On the 28th of February and the 1st of March, the folks behind Binary Ninja (Vector35) organised RE//VERSE in Orlando, Florida. While this was the conference’s first edition, this wasn’t noticeable at all, as the conference was exceptionally well organised. The communication from the speaker desk was swift and clear, even with the six hour time difference. The well organised set-up was also visible in the mandatory dry run. Each speaker did a dry run with a panel of industry experts, which gave me valuable feedback to further improve my talk’s content and the related slides.
The location, the Caribe Royale resort, is conveniently located just 15 minutes away from the Orlando International Airport. The adjacently located conference centre is part of the resort and just a few minutes away from any of the hotel rooms. This allowed me to rest in my room whenever I wanted to, or if the vendor lounge was too crowded.
The vendor area was filled with several booths and tables, allowing attendees to network among each other and to chat with the vendor booth staff. A TV screen and some chairs were available for those wanting to watch the talks from this room while still wanting to chat. The main room contained roughly 400 seats, which sufficed for the just-under-250 attendee count (from what I was told).
The conference’s first non-keynote talk was from Cindy Xiao, titled Reconstructing Rust Types: A Practical Guide for Reverse Engineers. This talk details the inner workings of Rust from a reverse engineering perspective, using source code, disassembled and decompiled code, and compiler optimisations. I’d highly recommend going over the slides if you need to dive into reversing Rust binaries.
Cindy’s talk was followed by a wonderful lunch. The food at the conference was exceptional, as was the weather. Vector35’s Peter and Jordan emphasised the food multiple times, and they rightfully did so.
My talk was directly after the lunch, where I represented Trellix and spoke about code reuse and attribution, and the dangers thereof. You can find my slides here. Upfront, I was unsure if the talk would come across in the same manner that I wanted to, as there was no exciting nor special outcome of the research. And while there does not need to be, it is always pleasant to have such a conclusion when presenting. I dove into the differences and similarities in general when looking at code reuse and attribution, and how this came back in AcidRain and AcidPour.
I chose the two wipers as it intersected two topics I have been researching for a while: wipers and code reuse. For those interested in the code reuse aspect: please read this blog in its entirety. The talk’s content did come across as I intended, based on feedback from multiple people afterwards.
The Polish train hack, presented by Michał Kowalczyk and Jakub Stepniewicz provided additional insight into the story they presented in their 37C3 and 38C3 talks. Both CCC talks are worth a watch, as will the RE//VERSE talk once it is published.
As an avid Ghidra (power) user, the talk titled Langs Beyond The C by Florian Magin and Angelo DeLuca showcased how they improved Ghidra’s handling of Objective-C along with Ghidra’s source code to do so (https://github.com/ReverseApple/GhidraApple). This is helpful for anyone looking to reverse Objective-C, but the talk’s outline covers what you want to look for when improving Ghidra’s handling of a given language. The focus on strings and functions is similar to the focus in my Golang handling scripts for Ghidra.
Staying on the topic of Ghidra, at Black Hat USA 2024 I got a HexRays cap, and I printed a Ghidra tshirt to wear at the conference. Given that the Binary Ninja team was present, I figured this was a good opportunity to take a picture with Jordan, who happily joined in!
Having met a lot of wonderful people, I want to thank Peter, Jordan, Kelly, and Šárka for the wonderful contact for the organisation, as well as all of the other Vector35 staff! Cindy and Josh were great to meet in-person, as well as numerous other people whom prefer to remain anonymous.
The conference made it clear based on landyard colour if you consented to photos by the official photography team, as well as pictures taken by members at the conference. Personally, I do not mind, but I do think this is a great example of a privacy minded approach at a large event.
The conference was an absolute blast in terms of new research, great people, good food, and fantastic weather.
To contact me, you can e-mail me at [info][at][maxkersten][dot][nl], or DM me on BlueSky @maxkersten.nl.