BEGIN:VCALENDAR
VERSION:2.0
PRODID:Data::ICal 0.24
BEGIN:VEVENT
DESCRIPTION:   'Title: You Hold the Helm: Agentic LLM Workflows for Malware
  Reversing\n   Tags: Malware Village | Creator Talk/Panel\n   When: Friday
 \, Aug 7\, 16:35 - 17:15 PDT\n   Where: LVCCW Level 1 Hall 2 600 (Malware 
 Village) Talks - [1]Map\n\n   Description:\n\n   Malware analysts are inte
 grating LLMs into their reversing workflows\n   today\, in real casework. 
 The MCP integrations for IDA Pro\, Ghidra\,\n   radare2\, and Binary Ninja
  already exist and are publicly available\,\n   and analysts are using the
 m to rename functions\, triage samples\, and\n   hunt for vulnerabilities.
  Adoption has outpaced any measured account\n   of where these tools are r
 eliable and where they are not. There is\n   also a cost problem that gets
  little attention: running an agent\n   against a single sample can burn a
 n enormous number of tokens\, much of\n   it spent having the model redisc
 over the same things on every binary.\n   This session addresses both. We 
 built an agentic malware analysis\n   framework\, tested it across multipl
 e models and real samples scored\n   against ground truth\, and we are bri
 nging the numbers along with the\n   workflows. The framework connects LLM
 s directly to disassemblers and\n   decompilers through MCP\, and wraps th
 at with per-language skills for\n   the malware families analysts actually
  encounter: C and C++\, C#\, Go\,\n   and Android. Each skill encodes what
  the runtime looks like\, how the\n   decompiler tends to mangle that spec
 ific target\, which structures and\n   metadata are worth recovering first
 \, and what the model can safely\n   ignore. The Go skill carries knowledg
 e of the pclntab and the\n   runtime's calling conventions. The C# skill a
 ssumes IL and metadata\n   tables rather than native code. The Android ski
 ll separates the DEX\,\n   the native libraries\, and the manifest\, and k
 nows where behavior\n   usually hides. The skills exist for efficiency. Wi
 thout them\, the\n   model relearns the same Go runtime layout on every sa
 mple and pays the\n   same token cost to reach the same conclusion. With t
 hem\, that context\n   is supplied once and the model spends its budget on
  the sample. The\n   framework runs inside Docker containers orchestrated 
 through an ADK\n   agent loop. Three concrete reasons make this matter. Is
 olation keeps\n   live malware analysis off the host. Reproducibility mean
 s the same\n   container\, skill\, and sample produce similar starting con
 ditions every\n   time\, which is what makes any claim about model perform
 ance\n   meaningful. Disposability means that when an agent corrupts its o
 wn\n   analysis state\, and it will\, you tear the container down and star
 t\n   clean rather than nursing a polluted session. The ADK loop is what\n
    lets the agent act on its own: pulling function lists\, following\n   c
 ross-references\, reading decompiled output\, and issuing disassembler\n  
  commands. It is also where most of the interesting failures show up\n   w
 hen the agent is not constrained. Function renaming and summarization\n   
 on stripped binaries holds up well\, but only when functions are fed\n   w
 ith surrounding call context rather than dumped in bulk. Behavioral\n   tr
 iage\, the question of what a sample does and where to look first\, is\n  
  faster through the agent than manual function-list review\, and the\n   b
 enefit is largest for less experienced analysts. Pattern matching\n   acro
 ss a binary is reliable when you specify the class of issue to\n   look fo
 r. The per-language work also pays off on Go and Rust samples\,\n   where 
 traditional C and C++ oriented decompilers produce walls of\n   indistingu
 ishable functions and the LLM-assisted workflow often cuts\n   through wha
 t the tooling alone cannot. The failures matter as much as\n   the wins. C
 rypto identification is where the models are most\n   confidently wrong\, 
 mapping anything stream-cipher-shaped onto whatever\n   algorithm they saw
  most in training. Deobfuscation of any serious\n   protection scheme brea
 ks down quickly. CVE matching is the most\n   consequential failure\, beca
 use a fabricated CVE number reads with the\n   same authority as a real on
 e\, and an analyst who puts it into a threat\n   report has introduced an 
 error that is hard to catch later and can\n   misdirect incident response.
  Scope drift shows up throughout: left\n   unconstrained\, the agent will 
 decide on its own that you wanted\n   detection rules when you asked for u
 npacker analysis. We show each of\n   these failure modes on screen with t
 he actual model output. The core\n   of the session is a direct comparison
 \, the same model and the same\n   sample\, run two ways. First pass is a 
 minimal prompt with the agent\n   left to default behavior. Second pass\, 
 we drive\, selecting which\n   functions to examine\, supplying context th
 rough the right per-language\n   skill\, and constraining the output forma
 t. The model does not get\n   smarter between passes. We get more delibera
 te about how we use it\,\n   and the output diverges sharply. That is the 
 thesis as a demo rather\n   than a claim: the analyst is the captain and t
 he model is the crew\,\n   and analysis quality tracks almost entirely wit
 h how well it is\n   steered. We walk the comparison side by side on real 
 samples\, and ship\n   the demo binaries and both prompt sets with the tal
 k. Attendees leave\n   learning how to do a full setup: the Docker contain
 ers\, the ADK agent\n   scaffolding\, the per-language skills for C and C+
 +\, C#\, Go\, and\n   Android\, and the prompt templates that worked along
 side the ones that\n   did not. They can install it\, run the same compari
 sons we ran\, and\n   extend the evaluation to their own samples and analy
 sis tasks. They\n   also leave with a calibrated sense of which tasks are 
 safe to hand to\n   an agent\, which require careful steering\, and which 
 should never be\n   trusted without manual verification. Additionally\, we
  will open source\n   our framework the day of the talk.\n\n   Speakers:As
 her Davila\,Lenin Alevski\n\n   SpeakerBio:  Asher Davila\, Vulnerability 
 Researcher at Palo Alto\n   Networks\n\n   Passionate about binary analysi
 s\, binary exploitation\, reverse\n   engineering\, hardware hacking\, ret
 ro computing\, and music.\n\n   SpeakerBio:  Lenin Alevski\, Security Engi
 neer at Google\n\n   Lenin Alevski is a Full Stack Engineer and generalist
  with a lot of\n   passion for Information Security. Currently working as 
 a Security\n   Engineer at Google. Lenin specializes in building and maint
 aining\n   Distributed Systems\, Application Security and Cloud Security i
 n\n   general. Lenin loves to play CTFs\, contributing to open-source and\
 n   writing about security and privacy on his personal blog\n   https://ww
 w.alevsk.com.\n\n   '\n\n   1. #LVCCW_Level1_Hall2\n\n\n
DTEND:20260808T001500Z
DTSTART:20260807T233500Z
LOCATION:Malware Village - LVCCW Level 1 Hall 2 600 (Malware Village) Talks
SUMMARY:You Hold the Helm: Agentic LLM Workflows for Malware Reversing
END:VEVENT
END:VCALENDAR