BEGIN:VCALENDAR
VERSION:2.0
PRODID:-//pretalx//cfp.balccon.org//balccon2k26-2026//speaker//8GCJPF
BEGIN:VTIMEZONE
TZID:CET
BEGIN:STANDARD
DTSTART:20001029T040000
RRULE:FREQ=YEARLY;BYDAY=-1SU;BYMONTH=10
TZNAME:CET
TZOFFSETFROM:+0200
TZOFFSETTO:+0100
END:STANDARD
BEGIN:DAYLIGHT
DTSTART:20000326T030000
RRULE:FREQ=YEARLY;BYDAY=-1SU;BYMONTH=3
TZNAME:CEST
TZOFFSETFROM:+0100
TZOFFSETTO:+0200
END:DAYLIGHT
END:VTIMEZONE
BEGIN:VEVENT
UID:pretalx-balccon2k26-2026-PQ9QZT@cfp.balccon.org
DTSTART;TZID=CET:20260918T160000
DTEND;TZID=CET:20260918T170000
DESCRIPTION:This talk is about using LLMs to build and modernize software w
 here correctness matters. It follows the work at two scales: modernizing a
  similarity-digest algorithm that must match its reference implementation 
 bit-for-bit\, and building malbench\, a local-first triage and clustering 
 workbench for malware analysts.\nmalbench is a local-first triage and clus
 tering workbench for malware analysts. It pulls samples and threat intelli
 gence from various sources\, computes similarity digests\, runs YARA rules
 \, and then turns a flat pile of hashes into structure: it clusters and gr
 aphs files by features they actually share and weaves several of those len
 ses into a single view.\nI needed a wider variety of hashing algorithms\, 
 so in addition to ssdeep and TLSH\, I took a dormant 2021 Go port of sdhas
 h\, a similarity-digest algorithm used in malware triage and code-reuse de
 tection\, and modernized it into a clean\, dependency-free\, fully-tested 
 library. A deterministic verification corpus and parallel C++/Go harnesses
  turn the original reference implementation into an oracle: millions of pa
 ir comparisons\, zero unexplained divergences. Around that sit total test 
 coverage as a drift alarm\, strict session and context hygiene\, profile-b
 efore-you-optimize with one change measured at a time. The result is a rep
 eatable process for adopting and modernizing old code and for building new
  tools on top of it.
DTSTAMP:20260901T063749Z
LOCATION:Tesla
SUMMARY:Comparing Malicious Files 2.0 - Malware Utkonos
URL:https://cfp.balccon.org/balccon2k26-2026/talk/PQ9QZT/
END:VEVENT
BEGIN:VEVENT
UID:pretalx-balccon2k26-2026-QSSAXP@cfp.balccon.org
DTSTART;TZID=CET:20260920T153000
DTEND;TZID=CET:20260920T183000
DESCRIPTION:Shellcode is often treated as a dark art: small\, opaque\, and 
 inseparable from exploit folklore. This workshop takes the opposite approa
 ch. It breaks shellcode down as a disciplined form of constrained systems 
 programming\, where every byte\, register\, calling convention\, memory re
 ference\, and control-flow decision matters.\n\nParticipants will learn ho
 w shellcode is structured\, how position-independent code works\, and why 
 common instruction patterns such as call/pop\, base-register anchoring\, s
 tack construction\, and compact control-transfer sequences appear so frequ
 ently in real-world payloads. The workshop will also cover Windows interna
 ls relevant to shellcode\, including TEB and PEB access\, API discovery\, 
 API hashing\, syscall resolution\, and indirect syscall techniques. Finall
 y\, it will explore more advanced building blocks such as tiny disassemble
 rs\, trampolines\, and API interception hooks.\n\nThe goal is not to teach
  copy-paste payload development\, but to give reverse engineers\, malware 
 analysts\, exploit developers\, and detection engineers a clear mental mod
 el for how shellcode actually works.
DTSTAMP:20260901T063749Z
LOCATION:Pupin
SUMMARY:Shellcode: Learning to Write Position Independent Code - Malware Ut
 konos
URL:https://cfp.balccon.org/balccon2k26-2026/talk/QSSAXP/
END:VEVENT
END:VCALENDAR