Unpacking a layered crack-me: RCTF reverse engineering 300
Notes on a crack-me that stacked packing, anti-disassembly tricks and a multi-step encoding scheme before the real check.
Read moreReverse engineering
Notes on taking binaries apart: packers, anti-debugging tricks, crack-mes and malware analysis.
2015
FireEye's FLARE-On 2015: an eleven-challenge reverse engineering gauntlet
A round-up of the themes across FireEye's eleven-stage 2015 FLARE-On reverse-engineering competition.
Read more2013
Why app server credential encryption is reversible, and what that means
Application servers like JBoss and WebLogic encrypt stored credentials reversibly rather than hashing them, because the server must get the plaintext back to connect; that design has real limits.
Read moreWhy physical memory matters as much as the disk in forensic work
A short primer on why volatile memory, not just the disk, holds evidence forensic investigators need, and why capturing it correctly and early matters.
Read more2012
How malicious Android apps used activity hijacking to steal data
A look at activity hijacking: a non-root Android technique where a malicious app watches for a target app, then overlays a convincing fake login screen.
Read moreReverse engineering an unfamiliar instruction set under CTF time pressure
A CTF binary challenge shipped a packet capture plus an executable for an unfamiliar architecture, solved mainly through protocol-flow reasoning.
Read more