Reverse Engineering

Analyze binaries in Binary Ninja with IL views, cross-references and Python automation

Reverse engineer Chrome and Firefox extensions to trace manifests and traffic logic

Hook Android apps with Frida to trace signing logic in CTF challenges

Recover source maps and bundled JavaScript structure in CTF web challenges

Decode ciphers, transform chains and mobile signing logic in CTF challenges

Recover custom binary or text protocols and replay accepted sessions in CTFs

Unpack firmware images and map partitions, boot chains and embedded configs

Hook iOS apps with Frida and inspect Keychain and request signing in CTFs

Recover malware configuration, C2 fields and staged payloads for analysis

Reverse binaries, debug crashes and build native exploits for pwn challenges

Find hidden data in images, audio, video and documents with steganography tools

Recover encrypted ZIP archives with known-plaintext attacks in CTF challenges

Reverse engineer .NET assemblies, obfuscated C# and managed malware with dnSpy

Reverse custom JavaScript VM interpreters and extract opcode tables and bytecode

Reverse engineer binaries with Ghidra for decompilation and cross-references

Reverse stripped Go and Rust binaries using runtime and panic string clues

Analyze binaries, DLLs, APKs and firmware with IDA Pro for reverse engineering

Trace front-end JavaScript signing chains and replay runtime behavior locally

Reverse Mach-O binaries and Apple apps including Swift and Objective-C recovery

Analyze Android and iOS apps with runtime instrumentation and SSL pinning checks

Recover custom binary protocols and Protobuf or gRPC schemas from captured traffic

Recognize obfuscation, packing and anti-debugging tricks in analyzed binaries

Disassemble and decompile binaries to map control flow and recognize code patterns

Dissect network protocols from captured traffic and document custom formats

Recover stripped Go function names and embedded strings from Go malware in Ghidra

Unpack UPX-packed malware, including samples with altered UPX headers, for analysis

Assess UEFI firmware, SPI flash protections and Secure Boot state with CHIPSEC

Unwrap obfuscated JavaScript from phishing pages and skimmers to recover the payload

Deobfuscate multi-layer PowerShell malware with AST analysis and PSDecode to reveal C2

Detect Secure Boot bypasses and bootkits like BlackLotus using dbx and EFI hash checks

Pull C2 endpoints and exfiltration credentials from Agent Tesla RAT samples

Find ransomware kill switches in samples and deploy mutex vaccines to stop execution

Run samples in a CAPEv2 sandbox to capture behavior, dropped files and malware configs

Find memory corruption in ELF binaries and build ROP exploit PoCs with pwntools

Detonate suspicious files and URLs in ANY.RUN to watch process trees and network traffic

Extract filesystems and kernels from firmware images with binwalk and entropy checks

Hunt implants and bootkits in router, IoT and UEFI firmware images

Write YARA rules to classify malware samples by strings, bytes and file structure

Analyze PLC firmware for hardcoded credentials, backdoors and insecure updates

Triage Windows PE malware statically with PEStudio before any sandbox run

Decompile malicious APKs with JADX to trace data theft and C2 behavior

Decompile and deobfuscate .NET malware with dnSpy to extract C2 configs

Instrument iOS apps with Frida to inspect logic, keys and hidden functions

Decompile malware with Ghidra to study C2 protocols and crypto routines

Identify ransomware crypto routines and key flaws that may allow decryption

Analyze Rust malware in IDA and Ghidra past fat pointers and generic code noise

Extract JavaScript and resources from installed Electron apps and restore source

Write IDAPython scripts to analyze binaries, decompile functions and walk call graphs

Decompile .NET, IL2CPP, Java and native code with ILSpy, Ghidra and IDA