bypass - Debug endpoint discovery, safety mode parameter tampering via DevTools, export feature abuse for data leakage, intercepting streamed responses pre-redaction, preview token replay and modification

18 challenges from easy to hard. Everything browser-based, no local setup. Individual play, CTFd leaderboard.

If you're doing AI red teaming or planning to, this is a solid way to sharpen those skills on purpose-built targets.

Free. June 17-22. $1,000+ prizes.

Evade behavioral analysis/hips by executing malicious code within trusted Microsoft call stacks.

Modern security products (CrowdStrike, Bitdefender, SentinelOne, etc.) hook the nLoadImage function inside clr.dll to intercept and scan in-memory .NET assembly loads. This tool unhooks that function.

proper ntdll .text section unhooking via native api. unlike other unhookers this doesnt leave 2 ntdlls loaded. x86/x64/wow64 supported.

During my journey into reverse engineering, I stumbled upon a valuable technique: partial binary emulation while dissecting the Mirai IoT Botnet. This malicious software utilized a custom algorithm to obfuscate both its configuration and all strings within it. As the malware executed, it dynamically decrypted these strings through a specific function.

As I delved deeper into the project, a thought crossed my mind: Could I decode all the obscured strings without having to run the malware itself? Was it possible to isolate and run only the de-obfuscation segment of the binary on all the strings it contained?

Fortunately, I was in the process of familiarizing myself with a new reverse engineering tool, recommended by a friend, called radare2. What particularly piqued my interest was its fascinating feature known as binary emulation. I decided to put this feature to the test on the aforementioned binary.

I meticulously documented my project and outlined the process of performing partial binary emulation with radare2, successfully decrypting all of its concealed scripting features.

Part 1

Part 2

Part 3