Malware — Qtnes

Apr 22 2026 1 min read

KUSER_SHARED_DATA quick notes

Today I learned about KUSER_SHARED_DATA: a kernel-populated shared page that user mode can read directly. User-mode address User mode reads it at fixed address 0x7FFE0000 (same on x86 and x64). It is …

windows reverse malware

Apr 17 2026 5 min read

7 - The Mole: Reconstructing an Android Malware Beacon from a PCAP

A packet-capture-driven reverse engineering walk through an Android malware dropper, its SID-based gating logic, and the token chain used to reach the final flag.

android malware network-forensics reverse ctf

Apr 16 2026 4 min read

6 - DeadDrop: Emulating an MQTT Bot to Recover a Flag

An Android malware sample communicating over MQTT with RC4-encrypted messages — decoding the obfuscated broker config, reversing the protocol, and building a bot emulator to trigger flag delivery.

android rc4 malware ctf

Feb 06 2026 13 min read

Malware Busters: Unpacking, Reversing, and Decrypting a Go-Based C2 Implant

Full analysis workflow — from safe extraction and manual GDB unpacking through IDA Pro reverse engineering, XOR config decryption, and ultimately intercepting C2 communications on a WIZ Cloud Security Championship challenge.

malware reverse ctf golang upx cryptography