This talk is about using LLMs to build and modernize software where correctness matters. It follows the work at two scales: modernizing a similarity-digest algorithm that must match its reference implementation bit-for-bit, and building malbench, a local-first triage and clustering workbench for malware analysts.
malbench is a local-first triage and clustering workbench for malware analysts. It pulls samples and threat intelligence from various sources, computes similarity digests, runs YARA rules, and then turns a flat pile of hashes into structure: it clusters and graphs files by features they actually share and weaves several of those lenses into a single view.
I needed a wider variety of hashing algorithms, so in addition to ssdeep and TLSH, I took a dormant 2021 Go port of sdhash, a similarity-digest algorithm used in malware triage and code-reuse detection, and modernized it into a clean, dependency-free, fully-tested library. A deterministic verification corpus and parallel C++/Go harnesses turn the original reference implementation into an oracle: millions of pair comparisons, zero unexplained divergences. Around that sit total test coverage as a drift alarm, strict session and context hygiene, profile-before-you-optimize with one change measured at a time. The result is a repeatable process for adopting and modernizing old code and for building new tools on top of it.

Shellcode is often treated as a dark art: small, opaque, and inseparable from exploit folklore. This workshop takes the opposite approach. It breaks shellcode down as a disciplined form of constrained systems programming, where every byte, register, calling convention, memory reference, and control-flow decision matters.

Participants will learn how shellcode is structured, how position-independent code works, and why common instruction patterns such as call/pop, base-register anchoring, stack construction, and compact control-transfer sequences appear so frequently in real-world payloads. The workshop will also cover Windows internals relevant to shellcode, including TEB and PEB access, API discovery, API hashing, syscall resolution, and indirect syscall techniques. Finally, it will explore more advanced building blocks such as tiny disassemblers, trampolines, and API interception hooks.

The goal is not to teach copy-paste payload development, but to give reverse engineers, malware analysts, exploit developers, and detection engineers a clear mental model for how shellcode actually works.