Using Symbolic Execution to Devirtualise a Virtualised Binary
https://blog.deobfuscate.io/using-symbolic-execution-for-devirtualisation
@reverseengine
https://blog.deobfuscate.io/using-symbolic-execution-for-devirtualisation
@reverseengine
Reverse Engineering Blog
Using Symbolic Execution to Devirtualise a Virtualised Binary
Using symbolic execution to reverse engineer and devirtualise a binary using virtual machine obfuscation.
❤4
Reverse Engineering and Instrumenting React Native Apps
https://pilfer.github.io/mobile-reverse-engineering/react-native/reverse-engineering-and-instrumenting-react-native-apps
@reverseengine
https://pilfer.github.io/mobile-reverse-engineering/react-native/reverse-engineering-and-instrumenting-react-native-apps
@reverseengine
pilfer.github.io
Reverse Engineering and Instrumenting React Native Apps
An adventure involving injecting JavaScript into the React Native global context, accessing onPress events, and overriding prototypes
❤4
BYOVD to the next level (part 2) Rootkit
https://blog.quarkslab.com/exploiting-lenovo-driver-cve-2025-8061_part2.html
@reverseengine
https://blog.quarkslab.com/exploiting-lenovo-driver-cve-2025-8061_part2.html
@reverseengine
Quarkslab
BYOVD to the next level (part 2) — rootkit like it's 2025 - Quarkslab's blog
Bring Your Own Vulnerable Driver (BYOVD) is a well-known post-exploitation technique used by adversaries. This blog post is part of a series. In part one we saw how to abuse a vulnerable driver to gain access to Ring-0 capabilities. In this second and final…
❤1
Microsoft Windows Cloud Files Minifilter TOCTOU Privilege Escalation
https://blog.exodusintel.com/2025/10/20/microsoft-windows-cloud-files-minifilter-toctou-privilege-escalation
@reverseengine
https://blog.exodusintel.com/2025/10/20/microsoft-windows-cloud-files-minifilter-toctou-privilege-escalation
@reverseengine
Exodus Intelligence
Microsoft Windows Cloud Files Minifilter TOCTOU Privilege Escalation - Exodus Intelligence
By Michele Campa Overview In this blog post we take a look at a race condition we found in Microsoft Windows Cloud Minifilter (i.e. cldflt.sys ) in March 2024. This vulnerability was patched in October 2025 and assigned CVE-2025-55680 . The vulnerability…
❤1
Let's Create Some Polymorphic PIC Shellcode
https://g3tsyst3m.com/shellcode/pic/Let's-Create-Some-Polymorphic-PIC-Shellcode!/
@reverseengine
https://g3tsyst3m.com/shellcode/pic/Let's-Create-Some-Polymorphic-PIC-Shellcode!/
@reverseengine
❤1
A Collection of incredible Malware Analysis and Reverse Engineering
https://x.com/embee_research/status/1674001545476861954
@reverseengine
https://x.com/embee_research/status/1674001545476861954
@reverseengine
X (formerly Twitter)
Matthew (@embee_research) on X
A collection of incredible (non-corporate) malware analysis and reverse engineering blogs that I have personally enjoyed over the years.
All focused on education and knowledge sharing of malware/RE topics.
[1/14] 🧵
(In no particular order)
#malware #education
All focused on education and knowledge sharing of malware/RE topics.
[1/14] 🧵
(In no particular order)
#malware #education
❤1
MuddyWater’s DarkBit ransomware cracked for free data recovery 😂🫵
https://www.bleepingcomputer.com/news/security/muddywaters-darkbit-ransomware-cracked-for-free-data-recovery
@FUZZ0x
https://www.bleepingcomputer.com/news/security/muddywaters-darkbit-ransomware-cracked-for-free-data-recovery
@FUZZ0x
BleepingComputer
MuddyWater’s DarkBit ransomware cracked for free data recovery
Cybersecurity firm Profero cracked the encryption of the DarkBit ransomware gang's encryptors, allowing them to recover a victim's files for free without paying a ransom.
❤1
Adaptix C2
https://github.com/Adaptix-Framework/Extension-Kit
Blogs:
https://adaptix-framework.gitbook.io/adaptix-framework/blogs
https://github.com/Adaptix-Framework/AdaptixC2
Document:
https://adaptix-framework.gitbook.io/adaptix-framework
@reverseengine
https://github.com/Adaptix-Framework/Extension-Kit
Blogs:
https://adaptix-framework.gitbook.io/adaptix-framework/blogs
https://github.com/Adaptix-Framework/AdaptixC2
sudo apt install mingw-w64 make
wget https://go.dev/dl/go1.24.4.linux-amd64.tar.gz -O /tmp/go1.24.4.linux-amd64.tar.gz
sudo rm -rf /usr/local/go /usr/local/bin/go
sudo tar -C /usr/local -xzf /tmp/go1.24.4.linux-amd64.tar.gz
sudo ln -s /usr/local/go/bin/go /usr/local/bin/go
sudo apt install gcc g++ build-essential cmake libssl-dev qt6-base-dev qt6-websockets-dev qt6-declarative-dev
git clone https://github.com/Adaptix-Framework/AdaptixC2.git
cd AdaptixC2
make server
make extenders
make client
cd dist
chmod +x ssl_gen.sh
./ssl_gen.sh
./adaptixserver -profile profile.json
./AdaptixClient
Document:
https://adaptix-framework.gitbook.io/adaptix-framework
@reverseengine
GitHub
GitHub - Adaptix-Framework/Extension-Kit: AdaptixFramework Extension Kit
AdaptixFramework Extension Kit. Contribute to Adaptix-Framework/Extension-Kit development by creating an account on GitHub.
❤1
Linux Rootkit Malware
https://www.fortinet.com/blog/threat-research/deep-dive-into-a-linux-rootkit-malware?utm_source=chatgpt.com
@reverseengine
https://www.fortinet.com/blog/threat-research/deep-dive-into-a-linux-rootkit-malware?utm_source=chatgpt.com
@reverseengine
Fortinet Blog
Deep Dive Into a Linux Rootkit Malware
An in-depth analysis of how a remote attacker deployed a rootkit and a user-space binary file by executing a shell noscript.…
❤1
Rootkit Technique to Hook the SSDT via Alt Syscalls
https://fluxsec.red/hells-hollow-a-new-SSDT-hooking-technique-with-alt-syscalls-rootkit
Poc: https://github.com/0xflux/Hells-Hollow
@reverseengine
https://fluxsec.red/hells-hollow-a-new-SSDT-hooking-technique-with-alt-syscalls-rootkit
Poc: https://github.com/0xflux/Hells-Hollow
@reverseengine
fluxsec.red
SSDT Hooking via Alt Syscalls for ETW Evasion
Discover how Hells Hollow introduces a novel SSDT hook primitive in Rust by manipulating the kernel’s Alt Syscalls mechanism—enabling ETW bypass, return-value patching, and PatchGuard-resistant rootkit capabilities on Windows 11. Deep dive with POC code and…
❤1
This media is not supported in your browser
VIEW IN TELEGRAM
Kill EDR Processes Permanently
User-Mode Code and Its Rootkit
https://github.com/SaadAhla/dark-kill
@reverseengine
User-Mode Code and Its Rootkit
https://github.com/SaadAhla/dark-kill
@reverseengine
❤1