Orca Cyber Weapons

Static Devirtualization of Tencent VM by aftermathlabs

@OrcaCyberWeapons

Some bugs found via binary instrumentation and fuzzing by aftermathlabs

~"Using BLARE2 for binary instrumentation to guide fuzzing via coverage. Seems to work well, two discord/chromium crasher media files in 30min~ We can instrument arbitrary PE files (no source or debug info needed)." - aftermathlabs


https://github.com/aftermathlabs/discord-crasher


@OrcaCyberWeapons

After a long wait, the BinaryHardening organization is finally back

GitHub Support confirmed that their abuse detection systems had flagged the account for manual review, and the restrictions have now been cleared

Everything is accessible again.

Glad to finally have it restored.

github: https://github.com/BinaryHardening

Discord server: https://discord.com/invite/gmJJ6737Us

Static Devirtualization of Tencent VM by
@BackEngineerLab
. Great read for anyone interested in VM-based obfuscation and devirtualization.


https://back.engineering/blog/31/07/2026/

Update - GitHub flagged the org, cfgrip is on GitLab now:
https://gitlab.com/BinaryHardening/cfgrip

Appreciate everyone reaching out. GitLab's been solid, built in CI, container registry, group profile already up. Same code, nothing's stalled.

Binary Hardening just put out cfgrip v1.0.0 - https://github.com/BinaryHardening/cfgrip

It loads PE and ELF binaries (32 and 64-bit), disassembles everything with Capstone, traces through indirect calls via GOT lookups, jump tables, and backward register tracking, figures out function boundaries from entry points, exports, prolog signatures, exception tables and data section pointers. Outputs the whole control flow graph as JSON with three modes: full graph, entry-point reachable only, and a cleaned version with jump threading, dead block removal, stack deltas and cross-references

@OrcaCyberWeapons

A dive into the PE file format

https://0xrick.github.io/win-internals/pe1/
https://0xrick.github.io/win-internals/pe2/
https://0xrick.github.io/win-internals/pe3/
https://0xrick.github.io/win-internals/pe4/
https://0xrick.github.io/win-internals/pe5/
https://0xrick.github.io/win-internals/pe6/
[Mastering PE Structure for Malware Analysis: A Layman’s Guide](https://tech-zealots.com/malware-analysis/pe-portable-executable-structure-malware-analysis-part-2/)
[Peering Inside the PE: A Tour of the Win32 Portable Executable File Format](https://coffi.readthedocs.io/en/latest/peering_inside_pe.pdf)
https://0xrick.github.io/win-internals/pe8/

packages:
- c++ : https://lief.re/doc/stable/formats/pe/cpp.html
- rust : https://docs.rs/pe-parser/latest/pe_parser/
- python : https://pypi.org/project/pe-parser/


questions? :
- [What does "e_lfanew" mean in the DOS header for the PE format?](https://stackoverflow.com/questions/47711282/what-does-e-lfanew-mean-in-the-dos-header-for-the-pe-format)
- [Disassemble Windows PE .data section (using python)](https://stackoverflow.com/questions/58775954/disassemble-windows-pe-data-section)
- [Loading a 64-bit Windows PE file from memory](https://stackoverflow.com/questions/68988499/loading-a-64-bit-windows-pe-file-from-memory)


@OrcaCyberWeapons

We’re building a small community around binary security research, focused on things like:

- Reverse Engineering
- Binary Obfuscation / Deobfuscation
- Exploit Development
- Compiler / interpreters...
- Malware Analysis
- Binary Hardening research

we also work on open source tools and experiments here:
GitHub → BinaryHardening GitHub
Discord → BinaryHardening Discord

If low level stuff and weird binaries are ur thing, come join us
Always happy to meet more RE people

Post-Build PE Obfuscation

Obfusk8 includes a post-build script to further harden the compiled binary by removing forensic artifacts.

* Script Location: `Obfusk8/Obfusk8/SCRIPTS/obfuscate_pe.ps1 at main · x86byte/Obfusk8`
* What it does:
1. Strips the Rich Header — removes the MSVC build-environment fingerprint that reveals compiler version and toolchain details.
2. Spoofs the TimeDateStamp — replaces the PE header timestamp with a fixed value to obscure build time.
3. Clears the Debug Directory — wipes debug directory entries that could leak PDB paths or build metadata.
* Usage:
Run as a post-build step after compiling:
powershell PowerShell -NoProfile -ExecutionPolicy Bypass -File Obfusk8/SCRIPTS/obfuscate_pe.ps1 -Path "path\to\Obfusk8.exe"

The script modifies the binary in-place. No backup is created.


@OrcaCyberWeapons

Obfusk8 v1.5 released!

Enhanced AES string obfuscation with improved decryption reliability and stronger PE obfuscation hardening. Smoother, more resilient code protection.

https://github.com/x86byte/Obfusk8/releases/tag/v1.5

https://prime.platacard.mx/file-service/static/


That's the Banco Plata S3 bucket we dumped earlier (platform-file-service-manager-prod-public in us-west-2). It serves financial documents: quarterly risk reports, signed Docusign contracts, Fitch/Moody's credit ratings, loan contracts, investment agreements, privacy policies — 849 files (156.4 MB). Authored by jorge.delacabada and Carlos Gonzalez.


@OrcaCyberWeapons

sbox

Compile-time AES string obfuscation for C++.

No XOR.
No delimiters.
No plaintext in .rdata.

https://github.com/x86byte/sbox

sbox - delimiter-less string obfuscation powered by compile-time AES

Plaintext literals are a signature. Standard string serialization using delimiters is easy to trace and trivial to reverse. I wrote sbox to handle both single-string and multi-string encryption at compile-time, ensuring that sensitive source data is never exposed in the constant pool.

The project ports the AES8 core from Obfusk8 to the NeetCode "Encode and Decode Strings" challenge.

The implementation passed NeetCode in 7ms.

- Static Stealth: Shreds both atomic literals and string arrays at compile-time. The strings utility returns high-entropy noise instead of rodata artifacts.
- Delimiter-less: Fixed-width headers and AES-128 blocks remove the need for predictable separators.
- Binary Safe: Handles raw payloads and null bytes without the overhead of split-logic.

Making static analysis irrelevant for a standard coding challenge.


sbox repo : https://github.com/x86byte/sbox

ent8 Bin2bin Obfuscator answers about the @PELock question "but the question is - can it obfuscate ntoskrnl.exe"

about the last x.com post:

https://x.com/x86byte/status/2029291022811799745