{
  "version": "https://jsonfeed.org/version/1.1",
  "title": "nil · zx41r · Zohir Hakmi",
  "home_page_url": "https://zx41r.dev/",
  "feed_url": "https://zx41r.dev/feed.json",
  "description": "security researcher and reverse engineer",
  "language": "en-US",
  "icon": "https://zx41r.dev/favicon.svg",
  "favicon": "https://zx41r.dev/favicon.svg",
  "authors": [
    {
      "name": "Zohir Hakmi",
      "url": "https://zx41r.dev/about/",
      "avatar": "https://zx41r.dev/favicon.svg"
    }
  ],
  "hubs": [
    {
      "type": "WebSub",
      "url": "https://pubsubhubbub.superfeedr.com/"
    }
  ],
  "_hub": {
    "type": "WebSub",
    "url": "https://pubsubhubbub.superfeedr.com/"
  },
  "items": [
    {
      "id": "https://zx41r.dev/posts/fddr1p/",
      "url": "https://zx41r.dev/posts/fddr1p/",
      "title": "fddR1p Reverse Engineering itc{flags} Official Writeup",
      "summary": "A rev binary that hands its own ptrace slot to a fileless child, then dares you to take it back. Two anti-debug gates, a memfd-only guardian, and a key that only half-exists on disk.",
      "content_text": "A rev binary that hands its own ptrace slot to a fileless child, then dares you to take it back. Two anti-debug gates, a memfd-only guardian, and a key that only half-exists on disk.",
      "date_published": "2026-08-01T00:00:00.000Z",
      "date_modified": "2026-08-01T00:00:00.000Z",
      "tags": [
        "ptrace",
        "memfd",
        "linux-internals",
        "gdb",
        "pwndbg",
        "aes-gcm",
        "anti-debug",
        "reverse-engineering",
        "ctf"
      ],
      "image": "https://zx41r.dev/og/fddr1p.png",
      "banner_image": "https://zx41r.dev/og/fddr1p.png",
      "authors": [
        {
          "name": "Zohir Hakmi",
          "url": "https://zx41r.dev/about/",
          "avatar": "https://zx41r.dev/favicon.svg"
        }
      ]
    },
    {
      "id": "https://zx41r.dev/posts/c00ked-d3v/",
      "url": "https://zx41r.dev/posts/c00ked-d3v/",
      "title": "c00ked d3v Full NexZeroCTF OSINT/4n6 Chain",
      "summary": "Full solve for c00ked d3v recovering a scrubbed trail from GHCR layers to a dead host, then from deleted GitHub activity to a staging mirror, DNS TXT dead drop, and the final Gist.",
      "content_text": "Full solve for c00ked d3v recovering a scrubbed trail from GHCR layers to a dead host, then from deleted GitHub activity to a staging mirror, DNS TXT dead drop, and the final Gist.",
      "date_published": "2026-05-02T00:00:00.000Z",
      "date_modified": "2026-05-02T00:00:00.000Z",
      "tags": [
        "nexzeroctf",
        "github",
        "ghcr",
        "docker",
        "favicon-hash",
        "fofa",
        "urlscan",
        "github-api",
        "gitlab",
        "dns",
        "gist",
        "osint",
        "forensics"
      ],
      "image": "https://zx41r.dev/og/c00ked-d3v.png",
      "banner_image": "https://zx41r.dev/og/c00ked-d3v.png",
      "authors": [
        {
          "name": "Zohir Hakmi",
          "url": "https://zx41r.dev/about/",
          "avatar": "https://zx41r.dev/favicon.svg"
        }
      ]
    },
    {
      "id": "https://zx41r.dev/posts/phobos/",
      "url": "https://zx41r.dev/posts/phobos/",
      "title": "Phobos Ransomware — Malware Analysis Walkthrough",
      "summary": "Deep analysis of Phobos ransomware: encrypted configuration, process termination, persistence mechanisms, and file encryption strategies.",
      "content_text": "Deep analysis of Phobos ransomware: encrypted configuration, process termination, persistence mechanisms, and file encryption strategies.",
      "date_published": "2026-01-04T00:00:00.000Z",
      "date_modified": "2026-01-04T00:00:00.000Z",
      "tags": [
        "ransomware",
        "phobos",
        "ida-pro",
