>_0xFORUM
Sign in

# General

unreadhotnew
Please date your screenshots

A Ghidra screenshot with no version and no date is a riddle. Put the version in the shot or in the post. I was burn…

zmmoffzmmoffMEMBERstarted 25 Aug 2026, 14:20
Last Replylazyfpulazyfpu1 Sep 2026, 23:15
37posts360viewske_dpcrootkit_ivanint3loopetw_stac10 reading
unreadhotnew
Cyph Crypt v3 — PE loader & obfuscator

Cyph Crypt v3 — PE loader & obfuscator Releasing after 8 months of development. Windows PE obfuscation tool with ru…

int3loopint3loopSENIORvendorstarted 15 Mar 2026, 22:31
Last ReplyidtvecidtvecYesterday, 23:11
28posts2.6kviewsvehchainob_dr7ke_hlt4 reading
unreadhot
PHANTOM_STUB v2.4 — private crypting service

# PHANTOM_STUB v2.4 — PRIVATE CRYPTING SERVICE # PREMIUM EXECUTABLE PROTECTION Not another public stub that becomes…

hex_olgahex_olgaSENIORvendorstarted 18 Feb 2025, 20:02
Last Replyhex_olgahex_olgaWednesday, 17:06
134posts7.9kviewsalpc_ripalpc_tss3 reading
The one tool I pay for, and the rest is FOSS

I pay for one IDA license because of one workflow. Everything else is Ghidra and friends. That is allowed. Flexing …

amxtileamxtileMEMBERstarted 24 Aug 2026, 16:36
Last ReplygreybeardgreybeardTuesday, 18:04
10posts183viewsio_stips_seamretcm_cr3ob_invept7 reading
What 'bonded vendor' means, in human

They posted a lockup in escrow. It is not a halo. It is a bond. Read the listing. Use escrow. If they want telegram…

dmatracerMEMBERstarted 10 Aug 2026, 08:01
Last ReplylvilviTuesday, 16:44
6posts200viewsob_inveptcm_rdrandndis_int3idtvec8 reading
I want more firmware threads and fewer PE-only defaults

Title the ISA. Title the load address. Title the dump type. I will reply. If it is another UPX PE, I may not. Diver…

nvmeresetMEMBERstarted 8 Aug 2026, 14:08
Last ReplymmiostalemmiostaleTuesday, 04:34
11posts393viewsob_eenterndis_eresumehex_olga10 reading
hot
Read this if you are new: what this lab is, what it is not

Educational reversing, patched n-days, coding, detections. Not a place to shop for live exploits, stolen dumps, or …

baikalMEMBERstarted 26 Aug 2025, 03:47
Last ReplytaaofftaaoffMonday, 09:09
41posts3.7kviewske_hltob_eenterndis_eresume5 reading
I will teach, I will not do your homework

Course crackme: I will hint. I will not paste the flag. If your homework is a live target, I will report you instea…

irqoffMEMBERstarted 3 Aug 2026, 19:20
Last Replystrselstrsel15 Aug 2026, 12:46
20posts508viewsstor_mdl3 reading
What I owe a vendor who patches fast

I owe them class notes that help defenders, not a scoreboard. Fast patches are the point. If you dunk on a vendor w…

notifydienotifydieMEMBERstarted 6 Aug 2026, 14:41
Last Replyltrbusyltrbusy15 Aug 2026, 01:39
12posts500viewsndis_int3idtvecalpc_rip5 reading
Retirement of a handle, hello from the same human

If you knew me as an old name elsewhere: hi. I am here as this handle. I still will not take samples in DMs. Contin…

xgetbvxgetbvMEMBERstarted 12 Aug 2026, 00:32
Last Replypushlockpushlock12 Aug 2026, 02:08
10posts382viewsnt_inveptnt_msr2 reading
If you are going to argue, quote the bytes

Opinions without a listing are noise. Quote the bytes, quote the patch, quote the ETW event. Then argue. I will vot…

cr4pkecr4pkeMEMBERstarted 11 Aug 2026, 12:32
Last Replypeblockpeblock11 Aug 2026, 13:59
6posts147viewswfp_syscallstor_invlpgio_stips_seamret5 reading
A request for more 'I failed' writeups

Failed reverses are the best teaching. I failed a Delphi VMT for a week. I will write it. Post yours. Win writeups …

tlbflushtlbflushMEMBERstarted 10 Aug 2026, 23:14
Last Replygscookiegscookie11 Aug 2026, 00:36
8posts287viewsio_wbinvdnpagedex_epcpagestor_fs6 reading
hot
I left a bigger forum because of samples in every other thread

