reversemedium
Три Лика Тени (Three Faces of Shadow)
hackerlab
Task: PE64 Windows binary with massive obfuscation — anti-debug, custom VM, fake flags, Braille art distractions, and obfusheader decoys — all red herrings. Solution: discovered patched _cexit CRT function jumping to hidden code in .idata section that decrypts the real flag via byte subtraction (0x69).
$ ls tags/ techniques/
pe64obfuscationmingwred_herringwindows_peanti_debugcustom_vmcrt_hooksidata_injectionbraille_artobfusheaderfake_flags
cexit_patching_detectioncrt_exit_flow_analysisidata_section_code_injectionbinary_patching_detectionsubtraction_cipher_reversalred_herring_elimination
🔒
Permission denied (requires tier.pro)
Sign in to access full writeups
Create a free account with GitHub to get started.
$ssh [email protected]