Reverse Engineering Tutorial Explores Hybrid Analysis of Linux x86-64 Crackme Using Ghidra and GDB
A comprehensive tutorial series introduces readers to hybrid reverse engineering of a Linux crackme titled Getting started keygen authored by Mazzotti. The binary presents itself as an introductory challenge yet contains realistic C++ constructs including optimized stack frames, mangled names, and opaque data structures.
The first article begins with basic triage using the file command, revealing a 64-bit PIE ELF dynamically linked against libc and libstdc++. Strings extraction surfaces user prompts such as "Enter a string of characters (no spaces)" and responses including "Bro, what are you trying to do?" and "OMG! You did it! :3".
Static analysis proceeds in Ghidra, where the analyst locates the true entry point at address 0x1340, demangles C++ symbols, and identifies imported std::string operations. The tutorial contrasts non-optimized and optimized (-O1) compilation outputs to explain why the frame pointer is omitted and why Ghidra initially mislabels stack variables such as local_58 and local_7c.
Dynamic validation occurs inside GDB with careful calculation of ASLR-adjusted addresses. Breakpoints placed before and after input allow verification of stack layout, growth and shrinkage behavior, and the actual four-byte size of certain locals that the decompiler had sized incorrectly.
The series stresses iterative refinement: decompiler output supplies hypotheses, the debugger confirms or refutes them, and corrected information is returned to Ghidra to improve type recovery. Subsequent installments will apply mutation testing and reconstruct the hidden validation algorithm in Python.
Related articles
SLEEPWALKER Backdoor Activates on Windows via Single Custom Encrypted Packet
SLEEPWALKER is a passive Windows backdoor that stays dormant in memory until it receives one specially crafted encrypted network packet. Upon activation the implant decrypts and executes custom bytecode written in a proprietary 23-instruction language, eliminating traditional beaconing and reducing network indicators. The malware is delivered as a 64-bit DLL that impersonates dpapi.dll and is loaded via DLL side-loading into ERAAgent.exe, the executable of the ESET Management Agent used in ESET PROTECT deployments. It inspects raw traffic in promiscuous mode, supports multiple transport protocols including TCP, UDP, ICMP, SMB named pipes and VMware VMCI, and can weaken security by modifying registry values such as EveryoneIncludesAnonymous and NullSessionPipes. Configuration is protected with AES-256-CCM and the sample contains no confirmed victims or attributed infrastructure. Researchers have released YARA rules and read-only scanning utilities to detect the implant and its artifacts.
SLEEPWALKER Backdoor Stays Dormant Until Triggered by Single Custom Network Packet
SLEEPWALKER is a stealthy Windows backdoor that remains inactive until it receives one specially crafted encrypted network packet. The implant then decrypts and executes custom bytecode from a proprietary 23-instruction language, enabling chained tasks, data movement, and in-memory code execution without prior outbound communication. The 64-bit DLL masquerades as dpapi.dll and is designed for DLL side-loading into ERAAgent.exe, the executable of the ESET Management Agent used in ESET PROTECT deployments. It inspects raw network traffic in promiscuous mode, supports multiple transport protocols including TCP, UDP, ICMP, SMB named pipes, and VMware VMCI, and can weaken security by modifying registry values such as EveryoneIncludesAnonymous. No confirmed victims or attribution have been identified, and the analysis is based on a single sample. Researchers recommend auditing endpoints for unexpected dpapi.dll files alongside ERAAgent.exe and reviewing related registry settings.
AmnesiaStealer Malware for macOS Hijacks Authenticated Browser Sessions via ClickFix and Chromium
A new macOS malware strain named AmnesiaStealer has emerged that combines infostealing, persistence mechanisms, and the ability to silently take over already authenticated browser sessions. The infection chain begins with a fake GitHub page that tricks victims into copying a malicious command into Terminal using the ClickFix social engineering technique. Once executed, the Rust-based payload collects system data, displays a fake installer window to capture the user password, and attempts to unlock the Keychain for protected credentials. Targeted data includes browser cookies, history, extensions, documents, Apple Notes, Telegram sessions, and cryptocurrency wallet information. A secondary module copies the browser profile and launches a hidden Chromium instance controlled through the Chrome DevTools Protocol, allowing attackers to interact with active sessions that have already passed multi-factor authentication. Persistence is achieved via a disguised LaunchDaemon, and the malware attempts to remove installation artifacts afterward.
GOFFEE Dissects Custom COW Agent Forked from Poseidon Mythic Implant
Angara Security researchers uncovered a custom Go-based Mythic C2 agent named COW used by the Russian-oriented APT group GOFFEE, also known as Paper Werewolf. The agent represents an independent development branch derived from the public Poseidon project rather than its Freyja fork. Samples were heavily protected with Garble obfuscation and a modified UPX packer that required manual header reconstruction for unpacking. Analysis of surviving strings, build paths, and architectural features confirmed Poseidon origins while revealing numerous custom modifications including Windows support, additional C2 profiles, and new command implementations. The group employs the agent alongside other tools such as PowerTaskel, MiRat, and BindSycler for persistent access to Linux and Windows systems across government, energy, telecom, and defense targets. Researchers traced multiple variants through VirusTotal and incident reports, documenting evolutionary changes in configuration handling and peer-to-peer communication mechanisms.