How to Build

With MinGW (on Windows):

For hotspot_sim.c:

gcc hotspot_sim.c -o hotspot_sim.exe -mwindows

mwindows to remove the console window and build the GUI

For gen_serial.c:

gcc gen_serial.c -o gen_serial.exe

With MSVC (Developer Command Prompt):

hotspot_sim.c:

cl /EHsc hotspot_sim.c user32.lib gdi32.lib

gen_serial.c:

cl /EHsc gen_serial.c

How to test and use

Inside a Windows VM, be sure to run the VM and snapshot for the hotspot_sim.exe file

Give it a name of your choice, for example Ali. Now either create the serial with gen_serial.exe Ali and paste it in the Serial field, or run the generation function inside the debugger and read the expected value

If the serial is correct, the MessageBox will display success

A short guide to analyzing in x64dbg / IDA

Search Strings
: "Name:", "Serial:", "%04X-%04X-%04X", "Activate & Play" → References usually indicate important functions

IsDebuggerPresent: breakpoint
On IsDebuggerPresent or the address that calls it, if it returns 1, the program will hit the error path

GetWindowTextA: breakpoint
Put it to see the value of name and serial in memory

Constants: Search for XOR constants (0xA5A5A5A5, 0x5A5A5A5A, 0x3C3C3C3C) or the pattern %04X-%04X-%04X will take you to the serial generation function

Comparison: breakpoint on stricmp to see the two buffers before comparing

MessageBoxA:
Putting a breakpoint here will quickly tell you which branch was executed successfully or failed

@reverseengine

Venom C2

https://github.com/boku7/venom

@reverseengine

تحلیل استفاده از ابزارهای RMM برا بایپس EDR در حملات گروه های باج افزاری Medusa و DragonForce

Analysis of the use of RMM tools to bypass EDR in Medusa and DragonForce ransomware attacks


https://zensec.co.uk/blog/how-rmm-abuse-fuelled-medusa-dragonforce-attacks

@FUZZ0x

Offensive Development

https://klezvirus.github.io/posts/OffDev-ShellcodeRetrieval

@reverseengine

Bootloader to Iris: A Security Teardown of a Hardware Wallet

https://hhj4ck.github.io/en/iris-wallet-security-teardown.html

@reverseengine

Elastic Defend Bypass

https://binary-win.github.io/2025/08/22/UAC-Bypass.html

@reverseengine

Malware Development  Evading Diaries

  NTFS Files Attributes:
  FuncIn
Code Cave
  Stolen Certificate
  Redirect Antivirus Website Evading Techniques:
  Shortcut Hiding
  Disabling Antivirus
  Adding Antivirus Exception
  Fake Signature
  Mark-Of-The-Web (MOTW) Bypass
Return Address Spoofing
Runtime Function Decryption
  DLL Unhooking
How DLL Unhooking works
Unhooking Strategies
Evasion Using Direct Syscalls
Key Aspects of This Technique
Operational Mechanis
Featured Windows APIs
Unloading Module With FreeLibrary
Operational Overview
Key Aspects of This Technique
Featured Windows APIs
References

@reverseengine

BalckPill

A Linux kernel rootkit in Rust

https://github.com/DualHorizon/blackpill

@reverseengine

Reversing

https://mohitmishra786.github.io/reversingBits

@reverseengine

Reverse Engineering Challenges

https://challenges.re

@reverseengine

Books

https://drive.google.com/drive/folders/1e5omiLCDC_3_rTbTMAvAht4g_l0SYmwE

@reverseengine

Hacking a Smart Home Device

https://jmswrnr.com/blog/hacking-a-smart-home-device

@reverseengine

Reversing Microsoft Defender's Signatures for Evasion

https://retooling.io/blog/an-unexpected-journey-into-microsoft-defenders-signature-world

@reverseengine

EDR Bypasses Techniques Written in Rust for Windows 10


https://github.com/Arasimnida/EDR-bypass-rs

@reverseengine

Exploiting Windows Kernel

CVE-2023–28218

https://theori.io/blog/exploiting-windows-kernel-wild-copy-with-user-fault-handling-cve-2023-28218

@reverseengine

Technical Analysis of Pegasus Spyware

@reverseengine

38C3 Reverse Engineering

https://www.youtube.com/watch?v=tnVD30fM5Tg

@reverseengine