The last real post here is dated 2020. If you’ve checked back in the years since and found nothing new, I owe you an honest paragraph or two. So here it is.
Life happened, in the best way
Most of the gap has a very simple explanation, and it’s asleep down the hall as I write this. Two kids. One almost six now, the other just turned three. There’s a particular kind of math that takes over when you have small children: the hours you used to pour into a stubborn disassembly listing get quietly reallocated to bedtime stories, sick days, first words, and the thousands of small emergencies that are, it turns out, the actual point of everything. I don’t regret a single one of those trades. But they don’t leave much room for the slow, obsessive, beautiful tedium that reverse engineering demands.
A new chapter
In 2020 I also closed one professional chapter and opened another. I left the Kroll DFIR team and joined SentinelOne, first on the IR TAM team, and these days as a Technical Success Manager working with our partners. Different problems, different people, a wider view of how the whole cyber world actually works at scale. But a career shift eats energy the same way a newborn does, and for a while the blog simply wasn’t where that energy went.
And life outside work
Somewhere in there I also fell hard for things I left for years: running and the gym. There’s something about a long run or a heavy set that scratches a similar itch to a clean reverse: a problem you solve with patience, one rep, one kilometer, one function at a time. I’m not sorry I got hooked because it kept me sane. During hard moments like when you don’t have enough hours of sleep, or not at all actually, physical activities help to have your mind clear and sharp, for a couple of hours at least.
I never fully stopped, though. Every now and then a sample crosses my desk that’s just too interesting to leave alone, and I disappear into IDA for an evening like the old days. To be frank, those hours are still some of my favorites.
And then there’s AI
Like pretty much everyone on the planet this past year, I’ve been experimenting with AI. But I went a little further than the chat window — I built my own local AI stack at home, running models on my own hardware, wiring it into my homelab, learning where it helps and where it confidently lies to you. It’s been a fascinating playground, and it’s quietly changed how I think about analysis work. More on that another time.
Why I’m back
Here’s the real reason for this post, though. After five years of good excuses — and they are good excuses — I’ve realized that I simply miss it. I miss pulling malware apart to see how it really works, or poking at a vulnerable driver to see if I can weaponize it. That small thrill, deep in a binary, of finding the one function that explains the whole thing. It’s the part of this field I’ve always loved most, and somewhere along the way I let it slip to the bottom of the list.
So I want to come back to it. I know I can fail again, to be honest, I’m quite sure I’ll fail again.
I’m not promising myself anything like a post every week, I hope I’ve learned the hard way what I can actually sustain. However, there might be samples I want to tear down, tools I want to write up, and a homelab that’s become a proper playground for all of it. If my actual job won’t offer these kinds of exposures, I’ve decided I had to go look for them, because it’s the only way I can really feel alive.
If you’re still reading after all this time: thank you.
— Mario