Deobfuscating APT32 (Ocean Lotus) control flow graphs using Cutter and radare2. Techniques for removing junk code and simplifying obfuscated binaries.
Five methods for patching binaries using Cutter: NOP instructions, reversing jumps, editing assembly, writing bytes, and applying patches from the hex editor.
Continued analysis of APT33’s Dropshot malware. Automating string decryption with r2pipe, resource extraction, and completing the malware analysis with Cutter.
Analyzing APT33’s Dropshot (StoneDrill) malware using Cutter and radare2. String decryption, function analysis, and Jupyter integration for malware research.
Analyzing a packed, self-modifying binary with radare2. Covers UPX-like packers, runtime unpacking, ESIL emulation, and debugging packed executables.
Reverse engineering a Gameboy ROM using radare2. Analyzing the Z80 architecture, Game Boy memory map, and solving a CTF challenge with r2.
Part 2 of the radare2 tutorial series. Covers exploitation, buffer overflows, ROP chains, and writing exploits with radare2.
Step-by-step tutorial for learning radare2 by solving a simple crackme. Covers installation, basic commands, visual mode, analysis, and debugging.