-
Recent Posts
Archives
- November 2025 (2)
- March 2025 (1)
- January 2025 (1)
- December 2024 (2)
- October 2024 (2)
- March 2023 (1)
- November 2022 (1)
- October 2022 (2)
- February 2022 (1)
- January 2022 (1)
- October 2021 (3)
- January 2021 (1)
- December 2020 (1)
- September 2019 (1)
- June 2019 (1)
- January 2019 (1)
- July 2018 (1)
- April 2018 (1)
- February 2018 (1)
- January 2018 (2)
- December 2017 (2)
- November 2017 (1)
- June 2017 (4)
- May 2017 (2)
- December 2016 (1)
- November 2016 (1)
- July 2016 (3)
- June 2016 (1)
- April 2016 (1)
- March 2016 (2)
- February 2016 (1)
- October 2014 (1)
- March 2014 (1)
- February 2014 (2)
- January 2014 (1)
- November 2013 (1)
- October 2013 (1)
- September 2013 (1)
- August 2013 (1)
- July 2013 (3)
- July 2012 (1)
- May 2012 (1)
- April 2012 (1)
Categories
- CONfidence (3)
- CrackMe (24)
- cryptography (1)
- CTF (8)
- FlareOn (6)
- KernelMode (4)
- Malware (16)
- Malware Decryptor (5)
- PE-bear (12)
- Programming (6)
- Techniques (5)
- Tools (10)
- Tutorial (17)
- Uncategorized (3)
- WKE (3)
Blog Stats
- 2,144,805 hits
All my works included here are licensed under:
Author Archives: hasherezade
Flare-On 12 – Task 8
In this mini-series I describe the solutions of my favorite tasks from this year’s Flare-On competition. To those of you who are not familiar, Flare-On is a marathon of reverse engineering. This year it ran for 4 weeks, and consisted … Continue reading
Flare-On 12 – Task 9
In this mini-series I describe the solutions of my favorite tasks from this year’s Flare-On competition. To those of you who are not familiar, Flare-On is a marathon of reverse engineering. This year it ran for 4 weeks, and consisted … Continue reading
Tutorial: unpacking executables with TinyTracer + PE-sieve
Covers: automatic OEP finding, reconstructing IAT, avoiding antidebugs and fixing imports broken by shims In this short blog I would like to demonstrate you how to unpack an executable with PE-sieve and Tiny Tracer. As an example, let’s use the … Continue reading
Posted in Malware, Tools, Tutorial
Tagged HollowsHunter, PE-bear, PE-sieve, TinyTracer
Leave a comment
Process Hollowing on Windows 11 24H2
Process Hollowing (a.k.a. RunPE) is probably the oldest, and the most popular process impersonation technique (it allows to run a malicious executable under the cover of a benign process). It is used in variety of PE loaders, PoCs, and offensive … Continue reading
Posted in Malware, Programming, Techniques
Tagged processhollowing, processinjection, Programming, runpe
4 Comments
Flare-On 11 – Task 7
Flare-On is an annual CTF challenged by the Mandiant Flare Team. This writeup details approaches to decrypting TCP traffic captured in a PCAP, linked to an AOT-compiled .NET binary. It discusses analyzing the binary, generating FLIRT signatures, and performing cryptanalysis to recover private keys used in Elliptic Curve Cryptography for traffic decryption. Continue reading
Flare-On 11 – Task 5
Flare-On is an annual CTF run by Mandiant Flare Team. In this series of writeups I present solutions to some of my favorite tasks from this year. All the sourcecodes are available on my Github, in dedicated repository: flareon2024. The … Continue reading
Flare-On 11 – Task 9
Flare-On is an annual CTF run by Mandiant Flare Team. In this series of writeups I present solutions to some of my favorite tasks from this year. All the sourcecodes are available on my Github, in dedicated repository: flareon2024. The … Continue reading
Flare-On 11 – Task 10
Flare-On is an annual CTF run by Mandiant Flare Team. In this series of writeups I present solutions to some of my favorite tasks from this year. All the sourcecodes are available on my Github, in dedicated repository: flareon2024. The … Continue reading
Magniber ransomware analysis: Tiny Tracer in action
Intro Magniber is a ransomware that was initially targeting South Korea. My first report on this malware was written for Malwarebytes in 2017 (here). Since then, the ransomware was completely rewritten, and turned into a much more complex beast. The … Continue reading
Flare-On 9 – Task 8
For those of you who don’t know, Flare-On is an annual “reverse engineering marathon” organized by Mandiant (formerly by FireEye). It runs for 6 weeks, and contains usually 10-12 tasks of increasing difficulty. This year I completed as 103 (solves … Continue reading
hasherezade's 1001 nights 