Malware Analysis

ROP defeats non-executable memory by chaining existing instruction sequences (“gadgets”) ending in ret. This post covers the technique from vulnerable-binary basics through modern variants (JOP, SROP, BROP) and the mitigations (CET, shadow stacks, CFI/CFG) that make ROP progressively harder in 2026.

An analyst-facing tour of the obfuscation techniques that show up in real malware samples, code, binary, and anti-analysis, with real-world examples and the modern EDR context that shapes how obfuscation actually works in the wild today.

This article provides an in-depth overview of advanced malware analysis techniques, including manual and automated disassembly, decompilers, debuggers, and dynamic binary instrumentation (DBI), with examples of tools and outputs provided for each technique.

This article explores advanced heap spraying techniques used by red teams and pen testers to exploit vulnerabilities in software applications, including non-ASLR and ASLR-based heap spraying, and Unicode heap spraying, with real-world examples and tools.

This article introduces and explains exploit development techniques, best practices, and examples for a technical audience of red teams and pen testers.

A working analyst’s tour of dynamic malware analysis. Static triage of the PE header in PEStudio and Detect It Easy, unpacking with x64dbg and Scylla, memory forensics with Volatility 3, VBA macro de-obfuscation with olevba, network monitoring with Wireshark, and the anti-analysis tricks (PEB checks, RDTSC timing, MAC address sniffing, sandbox-detection via mouse movement) that modern families ship by default. Case studies include WannaCry, TrickBot, and Emotet.

A working operator’s view of ransomware in 2026. How the RaaS model splits the work between operators and affiliates, the double- and data-only extortion patterns that replaced “just encrypt the files,” the state of the ecosystem after Operation Cronos took down LockBit and ALPHV exit-scammed itself, what reverse engineering a current sample actually looks like, and the incident response sequence when the ransom note lands.

A working primer on static and dynamic PE analysis from the operator’s seat. What an EDR actually sees when your payload lands on disk, why your IAT and entropy and PDB paths are doing most of the talking, and a self-audit loop that catches the obvious tells before the payload ever touches a customer machine.

PE/ELF/Mach-O structure, x86/x64 assembly, disassembly versus decompilation, dynamic analysis with debuggers and Frida, and the anti-RE tricks you’ll meet on the way.