This post serves as a text version of our presentation (available here) at Biere et Secu on 21/04/2026.

Binary executables are everywhere: firmware, desktop and mobile apps. They are fast and compact, but also difficult to understand. At their core, binary executables are just a sequence of raw machine code: 0s and 1s interpreted in the CPU as instructions. For that reason, this format is not ideal for human readability. Yet, in certain situations, for example malware analysis, we need to understand what a binary executable is doing. This is where disassembly comes in:

Symless is an IDA Pro plugin designed to assist with structure reconstruction and cross-reference placement. It comes in two flavors: an automatic pre-analysis that can reconstruct most of the structures used in a binary, and an interactive plugin that reconstructs a single structure from user selection.

We are now releasing a new architecture-agnostic version of Symless, and use this opportunity to describe its internal logic.

Although Kindle e-readers are a prime target in modding and jailbreaking communities, there is little public work about vulnerability research in remote code execution scenarios.

In this post, we give technical details about a chain of vulnerabilities we identified that can be triggered by downloading a malicious Audible audiobook, allowing to take full control of the device and its registered Amazon account.

Remote Play Together, developed by Valve, allows sharing local multi-player games with friends over the network through streaming. The associated protocol is elaborate enough to shelter a valuable attack surface that has scarcely been ventured into in the past.

This post covers the reverse engineering of the protocol and client/server implementations inside Steam, before presenting a dedicated fuzzer that unveiled a few critical vulnerabilities.