ChiBrrCon 2027

This session breaks down a real reverse-engineering case: dissecting malware from a Russian threat actor using a mix of traditional tooling and heavy AI augmentation. It’s a practical walkthrough, not a theory talk, showing exactly how modern AI fits into an RE workflow without replacing the analyst’s judgment.


The story starts with the basics: loading the sample into Visual Studio Code, wiring Copilot into the workspace, and using it to speed up early triage, sketch hypotheses, and clean up noisy decompiled output. From there, we move into Ghidra and Ghidra MCP, using AI-assisted explanations to untangle obfuscated functions, unpack encoding routines, and clarify the malware’s execution flow.


Next, we switch to Unicorn. You’ll see how AI helped generate the scaffolding and “ballast” needed to emulate tricky code paths, build test harnesses, and sanity-check behaviors that were too opaque in static form. This combination of emulation, targeted prompting, and iterative refinement peeled back layers of the loader, payload, and C2 logic far faster than a pure manual approach.


The session covers what worked, what failed, and how to avoid AI-induced dead ends. YThe goal is simple: show a realistic, repeatable way to integrate AI with VS Code, Copilot, Ghidra, Ghidra MCP, and Unicorn to speed analysis while staying firmly in control.


By the end, you’ll walk away with a complete, end-to-end view of how AI can boost malware reverse engineering on real hostile code — not as magic, but as a force multiplier for someone who knows what they’re doing.