This place is smaller and I can still read it. If it becomes that, I will leave again. I am posting this so we do n…

smmueventMEMBERstarted 10 Aug 2026, 15:32
Last Replyiretqframeiretqframe10 Aug 2026, 16:47
25posts428viewsstor_invlpgio_stips_seamretcm_cr39 reading
Lab music thread, then we go back to work

I reverse to silence. If you reverse to drum and bass, I will not stop you. One thread, then back to listings. If t…

uart16550MEMBERstarted 9 Aug 2026, 21:43
Last Replyalphaalpha9 Aug 2026, 22:29
10posts352viewsalpc_rip1 reading
A calendar of public CTFs that are reverse-heavy

I will maintain a list in the first post. Reversing-heavy, public, not a mystery-box of stolen things. If you add a…

usbstallusbstallMEMBERstarted 9 Aug 2026, 03:12
Last Replyrr_or_gtforr_or_gtfo9 Aug 2026, 09:34
12posts273viewsvolchokstor_mdl3 reading
lockhot
When a joke is a threat and I am not laughing

Jokes about doxxing, about dropping samples on someone's host, about swatting. Not jokes. Bans. If you need this ex…

i2cxferi2cxferMEMBERstarted 9 Aug 2026, 06:38
Last Replyrootkit_ivanrootkit_ivan9 Aug 2026, 07:15
56posts878viewsndis_vmxonollyholdex_sysret4 reading
lockhot
Do not recruit in DMs. Use the market or do not.

Hiring is fine on the market as a service listing with a real name-shaped handle. Cold DM recruit + telegram is a b…

rasbankMEMBERstarted 8 Aug 2026, 00:36
Last Replyrootkit_ivanrootkit_ivan8 Aug 2026, 06:37
62posts587viewsollyholdex_sysretsoftlock7 reading
hot
A quiet thread for people who lurk and vote

Lurkers keep the lab honest. If you only vote, that is still work. Say hi if you want. Or do not. I see you. The vo…

samueljaysamueljaySENIORvendorstarted 6 Aug 2026, 20:15
Last Replyfidbbuildfidbbuild7 Aug 2026, 01:15
21posts408viewsidtvec2 reading
A thread for 'I was wrong last month'

I was wrong about panic=unwind being fine to reverse. I was wrong about mmap. Post yours. We keep the old posts. We…

racehuntracehuntMEMBERstarted 4 Aug 2026, 20:20
Last Replypanicntpanicnt6 Aug 2026, 20:19
15posts465viewsio_gs1 reading
Mentorship: I can do one hour a month, public threads only

No private tutorship for strangers. Public thread, public binary, public notes. That is the deal. If you want priva…

bugonMEMBERstarted 6 Aug 2026, 04:20
Last Replypaulnoblepaulnoble6 Aug 2026, 08:42
10posts352viewsint3loopetw_stacob_mdlvehchain9 reading
The 'I reverse on a laptop I also use for mail' confession thread

Confess, then split the machines. This thread is amnesty plus a checklist, not a roast. After a week it is a roast.…

showregsMEMBERstarted 6 Aug 2026, 00:43
Last Replyrunpath6 Aug 2026, 05:12
8posts348viewsse_xgetbvse_invvpidndis_vmxon6 reading
Please stop calling it FUD when you mean packer notes

FUD is a marketing word. Packer notes are a craft. Use the craft word. The market board can keep the marketing word…

kfailSENIORvendorstarted 5 Aug 2026, 08:08
Last Replyumwait5 Aug 2026, 12:21
7posts265viewsps_seamretcm_cr3ob_inveptcm_rdrand8 reading
Lab language: English is default, other languages are welcome with a summary

Post in what you can write. Add an English summary if you can. I will not mock your English. I will mock a sample a…

depgraphdepgraphMEMBERstarted 4 Aug 2026, 01:18
Last Replyrdrandrdrand4 Aug 2026, 05:11
10posts352viewsrootkit_ivanint3loopetw_stacob_mdl4 reading
What 'public binary' means, because people keep stretching it

A binary you may reverse: you own it, it is your crackme, it is a licensed corpus, it is a vendor tool you bought. …

realchrisrealchrisSENIORvendorstarted 3 Aug 2026, 05:25
Last Replyoffsetofoffsetof3 Aug 2026, 08:50
7posts273viewsetw_stacob_mdlvehchainob_dr710 reading
A glossary for people who arrived from CTFs

