umasi

Thanks for your response, seems reasonable to me. That being said, this post is at best impolite, and at worse intentionally "scooping" another reverse engineer. Seems like you guys are chatting now though, so I'll leave you to figure it out.

As others have already touched on, it’s rather disingenuous to pretend that you are “picking up where he left off” after copying his title and labeling your article as part 2, no? Especially considering the first author made it very clear he intended to publish further work on the topic. Further, this article reads a lot like an attempt to beat him to the punch and to hijack his series. But correct me if I’m wrong?

Hey! My friend linked me this comment. This is super dope, I used to RE more dynamically and knowing about monitor() and debug() would have helped me a lot haha.

Also the memory snapshots, I've used that to try to debug memory leaks in the past but never thought about using it to RE. Super cool that you can also get the string that way.

You can definitely get the same results a lot faster via dynamic RE for most obfuscation methods, but what attracted me to Kasada was the challenge of writing a disassembler from a static RE perspective. I also don't think dynamic RE methods are super easy to apply here once you get into the VM logic though, as I've discovered while working on part 2.

If you want to chat with me about this more my socials are linked in the post, or you can message me on discord (umasi#3301) :)