I just pushed out #BinaryRefinery v0.8.24 which fixes all the issues I encountered during my recent live stream =D.

The main problems were caused by running an old version of pip in WSL, which caused an old version of LIEF to be installed, hence failing to parse executable formats. The 'solution' is to add a stricter version requirement for LIEF and improve the documentation to include a pip update.

Finally, I have finally fixed the annoying issue that I ran into on the stream with passing arguments to path extractor units that match a file on disk. Starting with v0.8.24, these arguments will no longer read file contents by default.

I will be doing a live stream [stream] later today, kindly hosted by the amazing Dr. Josh Stroschein! I will be using #BinaryRefinery to replicate an analysis that Josh previously presented [source], of a download chain going from exploit document all the way to the AgentTesla payload itself.

[stream]: https://www.youtube.com/live/HuLONk0Rt98
[source]: https://www.youtube.com/playlist?list=PLHJns8WZXCdvfqIp9m0kkjsbg9G8YWdSH

If you use #BinaryRefinery for unpacking MSI or CAB files, I urge you to update to at least 0.8.18: I recently fixed a very subtle error in my LZX implementation which will make it so that your output is almost correct, with just a few incorrect bytes.

LZX is used for extracting certain CABs, which in turn is used for certain MSIs. The bug is in the x86 filter used by LZX where I treated an integer as unsigned when it needs to be interpreted as signed. I am indebted to a colleague of mine who shall remain anonymous for now for pointing out the erroneous output, this would have been fairly hard to catch otherwise.

I recently added a new #BinaryRefinery tutorial:

https://github.com/binref/refinery/blob/master/tutorials/notebooks/tbr-files.v0x09.exploit.document.ipynb

This one follows the same steps as a very cool #MalCat blog article (thanks to @malcat)

As promised, here are my #BinaryRefinery solutions of #FlareOn10. Didn't quite refine them all, but there might be a nugget or two if you like static analysis:

https://github.com/binref/refinery/blob/master/tutorials/tbr-files.v0x08.flare.on.10.ipynb