Linux and IoT Malware Analysis with r2ai

Explore how artificial intelligence can accelerate Linux and IoT malware analysis in this 28-minute conference talk from NorthSec 2025. Learn to leverage r2ai, a tool that bridges Radare2's open-source disassembler with large language models, to significantly reduce analysis time from days to hours while maintaining quality results. Discover practical techniques for analyzing recent Linux and IoT malware samples, including Ladvix (Rhomba, Ebola) variants and Linux shellcode from March 2025. Master the art of guiding AI through complex reverse engineering tasks, understanding how to effectively communicate with AI systems to decompile malware functions and defeat obfuscation mechanisms. Examine critical limitations including AI hallucinations, omissions, and exaggerations that require careful verification and validation. Understand cost management strategies to keep AI-assisted analysis under $10 while maximizing effectiveness. Gain insights into treating AI as a collaborative partner rather than an infallible tool, learning when to trust AI output and when to apply human expertise for verification. Watch multiple live demonstrations showing real-world malware analysis workflows, practical troubleshooting techniques, and best practices for integrating AI into your security research methodology.