Python noscripts to help analzye go binaries in radare2. Basically this is a port of the IDA pro noscript golang_load_assist to r2

https://github.com/f0rki/r2-go-helpers

@reverseengine

Low-Level Process Hunting on macOS

https://objective-see.com/blog/blog_0x4A.html

@reverseengine

JVM Reverse Engineering

https://medium.com/@Oscar404/jvm-reverse-engineering-99a12fd59eeb

@reverseengine

Reverse-Engineering Android APKs with JADX

https://blog1.neuralengineer.org/reverse-engineering-android-apks-with-jadx-ebded67ceb8f

@reverseengine

Decoding Brickstorms Garble strings

https://medium.com/walmartglobaltech/decoding-brickstorms-garble-strings-b0a60828b3cc

@reverseengine

How to Reverse-Engineer (with AI) an old Demoscene Exe

https://medium.com/@kevin.drapel/how-to-reverse-engineer-with-ai-an-old-demoscene-exe-part-1-07e22e48b0c2

@reverseengine

Reverse engineering of a crypto stealer

https://medium.com/@beardr3d/reverse-engineering-of-a-crypto-stealer-e768f0c20853

@reverseengine

LazyHook is a stealthy API hooking framework that bypasses Host Intrusion Prevention Systems (HIPS) through call stack spoofing. By leveraging CPU-level hardware breakpoints and Vectored Exception Handling, it executes arbitrary code as if it originated from trusted, Microsoft-signed modules—completely fooling behavioral analysis engines that rely on call stack inspection and module origin verification.

Evade behavioral analysis by executing malicious code within trusted Microsoft call stacks
Uses hardware breakpoints + VEH to hijack legitimate functions and spoof module origins

│ 1. Target Function Call
│ ↓
│ 2. CPU Debug Register Triggers (DR0-DR3) │
│ ↓
│ 3. EXCEPTION_SINGLE_STEP Raised │
│ ↓
│ 4. VEH Handler Intercepts Exception │
│ ↓
│ 5. Execution Redirected to Hook Function │
│ ↓
│ 6. CallOriginal() Temporarily Disables Breakpoint
│ ↓
│ 7. Original Function Executes │
│ ↓
│ 8. Breakpoint Re-enabled

#callstackspoofing #edr

X86-64 Assembly Language Programming with Ubuntu

@reverseengine

Linux rootkits explained

https://www.wiz.io/blog/linux-rootkits-explained-part-1-dynamic-linker-hijacking

@reverseengine

Singularity - Stealthy Linux Kernel Rootkit

https://blog.kyntra.io/Singularity-A-final-boss-linux-kernel-rootkit

https://github.com/MatheuZSecurity/Singularity?tab=readme-ov-file#installation

Piercing the Veil: Android Code Deobfuscation

https://www.youtube.com/watch?v=lmHkfKXuN4A

@reverseengine

Updates on ThiefQuest, the Quickly-Evolving macOS Malware

https://blog.trendmicro.com/trendlabs-security-intelligence/updates-on-thiefquest-the-quickly-evolving-macos-malware

@reverseengine

Split 64 bits sep-firmware images

https://github.com/matteyeux/pysep

@reverseengine

Process Injection using DInvoke

https://rastamouse.me/blog/process-injection-dinvoke

@reverseengine

WEIZZ: Automatic Grey-Box Fuzzing for Structured Binary Formats

Slides: https://andreafioraldi.github.io/assets/weizz-issta2020-slides.pdf

Video: https://www.youtube.com/watch?v=MOeUqlFtgwE

Article: https://andreafioraldi.github.io/assets/weizz-issta2020.pdf

Code: https://github.com/andreafioraldi/weizz-fuzzer

@reverseengine

Breaking the BeeStation: Inside Our Pwn2Own 2025 Exploit Journey

https://www.synacktiv.com/en/publications/breaking-the-beestation-inside-our-pwn2own-2025-exploit-journey

@reverseengine

Exploiting an Envoy heap vulnerability

https://blog.envoyproxy.io/exploiting-an-envoy-heap-vulnerability-96173d41792

@reverseengine

Writing an iOS Kernel Exploit from Scratch

https://secfault-security.com/blog/chain3.html

@reverseengine

Rust reversing helper noscript

https://github.com/cha5126568/rust-reversing-helper

@reverseengine

Block Redo & Undo To Achieve Legacy IDA

https://github.com/tmr232/BRUTAL-IDA

@reverseengine