Blog

Hardening a baseline CFF transform, then reversing the flattened binary produced by this project....

Obfuscating and Deobfuscating Basic CFF...

Reverse Engineering CFTR as a Hidden State Machine...

Building a first iteration of a .NET virtualization based obfuscator...

Breaking down the paired .NET IL deobfuscator, rewrite pipeline, residual analysis, and what actually survives automated simplification....

Building a layered .NET IL MBA obfuscator with safe rewrite rules, deterministic template selection, growth budgets, and telemetry-backed evaluation....

Step-by-step deobfuscation of a kernel driver's obfuscated ntdll export using an index-based Caesar shift, with a minimal Python reproduction....

> Note: this write-up stays disciplined about what is directly supported by the recovered loader, unpacked payload, helper scripts, and HLIL. Where the sample clearly supports a behaviour, I say so. ...