Recent content on frereit's blog
Recently, my first ever paper has been published on the IACR ePrint server: https://eprint.iacr.org/2026/1351 . If you’re into hardware side-channel security and know what the d -probing model is, you should probably read the paper. Otherwise, here’s a small intro to what I spent my last ~year working on. Seemingly secure cryptography, like AES, can fail catastrophically when…
In this short post, I want to ramble about my approach to writing malware for Windows systems that are protected by some kind of Antivirus or EDR software. I will use the term AV to refer generally to any endpoint products that are there to detect and mitigate malware attacks. Similarly, I use the term malware extremely broadly here. My experiments are done mostly with little C2 agents I’m…
The “rusty_rev” challenge was, as the name suggests, a Rust reverse engineering challenge for the HackDay 2025 Qualifications CTF . Challenge Description Hello agent, a trusted source managed to find one of the most secured app of the black mist crew, but unfortunately, we can’t find the password to access it. We know your talents for reverse engineering, we need you to help us…
Abstract In this blog post, we’ll be covering Microsoft Warbird and how we can abuse it to sneakily load shellcode without being detected by AV or EDR solutions. We’ll show how we can encrypt our shellcode and let the Windows kernel decrypt and load it for us using the Warbird API. Using this technique, you can hide your shellcode from syscall-intercepting EDR solutions allowing you to allocate…
Abstract When building your C2 agent, you may want to avoid outbound traffic directly from your agent to the C2 server for a number of reasons. You may have strict firewall rules that block all non-browsers from accessing the Internet, or you may want to bypass a proxy that only allows access to certain trusted websites. By spawning a headless browser process and using the Chrome DevTools Protocol…
An overview of this article (TL;DR) TL;DR: AES-GCM is great, as long as every nonce (mnemonic: n umber used once ) is truly unique. Once a nonce is reused, AES-GCM completely falls apart. If you’ve ever worked with AES-GCM, you may have heard that reusing a nonce can lead to catastrophic security failures. In this post, we will look at how exactly all security guarantees of AES-GCM can be…
In the previous post , we discussed how to decode a Bootstring string. If you haven’t read it yet, I recommend you do so before continuing. This post will just quickly go over how encoding works to complete the picture. I’ll skip over the details of the generalized variable-length integers that we already discussed in the previous post. Recap We already saw how we can use the state…
You may know about Punycode , a way to represent Unicode strings with only ASCII characters. It is used to encode domain names, for example “münchen.de” becomes “xn--mnchen-3ya.de”. Punycode, specified in RFC 3492 , is technically just a set of parameters for a more general algorithm called Bootstring, which is specified in the same document. In this post, I will explain…
In this section, I’ll be collecting links to articles, papers, blog posts, and other resources that I find interesting without any categorization and in no particular order. What I Learned About Billionaires at Jeff Bezos’s Private Retreat ML-KEM Mythbusting Do I belong in tech anymore? On quitting, the spread of AI, and the loss of an ideal. The world in which IPv6 was a good design Raft…
You probably landed here because you had an old link. I’ve since moved the paths of the articles around. The article you wanted to read is at /bootstring_encoding .
You probably landed here because you had an old link. I’ve since moved the paths of the articles around. The article you wanted to read is at /bootstring_decoding .
You probably landed here because you had an old link. I’ve since moved the paths of the articles around. The article you wanted to read is at /bootstring_encoding .
Frederik Reiter Stuttgarter Str. 106 c/o Block Services 70736 Fellbach Phone: +49 15679 206983 Email: @ External links This website may contain links to external websites. The author cannot assume any liability for the contents of external links. The author explicitly distances himself from the contents and presentation of all linked pages and states clearly not to have any influence on the design…
This personal blog is hosted on GitHub Pages, a static site hosting service provided by GitHub, Inc. This Privacy Policy outlines what information is collect when you visit this site, how it is used, and your rights regarding your data. Information I Do Not Collect Cookies : I do not use cookies on this blog. Tracking : I do not use any tracking tools or analytics services. Data Storage : I do not…