مثال تشخیص Calling Convention

دیس‌اسمبلی:

mov rdi, rax
mov rsi, rbx
call func

این خط داریم دو آرگومان به func میدیم چون RDI/RSI هست پس کد لینوکسه و
Convention = System V


Example of Calling Convention Detection

Disassembly:

mov rdi, rax
mov rsi, rbx
call func

In this line, we are giving two arguments to func because it is RDI/RSI, so it is Linux code and Convention = System V

@reverseengine

Enumerating Windows Clipboard History in PowerShell
https://devblogs.microsoft.com/oldnewthing/20230303-00/?p=107894

@reverseengine

x86-64 GetPc: SYSCALL

https://medium.com/@5yx/x86-64-getpc-syscall-02f7a3100a27

@reverseengine

The ART of obfuscation

https://blog.quarkslab.com/dji-the-art-of-obfuscation.html

@reverseengine

LayeredSyscall Abusing VEH to Bypass EDRs

https://whiteknightlabs.com/2024/07/31/layeredsyscall-abusing-veh-to-bypass-edrs

@reverseengine

VMProtect Source Code (Leaked 07.12.2023)

intel.cc and processors.cc included

mirror:
https://github.com/jmpoep/vmprotect-3.5.1

@reverseengine

VMProtect devirtualizer

https://github.com/archercreat/titan

@reverseengine

Emulating IoT Firmware Made Easy: Start Hacking Without the Physical Device

https://boschko.ca/qemu-emulating-firmware

@reverseengine

Msdocviewer is a Simple Tool that Parses Microsoft's Win32 API

https://github.com/alexander-hanel/msdocsviewer

@reverseengine

Advanced Root Detection & Bypass Techniques

https://8ksec.io/advanced-root-detection-bypass-techniques

@reverseengine

Analysis of Malware Attacked Bank X Customers

https://www.reddit.com/r/MalwareAnalysis/comments/bgqz7m/analysis_of_malware_attacked_bank_x_customers

@reverseengine

Malware Development: Persistence

https://cocomelonc.github.io/persistence/2025/09/14/malware-pers-28.html

@reverseengine

Malware Development Trick 53: Steal Data

https://cocomelonc.github.io/malware/2025/10/22/malware-tricks-53.html

@reverseengine

تحلیل یکی از حملات گروه Lynx Ransomware

Analysis of a Lynx Ransomware attack

https://thedfirreport.com/2025/11/17/cats-got-your-files-lynx-ransomware

@FUZZ0x

Malchela

A Yara & Malware Analysis Toolkit
Written in Rust

https://github.com/dwmetz/MalChela

@reverseengine

Dirty Vanity: A New Approach to Code Injection & EDR Bypass
Clone the shellcode

https://www.deepinstinct.com/blog/dirty-vanity-a-new-approach-to-code-injection-edr-bypass

@reverseengine

Process Injection without R/W target memory and without creating a remote thread

https://github.com/Maff1t/InjectNtdllPOC

@reverseengine

Analyzing a Modern In-the-wild Android Exploit

https://googleprojectzero.blogspot.com/2023/09/analyzing-modern-in-wild-android-exploit.html

@reverseengine

Rusty Bootkit - Windows UEFI Bootkit in Rust

https://github.com/memN0ps/bootkit-rs

@reverseengine

Awesome HyperDbg: A list of awesome resources about HyperDbg

https://github.com/HyperDbg/awesome

@reverseengine