About

It’s a me, Babush!

I’m Paolo Montesel. I do low-level engineering: tooling, compilers, reverse engineering. Mostly I enjoy mashing together technologies that were never meant to touch each other.

When I reverse something these days it’s mostly vibe RE. I let the LLMs grind through the boring parts and go manual only when they give up. I build the opposite too, see llvm-jutsu below.

Right now I’m a software engineer at Hex-Rays (yes, the IDA Pro people). I build binary-analysis tooling, obsess over binary similarity, do large-scale analysis of binaries, and build information-retrieval systems around all of it.

Talks

• HITB Phuket 2023: Big Match: How I Learned to Stop Reversing and Love the Strings
• CODE BLUE Tokyo 2020: Reflex: you give me a parser, I give you a token generator

Stuff I’ve built

There’s more on my GitHub. Some favorites:

• Big Match: A search engine that tells you which open-source libraries are linked into a compiled binary. It uses GitHub as the corpus. Solo project. demo blog HITB talk
• s390 LLVM JIT: I compiled a mainframe emulator down to LLVM IR, then used that IR to JIT-specialize per guest instruction at runtime. I was the main developer for about seven months. I also found a use-after-free inside LLVM itself while pushing it hard.
• QEMU Hexagon: Worked on auto-generating QEMU TCG generators from Qualcomm’s pseudo-code ISA spec, validated by differential testing against the reference emulator. Some of it landed upstream. QEMU commit
• nonna: Example-based structural code search. It finds functions that compute the same way no matter how they’re named, and does reuse-before-write over MCP and LSP.
• xrefs: A fast binary cross-reference extractor for ELF, Mach-O, PE and dyld caches.
• llvm-jutsu: A tongue-in-cheek anti-LLM LLVM pass. It turns integer comparisons into finger-counting on procedurally-drawn hands (LLMs can’t count fingers), baked into the binary via Futamura projection.
• nampa: IDA’s FLIRT ported to pure Python. A straight translation of Radare’s code, but I’m still weirdly proud of it.
• dumb-obfuscator: An RSA-based obfuscation pass for LLVM. Yes, RSA, in your if statements. writeup
• Google CTF 2017: With abiondo, an LLVM-based deobfuscation script that cracked a challenge. Google picked it as one of the best writeups. writeup

Some things I brag about

• Hack-A-Sat 4 winner (2023) with mhackeroni: the US Space Force’s satellite-hacking CTF, and its final edition. I was in Vegas running logistics and filming. video
• DEF CON CTF finalist x4 with mhackeroni: 7th in 2018, 5th in 2019.
• MikroTik RouterOS SMB DoS, CVE-2019-16160.
• Bug-bounty halls of fame at Naver LINE, United Airlines, and TIM: the TIM one has its own writeup here.
• 5th at the Data Science Game (2016, international, 117 teams): my team was two security people and two biomedical engineers. Not one actual ML specialist.
• A Vulcanus in Japan alumnus. I lived in Tokyo for a year and still fumble through a bit of 日本語.

Say hi

I’m around for interesting low-level, compiler, RE, or “this is cursed” problems. Find me on GitHub, LinkedIn or Twitter. You can also read my full CV.