reverseProhard
It's over
hackerlab
Task: Reverse engineer a WinRAR SFX-wrapped PE executable with anti-debug and decoy flag. Solution: Discovered self-modifying code in PE overlay that decrypts hidden ChaCha20 verification shellcode using SUB+XOR transformation.
$ ls tags/ techniques/
xormingwshellcodechacha20anti_debugself_modifying_codesfx_unpackingdecoy_flagpe_overlayvirtualprotect
WinRAR SFX unpackingDecoy flag identification via XOR decodingSelf-modifying code analysis in PE overlayRuntime shellcode decryption (SUB+XOR)ChaCha20 parameter extraction from x86-64 assemblyObfuscated constant recovery via XOR with 0xa5a5a5a5
🔒
Permission denied (requires tier.pro)
Sign in to access full writeups
Sign in with GitHub to continue. No email required.
$sign in$ grep --similar
Similar writeups
- [forensics][Pro]Чувак, где мой флаг? (Dude, Where's My Flag?)— hackerlab
- [reverse][free]Debugme— HackTheBox
- [reverse][Pro]task1.out (re2)— rev-kids20.forkbomb.ru
- [reverse][Pro]Очень защищенный банк (Super Protected Bank)— duckerz
- [reverse][Pro]Reverse Me— taipanbyte