Reversing an Electron App's Self-Restore and OTA Mechanisms
Reversing an Electron app's self-restore mechanism, tracing how it repairs and restores its own files to understand the underlying protection scheme, and the code traced down to the core.
PC Reverse Engineering
Windows and PC reverse engineering: VMProtect and packers, OLLVM deobfuscation, drivers, kernel, boot process, and network protocols.
83 articles
De-obfuscating VMP 3.5 Virtualization: A Trace-and-Eliminate Methodology
De-obfuscating VMP 3.5 virtualization, working through the VM's handlers and dispatch loop to recover code protected by the older protector, with the result and caveats spelled out.
Reverse Engineering Siemens S7CommPlus: Symbolic Access to Optimized DB Blocks
Reverse engineering Siemens S7CommPlus symbolic access, decoding the PLC protocol's symbolic addressing for industrial control analysis, and the gotchas flagged along the way.
De-flattening Mutated OLLVM Control Flow with angr Symbolic Execution
De-flattening mutated OLLVM control flow with angr symbolic execution, recovering the original logic from heavily obfuscated native binaries, with the analysis method shown end to end.
Static Unpacking for VMProtect 3.9.5: the Rotating-XOR Layer
Static unpacking for VMProtect 3.9.5, reversing the rotating-XOR decryption layer to recover the protected binary without ever running it, for anyone reversing similar targets.
Indirect Branch Obfuscation with LLVM — Building and Removing It
Indirect branch obfuscation with LLVM, replacing direct branches with indirect jumps to break static control-flow analysis of compiled binaries, and the internals laid out in detail.
Graph-Topology Software Watermarking with LLVM — Part 1: Leaf Node Injection and Locating
Graph-topology software watermarking with LLVM, part one: embedding watermarks in a program's control-flow graph to track piracy, with every step broken down clearly.
Page-Granular Dynamic Decryption and Lazy Re-encryption in a Windows Packer
Page-granular dynamic decryption and lazy re-encryption in a Windows packer, explaining how it hides code until the moment of execution, so you can reproduce it yourself.
De-obfuscating ZKM Control-Flow Flattening with ASM
De-obfuscating ZKM control-flow flattening with ASM, using bytecode rewriting to reconstruct the original Java control flow and logic, with the tools and offsets documented.
Reversing the Windows Photos AI Eraser Models
Reversing the Windows Photos AI eraser models, digging into the on-device machine learning model files to understand how the feature works, including the pitfalls and the fix.
A General Approach to Defeating VMProtect-Style Code Virtualization - JIT Tracing, Equivalence Rewriting, and Handler Matching
A general approach to defeating VMProtect-style code virtualization: JIT tracing, equivalence rewriting, and handler matching, with the commands and code included.
Manually De-virtualizing a VMP 3.9.4 cmp/jne Handler Sequence
Manually de-virtualizing a VMProtect 3.9.4 cmp-jne handler sequence, tracing the handlers to recover the original comparison logic, with a full walkthrough of the technique.
Writing and Removing LLVM Bogus Control Flow
Writing and removing LLVM bogus control flow, showing how the pass inserts junk blocks and opaque predicates, then how to strip them back out, and the mechanism explained clearly.
IDA Debugger Hooks: Automating Breakpoints, Registers, and Memory
IDA debugger hooks, automating breakpoints, register reads, and memory access from IDAPython scripts to speed up dynamic analysis work, and the bypass logic broken down.
Reversing a Native Request-Signature Algorithm: SSL Pinning, OkHttp Interceptors, and MD5
Reversing a native request-signature algorithm, tracing a JNI signing routine down to its native implementation to recover the scheme, with the algorithm recovered in detail.
Debugging the Windows 11 Boot Process
Debugging the Windows 11 boot process, walking through the tools and techniques to trace startup from UEFI firmware all the way to the kernel, and the code traced down to the core.
Writing and Defeating OLLVM Control-Flow Flattening
Writing and defeating OLLVM control-flow flattening, an offense-defense look at building the obfuscation pass and then reversing it back out, with the result and caveats spelled out.
