DISASSEMBLE
EVERYTHING_
Writeups on malware analysis, reverse engineering, and CTF challenges — the methodology, the dead ends, and the flag at the end.
NSA Codebreaker 2025 — T2
Forensic analysis of a PCAP in Wireshark uncovers a rogue DNS server, suspicious FTP activity, and the IP addresses assigned to a malicious device on the network.
NSA Codebreaker 2025 — T1
Carving a Linux EXT2 image to surface a hidden malicious artifact and extract its SHA-1 hash.
picoCTF — Investigative Reversing 0
A binary mangles flag data into mystery.png. Reading the transform, then writing its inverse to decode the hidden flag.
picoCTF — WebNet1
Decrypting TLS traffic with a provided private key, then pulling decrypted HTTP objects out of Wireshark to recover the flag.
Flare-On 1 — Challenge 5: 5get_it
Dissecting a 32-bit Windows DLL in Ghidra to walk the keylogger logic and pull the flag out of its character map.
Flare-On 1 — Challenge 4: APT9001.pdf
A deceptive PDF hiding obfuscated JavaScript and encoded shellcode — deobfuscation with Origami and ndisasm, layer by layer, down to the flag.
Flare-On 1 — Challenge 3: such_evil
A PE32 that looks normal until it isn't — chasing shellcode that decodes its own strings at runtime.
Flare-On 1 — Challenge 2: PHP in a PNG
A PHP script hiding inside a PNG, wrapped in layers of mixed hex and octal obfuscation. Unraveling each layer until the flag falls out.
Unveiling Native Java Secrets in APKs
picoCTF "Droids 4": digging native secrets out of an APK, dissecting the binary, and scripting the decryption in Python.
Unraveling the Mysteries of Malware in the Wild
Finding a random piece of malware and taking it apart piece by piece — tooling, methodology, and what the sample was really doing.
grep: no records match that tag
// about
I'm Aaron. I spend my time pulling binaries apart to see how they work — malware samples, CTF challenges, anything with bytes worth reading. These posts document the process honestly: the tooling, the methodology, and the wrong turns along the way. Grab a coffee and dig in.
ghidra.so => found
wireshark.so => found
python3.so => found
ida.so => not found (ghidra is free)
coffee.so => required, loaded