Reverse Engineering Using Radare2

Dec. 16, 2017

This article assumes the reader has some basic knowledge in coding and assembly language. If not, a good resource for this would be the assembly tutorial from tutorialspoint....

Reverse Engineering, Radare2, Hacking, Malware Analysis

Snojan Analysis

Jan. 11, 2018

So this is my analysis on the snojan malware. My goal for my articles is to write about different malware samples that I collect in my honeypot. I hate finding a sample and looking up analyses on it only to find that nobody has taken the time to really look at it, so this is my remedy for that....

Reverse Engineering, Radare2, Malware Analysis, Malware

Linux Malware Analysis — Why Homebrew Encryption is Bad

Feb. 2, 2018

Linux is one of my favorite operating systems, but you seldom see malware for it, so I was pretty interested when Linux Malware was caught by my honeypot. This article will be my analysis of the sample, particularly the decryption function that was used throughout it. It’s a good example of why using your own encryption algorithm isn’t very secure....

Reverse Engineering, Radare2, Malware Analysis, Malware, Linux

Automating RE Using r2pipe

July 9, 2018

In this article we will go over Radare2’s r2pipe and its uses. R2pipe is the API for Radare2 that allows you to automate Radare2 and interact with a session from outside of Radare2. This can be used to simplify certain tasks, emulate a certain section of code, decrypt strings, or even reverse engineer multiple binaries with ease. In this specific example we will revisit a malware sample that I have detailed in a previous article titled Linux Malware Analysis — Why Homebrew Encryption is Bad. We will use r2pipe and Python to automate the process of deobfuscating strings within the binary....

Reverse Engineering, Radare2, Hacking, Malware Analysis, Malware, Scripting, Automation, r2pipe


Page 1 of 1