Breaking Garudas’ VM
Beating Instruction Substitution to Reverse Engineer a VM A few days after publishing the TadpoleVM blog post, I received a direct message on Discord from Garuda. They asked me if I want to reverse th...
Magic Bytes
Reverse Engineering & Stuff
Latest posts
Breaking TadpoleVM
Reverse engineering a virtual machine with a custom instruction set With the rising popularity of virtual machines as an anti-analysis technique such as VMProtect & Themida, more and more malware ...
AlmondRAT Analysis: Hazy Tiger Lost its Nuts
While browsing the OA-Labs Discord Server, I stumbled upon a few hashes being shared in the malware analysis chat. Out of curiosity, I picked one randomly and downloaded it from “virus.exchange” . Upo...
Liveness Analysis
Live Variable Analysis, also known as Liveness Analysis, is a data-flow analysis technique used by compilers to identify dead code, specifically, variable assignments whose values are never used. To u...
Reaching Definitions
Reaching definitions is a data-flow analysis technique used in compilers to determine which line could have assigned the value of a variable used at a specific point. As we all know a definition of an...
Nasty Triks from the Past
Back in November, I downloaded and analyzed a sample of what I thought was Phorpiex; however, shortly after sharing the post around, Struppigel pointed out that what I analyzed may in fact not be Phor...
ELF Internals - Part IV: The Symbols
This part got featured in Tmp.0ut #4: https://tmpout.sh/4/11.html Enjoy :^)
ELF Internals - Part III: The Section Headers
After the ELF and Program Headers, we have the section headers. This knowledge is, again, essential for reverse engineering, as well as malware development. So without wasting any time, let’s jump str...
ELF Internals - Part II: The Program Headers
This part got featured in Tmp.0ut #4: https://tmpout.sh/4/12.html Enjoy :^)
ELF Internals - Part I: The ELF Header
So… You wanna learn something about those weird Linux executables known as ELFs? Well you are in luck, me too! I’ve taken it upon me to seek around the dark dusty corners of the world wide webs to lea...
TitanLdr Overview
Recently I was talking to my friend 0xLegacyy about my little packer project I’m working on, and since I want to extract my position independent loader and append it to a PE (Portable Executable), he ...
Snowy Days & The Malware Packing Ways
A few weeks ago, I got the itch to start reversing some more malware samples to practice my reversing and analysis skills, however something I noticed while looking for a samples is: all malware sampl...
Ultima Analysis
So, ya boi is back with yet another of his geeky interests. This time we are gonna be taking a look at a sample made by crow called “ultima”, it is apparently a easy reversing challenge for new malwar...
FAT File System Basics
Recently while trying to learn about computer viruses from the 20th century, I came to the conclusion that it is important to understand what the FAT file system is and how it works from a high level ...