VMProtect 3.8.1 Obfuscation Strategies Explained
VMProtect 3.8.1 obfuscation strategies, cataloging the transformation techniques it applies to protected code and how each complicates analysis, and the gotchas flagged along the way.
A General Methodology for Reversing Deeply Obfuscated Modified MD5
Reversing a deeply obfuscated modified MD5, cutting through the obfuscation to recover a custom variant of the hash function and its constants, with the analysis method shown end to end.
Understanding the x64 Windows SEH Mechanism
Understanding the x64 Windows SEH mechanism, explaining how structured exception handling works at the binary level on modern 64-bit Windows, for anyone reversing similar targets.
Analyzing and Deobfuscating Polaris's BogusControlFlow Pass - Detecting Opaque Predicates with angr
Analyzing and deobfuscating Polaris's BogusControlFlow pass, using angr to detect opaque predicates and strip the bogus control flow, and the internals laid out in detail.
A Windows 7 Loader Bug Caused by Static DLL Dependency Order - Debugging a Packed Application Crash
A Windows 7 loader bug from static DLL dependency order, debugging a packed application crash down to the loader's resolution sequence, with every step broken down clearly.
Building an Open-Source ARM64 VMP from Scratch: Virtualizing All 121 A64 Base Instructions
Building an open-source ARM64 VMP from scratch, virtualizing all 121 A64 base instructions to create a custom VM-based protector, so you can reproduce it yourself.
Reverse Engineering a Malicious Kernel Driver: Callback Injection, APC, and Remote Thread Injection
Reverse engineering a malicious kernel driver, analyzing its dispatch routines and hooks to understand the rootkit's capabilities and intent, with the tools and offsets documented.
Reversing Cython .pyd Modules: Functions, Type Objects, and Wrapper Functions (Part 1)
Reversing Cython pyd modules, part one: understanding how Cython compiles Python into C extensions and how to read the resulting binaries, including the pitfalls and the fix.
Deobfuscating VMProtect 3.9.4: Junk Code, Code Shuffling, Opaque Predicates, and More
Deobfuscating VMProtect 3.9.4 with symbolic execution, using symbolic analysis to strip the VM's obfuscation and recover the original logic, with the commands and code included.
Tracing How the Disk Model and Serial Number Get Written into ClipSp.sys
Tracing how the disk serial number gets written into ClipSp.sys, following the value from its hardware query all the way down into the driver, with a full walkthrough of the technique.
Tracing a WMI Query to the Kernel: How Get-PhysicalDisk Reads Serial Number and UID
Tracing a WMI query to the kernel, following the full path end to end from a user-mode WMI call down to the kernel provider that answers it, and the mechanism explained clearly.
How Windows DTrace Works Under the Hood: bcdedit → winload.efi → ntoskrnl → dtrace.sys
How Windows DTrace works under the hood, explaining the tracing architecture and how it hooks into the kernel to instrument code, and the bypass logic broken down.
Statically Recovering UE5 UObject Reflection Struct Offsets via IDA String Search
Statically recovering UE5 UObject reflection struct offsets, locating object layouts without running the game for reversing and modding, with the setup and commands all covered.
Reconstructing the CCED 4.0 Encrypted Disk: 1991 Copy Protection, Reverse-Engineered
Reconstructing the CCED 4.0 encrypted disk, reverse engineering the 1991 copy protection scheme to recover the encryption and key material, with the result and caveats spelled out.
Reconstructing a Bitlock Key Disk: Reverse-Engineering 90s Disk Copy Protection
Reconstructing a Bitlock key disk, reverse engineering 1990s disk copy protection to recover the key material from the floppy, and the gotchas flagged along the way.
Fixing the VMProtect 3.5.1 Win32 Runtime Compilation Issue
Fixing the VMProtect 3.5.1 Win32 runtime compilation issue, a troubleshooting walkthrough for a protected binary that won't compile, with the analysis method shown end to end.