        "x32dbg",
        "aes-encryption",
        "crc32",
        "malware-analysis",
        "reverse-engineering"
      ],
      "image": "https://zx41r.dev/og/phobos.png",
      "banner_image": "https://zx41r.dev/og/phobos.png",
      "authors": [
        {
          "name": "Zohir Hakmi",
          "url": "https://zx41r.dev/about/",
          "avatar": "https://zx41r.dev/favicon.svg"
        }
      ]
    },
    {
      "id": "https://zx41r.dev/posts/red-stealer/",
      "url": "https://zx41r.dev/posts/red-stealer/",
      "title": "Red Stealer — Threat Intelligence Walkthrough",
      "summary": "Analyze a suspicious executable using VirusTotal and MalwareBazaar to extract IOCs, identify C2 infrastructure, MITRE ATT&CK techniques, and privilege escalation mechanisms.",
      "content_text": "Analyze a suspicious executable using VirusTotal and MalwareBazaar to extract IOCs, identify C2 infrastructure, MITRE ATT&CK techniques, and privilege escalation mechanisms.",
      "date_published": "2026-01-03T00:00:00.000Z",
      "date_modified": "2026-01-03T00:00:00.000Z",
      "tags": [
        "virustotal",
        "malwarebazaar",
        "threatfox",
        "redline-stealer",
        "ioc",
        "mitre-attack",
        "c2",
        "threat-intelligence",
        "malware-analysis"
      ],
      "image": "https://zx41r.dev/og/red-stealer.png",
      "banner_image": "https://zx41r.dev/og/red-stealer.png",
      "authors": [
        {
          "name": "Zohir Hakmi",
          "url": "https://zx41r.dev/about/",
          "avatar": "https://zx41r.dev/favicon.svg"
        }
      ]
    },
    {
      "id": "https://zx41r.dev/posts/re101/",
      "url": "https://zx41r.dev/posts/re101/",
      "title": "RE101 — Reverse Engineering Fundamentals Walkthrough",
      "summary": "Analyze diverse file types including binaries, obfuscated scripts, and corrupted archives using reverse engineering techniques to extract hidden flags.",
      "content_text": "Analyze diverse file types including binaries, obfuscated scripts, and corrupted archives using reverse engineering techniques to extract hidden flags.",
      "date_published": "2026-01-03T00:00:00.000Z",
      "date_modified": "2026-01-03T00:00:00.000Z",
      "tags": [
        "base64",
        "jsfuck",
        "brainfuck",
        "zip-repair",
        "stack-strings",
        "xor-encryption",
        "ida",
        "ghidra",
        "hex-editor",
        "malware-analysis",
        "reverse-engineering"
      ],
      "image": "https://zx41r.dev/og/re101.png",
      "banner_image": "https://zx41r.dev/og/re101.png",
      "authors": [
        {
          "name": "Zohir Hakmi",
          "url": "https://zx41r.dev/about/",
          "avatar": "https://zx41r.dev/favicon.svg"
        }
      ]
    },
    {
      "id": "https://zx41r.dev/posts/ransomed/",
      "url": "https://zx41r.dev/posts/ransomed/",
      "title": "Ransomed — Malware Analysis Walkthrough",
      "summary": "Dynamic analysis and memory forensics: stack-strings, API resolution, shellcode and process hollowing.",
      "content_text": "Dynamic analysis and memory forensics: stack-strings, API resolution, shellcode and process hollowing.",
      "date_published": "2026-01-02T00:00:00.000Z",
      "date_modified": "2026-01-02T00:00:00.000Z",
      "tags": [
        "process-hollowing",
        "shellcode",
        "x32dbg",
        "scdbg",
        "ida",
        "malware-analysis",
        "reverse-engineering"
      ],
      "image": "https://zx41r.dev/og/ransomed.png",
      "banner_image": "https://zx41r.dev/og/ransomed.png",
      "authors": [
        {
          "name": "Zohir Hakmi",
          "url": "https://zx41r.dev/about/",
          "avatar": "https://zx41r.dev/favicon.svg"
        }
      ]
    }
  ]
}