RE · malware
Reverse engineering the worm payload via IAT resolution through sqlsort.dll — tracing the propagation logic from the UDP spray to the shellcode entry point.
RE · DOS · malware
Complete reverse engineering walkthrough of the Michelangelo DOS virus — boot sector infection, payload trigger logic, and disk overwrite mechanics.
RE · DOS · malware
Annotated walkthrough of the DOS7 sample — disassembly, infection mechanics, and payload analysis.
RE · malware · x86_64
Annotated Hex-Rays decompilation of an x86_64 bot sample (with Joshua Harris) — beacon construction sending hashed bot_id / hostname / user to a C2 server, anti-debug timing checks, and consolidated obfuscation noise stripped down to intent.
x86 ASM · puzzles
Working through every exercise in xorpd's "little black book" — scanned handwritten notes for each snippet, covering bit manipulation, loop invariants, and obfuscation primitives.