reversemedium

Challenge Scenario (rev_gameloader)

HackTheBox

Task: Investigate a Godot game that compromised a computer despite updated antivirus. Solution: Extract AES-256 key from EXE .data section, decrypt PCK file, deobfuscate GDScript malware to find C2 server and flag parts in HTTP response headers.

$ ls tags/ techniques/
obfuscationgamemalwarec2godotpckaes-256-cfbgdscripthttp-headers
godot_pck_decryptionaes_key_extractiongdscript_deobfuscationc2_emulationhttp_header_inspection
🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Create a free account with GitHub, then upgrade to Pro.

$ssh [email protected]