Orca Cyber Weapons

Static Devirtualization of Tencent VM by @BackEngineerLab . Great read for anyone interested in VM-based obfuscation and devirtualization. https://back.engineering/blog/31/07/2026/

Update - GitHub flagged the org, cfgrip is on GitLab now: https://gitlab.com/BinaryHardening/cfgrip Appreciate everyone reaching out. GitLab's been solid, built in CI, container registry, group profile already up. Same code, nothing's stalled.

Binary Hardening just put out cfgrip v1.0.0 - https://github.com/BinaryHardening/cfgrip It loads PE and ELF binaries (32 and 64-bit), disassembles everything with Capstone, traces through indirect calls via GOT lookups, jump tables, and backward register tracking, figures out function boundaries from entry points, exports, prolog signatures, exception tables and data section pointers. Outputs the whole control flow graph as JSON with three modes: full graph, entry-point reachable only, and a cleaned version with jump threading, dead block removal, stack deltas and cross-references @OrcaCyberWeapons

A dive into the PE file format https://0xrick.github.io/win-internals/pe1/ https://0xrick.github.io/win-internals/pe2/ https://0xrick.github.io/win-internals/pe3/ https://0xrick.github.io/win-internals/pe4/ https://0xrick.github.io/win-internals/pe5/ https://0xrick.github.io/win-internals/pe6/ [Mastering PE Structure for Malware Analysis: A Layman’s Guide](https://tech-zealots.com/malware-analysis/pe-portable-executable-structure-malware-analysis-part-2/) [Peering Inside the PE: A Tour of the Win32 Portable Executable File Format](https://coffi.readthedocs.io/en/latest/peering_inside_pe.pdf) https://0xrick.github.io/win-internals/pe8/ packages: - c++ : https://lief.re/doc/stable/formats/pe/cpp.html - rust : https://docs.rs/pe-parser/latest/pe_parser/ - python : https://pypi.org/project/pe-parser/ questions? : - [What does "e_lfanew" mean in the DOS header for the PE format?](https://stackoverflow.com/questions/47711282/what-does-e-lfanew-mean-in-the-dos-header-for-the-pe-format) - [Disassemble Windows PE .data section (using python)](https://stackoverflow.com/questions/58775954/disassemble-windows-pe-data-section) - [Loading a 64-bit Windows PE file from memory](https://stackoverflow.com/questions/68988499/loading-a-64-bit-windows-pe-file-from-memory) @OrcaCyberWeapons

We’re building a small community around binary security research, focused on things like: - Reverse Engineering - Binary Obfuscation / Deobfuscation - Exploit Development - Compiler / interpreters... - Malware Analysis - Binary Hardening research we also work on open source tools and experiments here: GitHub → BinaryHardening GitHub Discord → BinaryHardening Discord If low level stuff and weird binaries are ur thing, come join us Always happy to meet more RE people

Post-Build PE Obfuscation Obfusk8 includes a post-build script to further harden the compiled binary by removing forensic artifacts. * Script Location: `Obfusk8/Obfusk8/SCRIPTS/obfuscate_pe.ps1 at main · x86byte/Obfusk8` * What it does: 1. Strips the Rich Header — removes the MSVC build-environment fingerprint that reveals compiler version and toolchain details. 2. Spoofs the TimeDateStamp — replaces the PE header timestamp with a fixed value to obscure build time. 3. Clears the Debug Directory — wipes debug directory entries that could leak PDB paths or build metadata. * Usage: Run as a post-build step after compiling: powershell PowerShell -NoProfile -ExecutionPolicy Bypass -File Obfusk8/SCRIPTS/obfuscate_pe.ps1 -Path "path\to\Obfusk8.exe" The script modifies the binary in-place. No backup is created. @OrcaCyberWeapons

Obfusk8 v1.5 released! Enhanced AES string obfuscation with improved decryption reliability and stronger PE obfuscation hardening. Smoother, more resilient code protection. https://github.com/x86byte/Obfusk8/releases/tag/v1.5

https://prime.platacard.mx/file-service/static/ That's the Banco Plata S3 bucket we dumped earlier (platform-file-service-manager-prod-public in us-west-2). It serves financial documents: quarterly risk reports, signed Docusign contracts, Fitch/Moody's credit ratings, loan contracts, investment agreements, privacy policies — 849 files (156.4 MB). Authored by jorge.delacabada and Carlos Gonzalez. @OrcaCyberWeapons

sbox Compile-time AES string obfuscation for C++. No XOR. No delimiters. No plaintext in .rdata. https://github.com/x86byte/sbox

sbox - delimiter-less string obfuscation powered by compile-time AES Plaintext literals are a signature. Standard string serialization using delimiters is easy to trace and trivial to reverse. I wrote sbox to handle both single-string and multi-string encryption at compile-time, ensuring that sensitive source data is never exposed in the constant pool. The project ports the AES8 core from Obfusk8 to the NeetCode "Encode and Decode Strings" challenge. The implementation passed NeetCode in 7ms. - Static Stealth: Shreds both atomic literals and string arrays at compile-time. The strings utility returns high-entropy noise instead of rodata artifacts. - Delimiter-less: Fixed-width headers and AES-128 blocks remove the need for predictable separators. - Binary Safe: Handles raw payloads and null bytes without the overhead of split-logic. Making static analysis irrelevant for a standard coding challenge. sbox repo : https://github.com/x86byte/sbox

RE//verse 2026: Deobfuscation of a Real World Binary Obfuscator by James McGowan and Bas Zweers @OrcaCyberWeapons

ent8 Bin2bin Obfuscator answers about the @PELock question "but the question is - can it obfuscate ntoskrnl.exe"

about the last x.com post: https://x.com/x86byte/status/2029291022811799745

ent8 Bin2bin Obfuscator dev update: dead injections, loop obfs, NOT/PUSH/POP & anti-decompiler work but need polish. fixing a wild bug where obfuscating C++ std libs bloats a 1MB binary to 11MB (no need for c++ stds obf), even though it incredibly still runs perfectly. @OrcaCyberWeapons

GHOST IN THE SILICON: You're an admin on your machine, but you're still a guest in its house. A lot of people still think Ring 0 (the Kernel) is the absolute ceiling of authority. If you have root, you have God mode, right? For cracked people(not one though), they know the real power lives in Ring -3. There is a separate, invisible processor inside your Intel CPU running its own closed-source operating system usually a version of MINIX. This is the Intel Management Engine (ME). It doesn't matter if your PC is off, your drive is encrypted with AES-256, or you're running the most hardened Linux distro. If the power cable is plugged in, the ME is awake. It has its own independent network stack. It can bypass your OS-level firewall to send and receive data. It can see your RAM, your screen, and every single keystroke you type before your OS even knows they happened. The Kill Switch Irony: The only reason we know how to soft-disable this is because the NSA requested a way to turn it off for their own high-security machines. It's called the HAP (High Assurance Platform) bit. Even the guys who do the spying didn't trust a black-box OS living inside their silicon. @OrcaCyberWeapons

Кейс, когда пришёл за одним (интерналсами Hyper-V), а остался из-за другого (очень плотного доклада по пывну userspace Windows). Было не очень очевидно, но в MSRC работают по-настоящему серьёзные ребята. https://www.youtube.com/watch?v=50xxJEODO3M @OrcaCyberWeapons