Reversing OLLVM Control-Flow Flattening with IDA Hex-Rays Microcode
Reversing OLLVM control-flow flattening with IDA Hex-Rays microcode, using the decompiler's IR to reconstruct the flattened logic, for anyone reversing similar targets.
Reversing the MSVC Compiler: IL Emission and the Warbird Obfuscation Interface
Reversing MSVC compiler IL emission and Warbird obfuscation, tracing how the compiler transforms code into its internal representation, and the internals laid out in detail.
Analyzing the VMProtect 3.9.4 Virtual Machine: Backward Virtual Code and the Final Boss
Analyzing VMProtect 3.9.4's virtual machine flow, tracing the dispatch loop and handler set that drive its newest VM architecture and opcode mapping, so you can reproduce it yourself.
Analyzing the VMProtect 3.0.0beta Virtual Machine: Handler Chaining and Double Encryption
Analyzing VMProtect 3.0.0 beta's virtual machine handler chaining, tracing how its handlers link together to interpret protected code at runtime, with the tools and offsets documented.
Analyzing the VMProtect 2.12.3 Virtual Machine: Handler Flow and Virtual-Register Mapping
Analyzing VMProtect 2.12.3's virtual machine handler flow, mapping how its handlers chain together to interpret and execute virtualized code, including the pitfalls and the fix.
Reversing V8 Bytecode: Format, Version Fingerprinting, and Disassembly
Reversing the V8 bytecode format, fingerprinting the engine version and disassembling bytecode to read the compiled JavaScript internals, with the commands and code included.
Reversing the Rondo Botnet: From CVE-2021-35394 to Persistence and C2
Reversing the Rondo botnet from CVE-2021-35394 to persistence and C2, dissecting its infection chain and command-and-control protocol, with a full walkthrough of the technique.
Tracing Windows Syscalls on 10/11: LSTAR, the SSDT, and Parameter-Count Determination
Tracing Windows syscalls on Windows 10 and 11 via LSTAR and the SSDT, working out parameter counts to hook kernel calls cleanly, and the mechanism explained clearly.
Infinite Coins in a Single-Player Tower Defense Game: A First CE + x64dbg Walkthrough
Infinite coins in a single-player tower defense game: a first Cheat Engine and x64dbg walkthrough of finding and patching the currency value, and the bypass logic broken down.
Decrypting CR3 via MMPFN: Reading the Real Directory Base on Windows 7, 10, and 11
Decrypting CR3 via MMPFN to read the real directory base on Windows 7, 10, and 11, resolving the kernel page table pointer across versions, with the setup and commands all covered.
Extracting a WeCom Login QR Code: Reverse Engineering, File Monitoring, and Screenshot
Extracting a WeCom login QR code via reverse engineering, file monitoring, and screenshots, to capture the login flow programmatically, and the code traced down to the core.
Reversing a Hardware-Detection Tool: Harvesting CPU/GPU Telemetry Through Its Own DLL
Reversing a hardware-detection tool, harvesting CPU and GPU telemetry through its own DLL to understand what it fingerprints, with the result and caveats spelled out.
Unpacking a .NET JIT Protector on .NET Framework 4.8+ with WinDbg TTD
Unpacking a .NET JIT protector on .NET Framework 4.8+ with WinDbg TTD, using time-travel debugging to recover JIT-compiled methods, and the gotchas flagged along the way.
Removing OLLVM Bogus Control Flow with angr Symbolic Execution
Removing OLLVM bogus control flow with angr symbolic execution, using symbolic analysis to strip opaque predicates and junk blocks, with the analysis method shown end to end.
Analyzing Windows Boot: bootmgfw.efi and the Early UEFI Boot Flow
Analyzing Windows boot: bootmgfw.efi and the early UEFI boot flow, tracing how the boot manager hands off to the Windows loader, for anyone reversing similar targets.
The Office 2000 50-Launch Limit: Finding the Confirmation ID in Memory
The Office 2000 50-launch limit: finding the confirmation ID in memory, reversing the classic activation check to lift the trial cap, and the internals laid out in detail.
