forensicsProhard

Ett till pajat fonster

undutmaning

Task: Windows BSOD crash dump with custom kernel driver that reads flag from registry, XORs it, stores in XMM registers, then triggers BSOD. Solution: Parse CONTEXT structure to extract XMM14/XMM15, recover XOR key from last 4 bytes, decrypt flag.

$ ls tags/ techniques/
memory_forensicsbsodxor_encryptionwindows_dumpkernel_driverxmm_registerscontext_structureavx_instructionsregistry_analysiscrash_dump_analysis
xor_key_recoverypagedu64_header_parsingcontext_structure_analysisxmm_register_extractionkernel_driver_reverse_engineeringvpackuswb_utf16_to_ascii
đź”’

Permission denied (requires tier.pro)

Sign in to access full writeups

Sign in with GitHub to continue. No email required.

$sign in

$ grep --similar

Similar writeups