Binary analysis, malware and firmware
The binary does not lie.
Reverse engineering reveals what the binary actually does, not what the vendor claims it does: hidden behaviour, undocumented APIs, and security flaws that exist only in the compiled code. No source code access required. No vendor claims accepted on faith.
Static and dynamic analysis. Firmware audit. All platforms.
From firmware to malware, we reverse it all.
What we analyse, and what you get out of it.
- 01
Malware analysis
Full reverse engineering of malware samples. Attribution indicators, capability mapping, command-and-control extraction, and detection signature development.
- 02
Firmware security audit
Extraction and analysis of firmware from embedded devices, IoT hardware, and industrial controllers. Bootloader analysis, hard-coded credential discovery, and update mechanism verification.
- 03
Exploit development
When penetration testing finds a vulnerability, we can develop a reliable exploit to prove impact. Heap, stack, kernel, and browser exploitation.
- 04
Protocol reverse engineering
Proprietary and undocumented protocol analysis. Traffic capture and replay, protocol state machine reconstruction, and vulnerability assessment of implementations.
- 05
Anti-tamper bypass
Analysis of DRM, license verification, anti-debugging, and code obfuscation techniques, to test protected software and understand adversary evasion capabilities.
- 06
Supply chain verification
Binary-level verification of third-party software and libraries. Backdoor detection, hidden functionality analysis, and comparison against known-good builds.
Black-box testing vs. reverse engineering.
| Black-box testing | Reverse engineering |
|---|---|
| Tests from the outside | Analyses the internals |
| Observable behaviour only | Understands the mechanism |
| Cannot find hidden features | Reveals undocumented functionality |
| Limited to live interfaces | Static and dynamic binary analysis |
| Guesses at root cause | Proves root cause at instruction level |
Triage. Dissect. Understand. Report.
Triage & scoping
Identify the target binaries, determine the architecture and obfuscation, and define what questions need answering: malware attribution, vulnerability hunting, or IP verification.
Static analysis
Disassembly and decompilation. String analysis, import and export mapping, control flow reconstruction, and identification of interesting functions and data structures.
Dynamic analysis
Controlled execution in sandboxed environments. API call tracing, memory dump analysis, network behaviour capture, and anti-analysis technique bypass.
Reporting & intelligence
A full technical report on what the binary does, how it works, indicators of compromise, and what to do about it. Written for engineers, with an executive summary for leadership.
What you receive.
- Technical report
- What the binary does, how it works, and what to do about it. Written for engineers.
- Indicators of compromise
- For malware: the indicators you can use to detect it.
- Executive summary
- A summary for leadership.
What changes.
See what it really does
At the instruction level, not what the vendor claims.
Find hidden behaviour
Undocumented functionality that only exists in the compiled code.
Answers for engineers and leaders
A technical report plus an executive summary.
You cannot secure what you do not understand.
Binary analysis gives you answers source code review cannot. Talk to our researchers about scoping a reverse engineering engagement, whether it is malware analysis, firmware audit, or software verification.
Talk to an operator