Three Ways to Protect Android Native Libraries - Function Encryption, Program Header Obfuscation, and a Custom ELF Format
Three ways to protect Android native libraries: function encryption, program-header obfuscation, and a custom ELF format, compared and explained, with the tools and offsets documented.
Replacing the HWID in VMProtect 3.8.4
Replacing the HWID in VMProtect 3.8.4, patching the machine-binding check inside the VM so a protected binary runs on different hardware, so you can reproduce it yourself.
Reversing a Delphi App's Registration Logic: SI ObjectBrowser
Reversing a Delphi app's registration logic, recovering the object model to crack the license check and understand the registration flow, including the pitfalls and the fix.
FreeFileSync: Connection Limits and the Tamper Check
FreeFileSync's connection limits and tamper check, reversing the license gating and integrity verification behind the open-source tool's builds, with the algorithm recovered in detail.
Hooking Every Kernel Export to Analyze a Driver's Logic
Hooking every kernel export to analyze a driver's logic, a brute-force approach to mapping exactly what a Windows driver calls at runtime, with the result and caveats spelled out.
WeChat 4.0 Anti-Revoke with Reminder: Symbol Recovery and String Decryption
WeChat 4.0 anti-revoke with a reminder, recovering symbols and decrypting strings to hook the message-revoke path and keep deleted messages, and the internals laid out in detail.
Reading EPROCESS and CR3 from MmPfnDatabase
Reading EPROCESS and CR3 from MmPfnDatabase, a kernel technique to resolve process structures and page tables from a known physical address, with every step broken down clearly.
Analyzing and Recovering a Major Company's VM Protection
Recovering a VM-protection bytecode-to-native compiler, mapping virtual instructions back to real ones to de-virtualize the protected code, including the pitfalls and the fix.
Reverse Engineering Windows 10's ObRegisterCallbacks and ObUnRegisterCallbacks
Reverse engineering Windows 10's ObRegisterCallbacks and ObUnRegisterCallbacks, explaining how kernel drivers subscribe to object events, with the commands and code included.
Reverse Engineering a Java Equinox OSGi Application: From Encrypted Bundles to the Decryption Hook
Reverse engineering a Java Equinox OSGi application, from encrypted bundles to the decryption hook that unlocks the class files, with a full walkthrough of the technique.
Inside ttEncrypt - Tracing a VM-Protected JNI Cipher Down to SHA-512 and AES
Inside ttEncrypt: tracing a VM-protected JNI cipher down to its SHA-512 and AES primitives, unwrapping the virtualization to recover the algorithm, with the algorithm recovered in detail.
VMProtect 1.81 Under the Hood: VM Structure and De-virtualization
VMProtect 1.81 under the hood: dissecting its VM structure and de-virtualization, mapping the handlers to reconstruct the original native code, and the mechanism explained clearly.
An OLLVM Survival Guide: Building, Understanding, and Defeating Control-Flow Obfuscation
An OLLVM survival guide, collecting practical techniques for navigating flattened control flow, bogus blocks, and instruction substitution, and the bypass logic broken down.
Key Techniques for Dynamic .NET Unpacking
Key techniques for dynamic .NET unpacking, dumping assemblies straight from memory and rebuilding them from their JIT-compiled state, and the internals laid out in detail.
MFC Under the Hood: RTTI, Message Routing, and Class Hierarchy Recovery
MFC under the hood: RTTI, message routing, and class hierarchy recovery, decoding the framework's internals to reconstruct C++ classes, with every step broken down clearly.
Reconstructing RtlCreateHeap: Assembly Optimization Patterns in Windows NTDLL
Reconstructing RtlCreateHeap from Windows NTDLL, decoding the assembly optimization patterns that make the original source hard to follow, with the setup and commands all covered.
Speaking DCERPC to Windows: Creating Services Without CreateService
Speaking DCERPC to Windows directly, creating services without CreateService by hand-crafting the RPC calls to the Service Control Manager, with the result and caveats spelled out.