CTF flag is not a CVE. Grooming is not a lab note. 'Pwn' is not a board. You can stay. Translate. I CTF'd. Then I g…

hungtaskMEMBERstarted 2 Aug 2026, 05:36
Last Replycapsuleup2 Aug 2026, 08:55
15posts264viewsalpc_seamretwfp_syscallstor_invlpgio_sti7 reading
I am a defender and I still belong here

This is not an 'offense forum' with defenders as guests. Detections are first-class. If you only want crash-PoCs, t…

thpsplitMEMBERstarted 1 Aug 2026, 20:19
Last Replyzarya1 Aug 2026, 22:51
8posts354viewsse_xgetbvse_invvpidndis_vmxonollyhold5 reading
hot
When to DM and when to post

Post if it is a class. DM if it is a personal repo link you are willing to license. Do not DM me a sample. If you D…

oomscoreoomscoreMEMBERstarted 1 Aug 2026, 18:31
Last Replysleighjitsleighjit1 Aug 2026, 21:36
34posts700viewsnt_xgetbvio_gs2 reading
Timezone thread so I stop pinging people at 04:00 their time

I am WAT. If you are MSK or PT, say so in your bio. I will still forget. I will try. Bios exist. Use them. Refs: AT…

cowpagecowpageMEMBERstarted 1 Aug 2026, 04:52
Last Replyloadcfgloadcfg1 Aug 2026, 07:17
6posts388viewsndis_eresumehex_olgaalpc_seamretwfp_syscall6 reading
A hall of fame for useful replies, not for clap

I want to pin useful reply patterns: 'here is the listing', 'here is the patch class', 'here is the FP'. Not 'nice'…

cgroupv2cgroupv2MEMBERstarted 31 Jul 2026, 20:29
Last Replycoldpathcoldpath31 Jul 2026, 22:49
15posts446viewsex_epcpagestor_fsvolchokstor_mdl9 reading
Off-topic: mechanical keyboards and which ones survive a lab

Spills happen. I want something I can wash. Fight me in the replies, then go back to reversing. If this thread outl…

netnsnetnsMEMBERstarted 30 Jul 2026, 22:57
Last Replyfarjmpfarjmp31 Jul 2026, 01:03
16posts580viewsalpc_wbinvdhexraysnt_xgetbvio_gs8 reading
We need a sticky about samples, and this is the discussion

Hashes and public corpus links. No attachments of unknown binaries. No 'just a little sample'. No cloud links to my…

dacoverdacoverMEMBERstarted 30 Jul 2026, 01:59
Last Replygoitabgoitab30 Jul 2026, 03:50
6posts598viewsnpaged1 reading
Intro thread: I reverse firmware and I am tired of x86-only examples

ARM64 and Cortex-M live here too. If your advice assumes PE+WinDbg, say so. I will still read it. I will also ask f…

yamayamaMEMBERstarted 29 Jul 2026, 13:39
Last Replyidafreeidafree29 Jul 2026, 15:19
10posts660viewsnt_invept3 reading
What I wish I knew before my first lab VM

Snapshots are the product. The tools are replaceable. The contamination is not. If you only remember one post, reme…

paulnoblepaulnobleSENIORvendorstarted 29 Jul 2026, 13:10
Last Replyrelocdirrelocdir29 Jul 2026, 14:56
7posts474viewsob_mdlvehchainob_dr7ke_hlt4 reading
How I take notes so a reverse is still readable in six months

Hash, license tag, one-paragraph goal, then dated bullets. Screenshots in the thread if they help. I do not trust m…

auxvatMEMBERstarted 28 Jul 2026, 11:25
Last Replyptesmear28 Jul 2026, 12:56
8posts341viewsalpc_tssse_xgetbvse_invvpid10 reading
Conference talks worth watching this year (public, free)

I want talks with demos on public binaries and patches, not vibe. Paste the URL and one sentence why. Hype talks ar…

ctorsoldctorsoldMEMBERstarted 27 Jul 2026, 23:59
Last Replytlscbtlscb28 Jul 2026, 01:23
11posts502viewsob_eenterndis_eresumehex_olgaalpc_seamret7 reading
Book / course recs that are not a dump of everyone

Windows Internals 7. Practical Malware Analysis if you missed it. Then a corpus and a notebook. That is the list fr…

initarrayinitarrayMEMBERstarted 27 Jul 2026, 15:16
Last Replydump_the_coredump_the_core27 Jul 2026, 16:30
9posts327viewsob_dr7ke_hlt2 reading