TitanMist, the newest project from ReversingLabs, was presented at this year's BlackHat USA. Being our youngest product, it got the most attention. As a sign of our high hopes for this project, we've dedicated ourselves to creating a detailed roadmap for it, a roadmap based on your desires, your expectations, and best of all: your contributions. Below are the milestones for the project's future:

• Deploying an easy to use installer for the project (done)
• Deploying a QA system and integrating it with our wiki format knowledge base
• Extending the TitanMist database with more signatures and unpackers
• Extending the TitanMist database with quality tested PeID signatures
• Extending the TitanMist database with quality tested OllyDBG scripts
• Extending the TitanScript capabilities by enabling the DLL unpacking
• Introducing more TitanMist plugins along with the Nexus plugin
• Graphical user interface

That is our TODO list, our focus. We've received many suggestions from people who have tried TitanMist in the brief time since its release - some of which immediately found their way onto on our roadmap list. We encourage you to contribute to our little project, making it a true "go-to" tool when it comes to file analysis. Until the next update on the TitanMist...

TitanMist ReversingLabs Corporation

TitanMist installer (package contains the installer for the tool)

BlackHat, one of the world's biggest security conferences, was held in Las Vegas two weeks ago. Among the BlackHat conferences this year, Las Vegas was by far the biggest event  - bringing thousands of security researchers to the heart of the Sin City. Bigger then ever before, BlackHat featured eleven tracks with an impressive number of high quality talks and trainings. We were there, and we were more than proud to present our newest file analysis tool, TitanMist, to the World.

In a fairly full room, for a reversing track that is, we presented the TitanMist project we have been working on for the past couple of months. Best described as  an automated PE32 file format identification and unpacking tool, TitanMist aims to improve collaboration among reverse engineers across the globe. That is an ambitious goal, but we have high hopes for this project and believe that we can grow it into something of great value in the coming months. Our detailed project roadmap will be unveiled on our blog next week.

The TitanMist presentation was accompanied by the Arsenal presentation that featured all of our tools: TitanEngine, NyxEngine and TitanMist. This kind of tool demo was introduced at this year's BlackHat USA and we must admit that we like the idea of tool presentations, during which authors receive direct feedback from the community. This feedback enables us to add new features and improve our tools even further. We got  many great ideas from talking to attendees with an interest in our tools and what we do. Ones attendees with particularly intriguing questions or ideas questions were rewarded with one of our TitanEngine T-Shirts. But t-shirt winner or not, we thank you all for your continuing support of ReversingLabs and the TitanEngine project!

In the picture on the left you can see our Arsenal booth and one of our senior software engineers, Mario Suvajac. Mario is one of the guys behind the TitanMist project, in charge of the byte pattern matching and overall tool design.

That is it for this report, until next week...

Security is notoriously disunited. Every year multiple tools and projects are released and never maintained. TitanMist is its inverse opposite. Built on top of TitanEngine, it provides automation and manages all known and good PEID signatures, unpacking scripts and other tools in one unified tool. TitanMist is the nicely packaged and open source catch all tool that will become your first line of defense. The project also goes beyond pure tool development. It builds a forum to share information and reverse engineering experience built around the biggest online and collaborative knowledge base about software packers.

With the increase in packed and protected malicious payloads, collaboration and quick response between researchers has become critical. As new sample numbers are quickly closing to 40M samples per year, solution to this problem has to come from reverse engineers themselves, integrating the work that they have done in the past and they continue to do. Huge databases of format identification data and unpacking scripts can be reused in a way to maximize automation. Yet, where do we find a definite collection of functional tools, identification signatures and unpacking tools? And how do we integrate them in a meaningful and accurate way?

TitanMist approaches these problems in a manner recognizable to every reverse engineer. It aims to mimic, but automate, the reversing process enabling everyone to easily create unpackers and integrate them in an extensible system. This builds a powerful and fast growing community analysis tool. Overcoming the most basic problems of reverse engineering problems was the top priority for the TitanMist project. Hoping to bridge the programming knowledge barrier which troubles many reverse engineers TitanMist introduces a variety of programming languages in which unpackers can be written in.

TitanMist goes beyond languages that compile to native code relying heavily on popular and easy to learn script languages. Backed up by LUA and Python this project makes coding unpackers a much simpler task. However the challenge of making TitanMist as easy to adopt and extend as possible meant that the project has to go further than extending support for more programming languages. Knowing that most of reverse engineers are familiar with debugger level script language OllyScript we added the support for it as well. Combined with the full TitanEngine functionality these scripts become powerful automated unpackers which combined with the layer of file format identification create a unique database of file analysis tools.

Download

• TitanMist / TitanMist Source
• BlackHat Vegas 2010 whitepaper
• BlackHat Vegas 2010 presentation

TitanMist ReversingLabs Corporation

TitanMist 1.0 released!