Breaking VMProtect's Local License Lock: RSA, Big-Number Encryption, and a Working Keygen
Breaking VMProtect's local license lock by reversing its RSA and big-number encryption, then building a fully working offline keygen from the recovered math.
Software Protection, Explained: From Application Packing to Algorithm Protection
A survey of software protection from application packing and code encryption to algorithm-level protection, explaining the full landscape and how each layer actually defends a binary.
Emulating an aarch64 Shared Library with Qiling and Reversing Its VM-Protected RC4
Emulating an aarch64 shared library with Qiling and reversing its VM-protected RC4, decrypting the cipher without native hardware, with a full walkthrough of the technique.
InfinityHook on Modern Windows: An ETW-Based Hook That Survives PatchGuard
InfinityHook on modern Windows: an ETW-based syscall hook that survives PatchGuard, with the reverse-engineered pieces the original writeup left out, with the setup and commands all covered.
How WeChat Channels Encrypts Video: Reversing WxIsaac64 and the 128KB XOR Key
How WeChat Channels encrypts video: reversing the WxIsaac64 PRNG in WebAssembly and the 128KB XOR key it uses, via JS instrumentation and MITM, with the tools and offsets documented.
Reverse Engineering the Alienware Keyboard USB Protocol for Custom RGB Control
Reverse engineering the Alienware keyboard's USB protocol to drive custom RGB lighting, decoding the HID reports with Wireshark for full control, with the commands and code included.
Reverse Engineering KV300+'s Floppy-Disk Copy Protection, 25 Years Later
Reverse engineering the floppy-disk copy protection of KV300+ twenty-five years later, decoding its INT 13 and CRC checks in a retro forensics deep dive.
Source Insight 4.x: Reversing the License Scheme and Building an Offline Keygen
Reversing Source Insight 4.x's license scheme and building an offline keygen, cracking the signature and the base64 registration file format, and the code traced down to the core.
CodeMeter 7.3 Study Notes: The CodeMeter API and Communication Protocol
Study notes on CodeMeter 7.3's API and communication protocol, covering Wibu's AxProtector, AES-128-CBC, CRC32, and SHA1 inside its license handshake.
Cracking a Top-Ranked macOS Screensaver: Tracing the Restore-Purchase Flow to the VIP Flag
Cracking a top-ranked macOS screensaver by tracing its StoreKit restore-purchase flow with Hopper and class-dump until the VIP flag finally shows up, with the commands and code included.
Reversing a Desktop IM Client with Frida - Sending Tampering and Listening to Messages
Reversing a desktop IM client with Frida: class-dump the headers, find the message-send classes, then tamper with outgoing messages and listen in on incoming ones.
Reverse Engineering a Browser's Encrypted Credential Database
Reverse engineering a browser's encrypted credential database, recovering the AES-128-ECB key derivation and decrypting stored passwords for forensic analysis.
Recovering the Encryption Seed in FlexNet Publisher ≤ V11.16
Recovering the encryption seed inside FlexNet Publisher v11.16 and earlier, breaking down the ECC-based license protection that guards commercial software.
Decrypting (and Re-encrypting) Cocos2d Lua Game Scripts
Decrypting and re-encrypting a Cocos2d game's Lua scripts, recovering the custom Huffman substitution cipher in the NDK and scripting it back with IDA.
Extracting OEM BIOS WMI Interfaces from ACPI - Recovering Hidden BIOS Management Endpoints
Recovering hidden OEM BIOS management endpoints by extracting WMI and MOF interfaces from ACPI tables, turning firmware black boxes into documented attack surface.
Reversing InfinityHook: Hooking Every System Call via the ETW CpuClock
A line-by-line analysis of InfinityHook, the Windows technique that hooks every system call by abusing ETW's CpuClock provider, with the SSDT resolution flow fully explained.
A Field Guide to Common Unpacking Techniques
Six classic techniques for finding a packed binary's original entry point, from the ESP stack law to language-specific entry points, with OllyDbg walkthroughs that transfer to any modern target.