A deep Windows 11 24H2 kernel-reversing write-up about five vulnerability candidates that looked reportable in static analysis - a near-4 GiB FileCrypt integer wrap, an ahcache kernel-address oracle, a BindFlt minifilter underflow, an IntelPEP pool overflow, and a KSecDD raw callback registration primitive - and the exact runtime, producer-contract, filesystem, and boot-lifetime invariants that killed every one before it reached MSRC.

A deep reverse-engineering write-up of the most promising false positive of a Windows 11 24H2 kernel-driver research - a seemingly unprivileged arbitrary-kernel-address read in condrv.sys where a console server names a raw SourcePtr that the driver memmoves into a client's MDL-mapped output buffer via IOCTL_CONDRV_COMPLETE_IO - that survived a triage pass, a five-item adversarial kill-list, and full protocol extraction, produced a self-verifying dual-role PoC whose control case passed cleanly, and then collapsed the instant a kernel VA was named, killed by an inlined ProbeForRead the Hex-Rays decompiler folded to nothing.

A reverse-engineering write-up of a refuted sandbox-escape candidate in bfs.sys the Brokering File System on Windows 11 24H2 build 26100 - the device opens for a normal token and its per-IOCTL capability gate is passable by forging an AppContainer lowbox token carrying bfs's capability SID via NtCreateLowBoxToken, but the path and rename brokering opens every target with OBJ_FORCE_ACCESS_CHECK in the caller's own non-impersonated context against an FLT-normalized canonical name, so the broker can only ever touch files the sandbox could already open itself, leaving no path confusion, no TOCTOU, no privilege amplification, and nothing to report.

A full pwn write-up of the HTB box "FireFlow", chaining an unauthenticated Langflow RCE (CVE-2026-33017), credential looting from environment variables, a JWT 'none' algorithm bypass on an internal MCP AI Tool Registry, malicious tool registration for in-cluster RCE, and Kubernetes nodes/proxy abuse via kubelet /exec to read the root flag from a privileged node-exporter pod.

Reverse engineering write-up for the HTB challenge "rev_dudsat" - recovering a flag hidden in the residuals of satellite telemetry by reconstructing a permutation table built at process startup.

HTB reversing write-up. Outer ELF is a decoy; the real entry point lives in a hidden RWE segment with no section header, jumps into a DEFLATE-packed nested ELF, which mmap-XORs a 62-byte bytecode for a stack VM, which runs a tiny DFT magnitude check whose output bitmap, packed MSB-first, is the flag.

SANDY is a Huntress 2025 CTF reverse engineering challenge where you analyze a malicious binary, uncover its logic, and extract the hidden flag.

Reverse engineering RC4 in Windows malware using SystemFunction032 to extract keys and decrypt the payload.

NahamCon2025 CTF Malware Reversing Challenge

A PowerShell toolkit that automates enabling TCP/IP, adding -T7806, enabling the DAC, and decrypting SQL Server linked-server passwords - for legal, authorized use only.