Magic Bytes

Beating Instruction Substitution to Reverse Engineer a VM A few days after publishing the TadpoleVM blog post, I received a direct message on Discord from Garuda.

Reverse engineering a virtual machine with a custom instruction set With the rising popularity of virtual machines as an anti-analysis technique such as VMProtect & Themida, more and more malware samples as well as CTF-challenges are using virtual machines

While browsing the OA-Labs Discord Server, I stumbled upon a few hashes being shared in the malware analysis chat.

Live Variable Analysis, also known as Liveness Analysis, is a data-flow analysis technique used by compilers to identify dead code, specifically, variable assignments whose values are never used.

Reaching definitions is a data-flow analysis technique used in compilers to determine which line could have assigned the value of a variable used at a specific point.

Back in November, I downloaded and analyzed a sample of what I thought was Phorpiex; however, shortly after sharing the post around, Struppigel pointed out that what I analyzed may in fact not be Phorpiex; thus, here we are.

This part got featured in Tmp.0ut #4: https://tmpout.sh/4/11.html Enjoy :^)

After the ELF and Program Headers, we have the section headers.

This part got featured in Tmp.0ut #4: https://tmpout.sh/4/12.html Enjoy :^)

So… You wanna learn something about those weird Linux executables known as ELFs?

Recently I was talking to my friend 0xLegacyy about my little packer project I’m working on, and since I want to extract my position independent loader and append it to a PE (Portable Executable), he suggested I take a look at TitanLdr since it apparently…

A few weeks ago, I got the itch to start reversing some more malware samples to practice my reversing and analysis skills, however something I noticed while looking for a samples is: all malware samples are either obfuscated or packed.

So, ya boi is back with yet another of his geeky interests.

Recently while trying to learn about computer viruses from the 20th century, I came to the conclusion that it is important to understand what the FAT file system is and how it works from a high level perspective.