Small interactive drills live here so the homepage can stay focused on the blog itself.
Labs
glibc heap drill
Model a small tcache poisoning sequence: stabilize the layout, free the victim, corrupt the forward pointer, and reclaim the target allocation.
layout
victim
free
poison
claim
malware triage
Work the sample the way you would in a real triage pass: validate the unpack pivot, identify the cross-process launch, and recover the live C2 path.
triage
loader
launch
c2
best label for the loader stage
most likely cross-process launch primitive
which route is the live beacon channel
control-flow recovery
Treat the snippet like a real reversing note: isolate the dispatcher, explain the fan-out, and resolve the branch that reaches the winning path.
inspect
symbol
xrefs
sink
best name for `sub_4012d0`
which clue explains the fan-out
which branch reaches the winning sink