nil · zx41r · Zohir Hakmisecurity researcher and reverse engineerhttps://zx41r.dev/en-us© Zohir Hakmi · code MIT · writing CC BY-NC 4.0z_hakmi@estin.dz (Zohir Hakmi)z_hakmi@estin.dz (Zohir Hakmi)c97558https://zx41r.dev/favicon.svgfddR1p Reverse Engineering itc{flags} Official Writeuphttps://zx41r.dev/posts/fddr1p/https://zx41r.dev/posts/fddr1p/A rev binary that hands its own ptrace slot to a fileless child, then dares you to take it back. Two anti-debug gates, a memfd-only guardian, and a key that only half-exists on disk.Sat, 01 Aug 2026 00:00:00 GMTZohir Hakmiptracememfdlinux-internalsgdbpwndbgaes-gcmanti-debugreverse-engineeringctfz_hakmi@estin.dz (Zohir Hakmi)c00ked d3v Full NexZeroCTF OSINT/4n6 Chainhttps://zx41r.dev/posts/c00ked-d3v/https://zx41r.dev/posts/c00ked-d3v/Full solve for c00ked d3v recovering a scrubbed trail from GHCR layers to a dead host, then from deleted GitHub activity to a staging mirror, DNS TXT dead drop, and the final Gist.Sat, 02 May 2026 00:00:00 GMTZohir Hakminexzeroctfgithubghcrdockerfavicon-hashfofaurlscangithub-apigitlabdnsgistosintforensicsz_hakmi@estin.dz (Zohir Hakmi)Phobos Ransomware — Malware Analysis Walkthroughhttps://zx41r.dev/posts/phobos/https://zx41r.dev/posts/phobos/Deep analysis of Phobos ransomware: encrypted configuration, process termination, persistence mechanisms, and file encryption strategies.Sun, 04 Jan 2026 00:00:00 GMTZohir Hakmiransomwarephobosida-prox32dbgaes-encryptioncrc32malware-analysisreverse-engineeringz_hakmi@estin.dz (Zohir Hakmi)Red Stealer — Threat Intelligence Walkthroughhttps://zx41r.dev/posts/red-stealer/https://zx41r.dev/posts/red-stealer/Analyze a suspicious executable using VirusTotal and MalwareBazaar to extract IOCs, identify C2 infrastructure, MITRE ATT&CK techniques, and privilege escalation mechanisms.Sat, 03 Jan 2026 00:00:00 GMTZohir Hakmivirustotalmalwarebazaarthreatfoxredline-stealeriocmitre-attackc2threat-intelligencemalware-analysisz_hakmi@estin.dz (Zohir Hakmi)RE101 — Reverse Engineering Fundamentals Walkthroughhttps://zx41r.dev/posts/re101/https://zx41r.dev/posts/re101/Analyze diverse file types including binaries, obfuscated scripts, and corrupted archives using reverse engineering techniques to extract hidden flags.Sat, 03 Jan 2026 00:00:00 GMTZohir Hakmibase64jsfuckbrainfuckzip-repairstack-stringsxor-encryptionidaghidrahex-editormalware-analysisreverse-engineeringz_hakmi@estin.dz (Zohir Hakmi)Ransomed — Malware Analysis Walkthroughhttps://zx41r.dev/posts/ransomed/https://zx41r.dev/posts/ransomed/Dynamic analysis and memory forensics: stack-strings, API resolution, shellcode and process hollowing.Fri, 02 Jan 2026 00:00:00 GMTZohir Hakmiprocess-hollowingshellcodex32dbgscdbgidamalware-analysisreverse-engineeringz_hakmi@estin.dz (Zohir Hakmi)