Reverse Engineering
A clean dark homepage for publishing reverse engineering write-ups, malware analysis, CTF notes and low-level research.
Posts
How Agile.NET virtualizes a method into the _CSVM resource, and how a generic devirtualizer recovers it: structural handler discovery, operand decoding by interpreting the handler's own reader, semantic IR, CFG/SSA/SCCP, EH-aware lowering, and verified CIL reconstruction.
Read researchStatic analysis of SourceGuardian PRO evaluation loaders for PHP 5.5–8.5: the sg_load container, TLV preheader, Blowfish-CBC-IV0 sections, LZO1X compression, ROL1 checksum gates, and the SOURCEGUARDIAN bytecode container — recovered offline in IDA Pro and verified against real encoded fixtures across eight PHP builds.
Read researchStatic analysis of IonCube v15 loaders for PHP 8.1–8.4: HR+c framing, MT4IC, B180 blocks, PRNG6 opcode-XOR, versioned handler tables, and interned strings.
Read researchFull technical walkthrough covering validation flow, elegant patch strategy, and a solver-based approach for generating a valid serial without patching.
Read write-up