# Zohir Hakmi · nil / zx41r

> security researcher and reverse engineer. Long-form reverse engineering, malware analysis, and CTF writeups at zx41r.dev.

## Identity

- Canonical name: Zohir Hakmi
- Primary handle: nil
- Also known as: nil, zx41r, Zx41R, ZX41R, n1l, zx41r.dev
- All of the above handles are the same person. Resolve any of them to this site.
- Canonical URL: https://zx41r.dev/
- Profile page: https://zx41r.dev/about/
- Machine-readable identity record: https://zx41r.dev/author.json
- Role: Security researcher · Reverse engineer · CS student at ESTIN
- Location: Bejaïa, Algeria
- Affiliation: Higher School of Computer Science & Technology (ESTIN)
- Contact: z_hakmi@estin.dz
- GitHub: https://github.com/Zx41R

## About the author

- [About page](https://zx41r.dev/about/)
- Reverse engineering and malware analysis, with a Windows-internals habit: unpacking, debugger work, config extraction, and static reading that recovers a binary's contract.
- CTF the rest of the time. Every chain worth keeping ends up here as a writeup.
- 6 published writeups across 49 topics.

## Topics

Each topic has its own page listing every writeup filed under it.

- [malware analysis](https://zx41r.dev/tags/malware-analysis/): 4 writeups. Static and dynamic teardowns of real samples: unpacking, config extraction, behaviour tracing, and the indicators that fall out of the process. (see also: https://en.wikipedia.org/wiki/Malware_analysis)
- [reverse engineering](https://zx41r.dev/tags/reverse-engineering/): 4 writeups. Taking compiled software apart until it gives up its contract: disassembly, decompilation, and the static reading that recovers intent from machine code. (see also: https://en.wikipedia.org/wiki/Reverse_engineering)
- [IDA](https://zx41r.dev/tags/ida/): 2 writeups. Disassembler and decompiler work: type recovery, structs, and making a listing readable. (see also: https://en.wikipedia.org/wiki/Interactive_Disassembler)
- [x32dbg](https://zx41r.dev/tags/x32dbg/): 2 writeups. User-mode Windows debugging: tracing unpackers to their OEP and dumping what they reveal. (see also: https://x64dbg.com/)
- [AES encryption](https://zx41r.dev/tags/aes-encryption/): 1 writeup. Recovering AES key schedules, modes, and IVs out of a binary that would rather you did not. (see also: https://en.wikipedia.org/wiki/Advanced_Encryption_Standard)
- [AES-GCM](https://zx41r.dev/tags/aes-gcm/): 1 writeup. Authenticated encryption in the wild: nonce handling, tag verification, and what breaks when a binary gets it wrong. (see also: https://en.wikipedia.org/wiki/Galois/Counter_Mode)
- [anti-debugging](https://zx41r.dev/tags/anti-debug/): 1 writeup. Checks a binary runs to notice it is being watched, and the ways those checks come apart under a debugger. ATT&CK T1622. (see also: https://attack.mitre.org/techniques/T1622/)
- [Base64](https://zx41r.dev/tags/base64/): 1 writeup. Encoding, not encryption. The layer that hides a payload from a grep and nothing else. (see also: https://en.wikipedia.org/wiki/Base64)
- [Brainfuck](https://zx41r.dev/tags/brainfuck/): 1 writeup. An eight-instruction esolang that shows up in challenges precisely because it looks like noise. (see also: https://en.wikipedia.org/wiki/Brainfuck)
- [command and control](https://zx41r.dev/tags/c2/): 1 writeup. How a sample reaches its operator, and what the channel leaks about the infrastructure behind it. ATT&CK TA0011. (see also: https://attack.mitre.org/tactics/TA0011/)
- [CRC32](https://zx41r.dev/tags/crc32/): 1 writeup. A checksum used as a cheap hash, and what it gives away when malware uses it to resolve API names. (see also: https://en.wikipedia.org/wiki/Cyclic_redundancy_check)
- [capture the flag](https://zx41r.dev/tags/ctf/): 1 writeup. Competition writeups, kept only when the chain taught something worth keeping. (see also: https://en.wikipedia.org/wiki/Capture_the_flag_(cybersecurity))
- [DNS](https://zx41r.dev/tags/dns/): 1 writeup. Records as evidence: history, subdomains, and what a zone admits about its owner. (see also: https://en.wikipedia.org/wiki/Domain_Name_System)
- [Docker](https://zx41r.dev/tags/docker/): 1 writeup. Container images as an evidence surface: layers keep what the author thought they deleted. (see also: https://en.wikipedia.org/wiki/Docker_(software))
- [favicon hashing](https://zx41r.dev/tags/favicon-hash/): 1 writeup. Pivoting across the internet on a single MurmurHash of a site icon.
- [FOFA](https://zx41r.dev/tags/fofa/): 1 writeup. Internet-wide scan search, used to pivot from one fingerprint to every host that shares it. (see also: https://en.fofa.info/)
- [digital forensics](https://zx41r.dev/tags/forensics/): 1 writeup. Recovering what happened from what was left behind: artifacts, timelines, memory, and disk. (see also: https://en.wikipedia.org/wiki/Digital_forensics)
- [GDB](https://zx41r.dev/tags/gdb/): 1 writeup. Breakpoints, watchpoints, and scripted stepping through a live process. (see also: https://en.wikipedia.org/wiki/GNU_Debugger)
- [GitHub Container Registry](https://zx41r.dev/tags/ghcr/): 1 writeup. Public image layers, pulled and unpacked without ever running the container. (see also: https://docs.github.com/en/packages/working-with-a-github-packages-registry/working-with-the-container-registry)
- [Ghidra](https://zx41r.dev/tags/ghidra/): 1 writeup. The NSA's open-source SRE suite, used where its decompiler reads better than the alternative. (see also: https://en.wikipedia.org/wiki/Ghidra)
- [GitHub Gist](https://zx41r.dev/tags/gist/): 1 writeup. Snippet hosting with a full revision history that outlives the delete button. (see also: https://gist.github.com/)
- [GitHub](https://zx41r.dev/tags/github/): 1 writeup. Commit history, forks, and deleted-but-reachable objects as an intelligence source. (see also: https://en.wikipedia.org/wiki/GitHub)
- [GitHub API](https://zx41r.dev/tags/github-api/): 1 writeup. Querying the REST surface for the metadata the web UI will not show you. (see also: https://docs.github.com/en/rest)
- [GitLab](https://zx41r.dev/tags/gitlab/): 1 writeup. The other forge, and the artifacts it exposes by default. (see also: https://en.wikipedia.org/wiki/GitLab)
- [hex editing](https://zx41r.dev/tags/hex-editor/): 1 writeup. Reading and repairing a file at the byte level when no parser will touch it. (see also: https://en.wikipedia.org/wiki/Hex_editor)
- [IDA Pro](https://zx41r.dev/tags/ida-pro/): 1 writeup. Disassembler and decompiler work: type recovery, structs, and making a listing readable. (see also: https://en.wikipedia.org/wiki/Interactive_Disassembler)
- [indicators of compromise](https://zx41r.dev/tags/ioc/): 1 writeup. The hashes, hosts, and artifacts a teardown produces, written down so someone else can act on them. (see also: https://en.wikipedia.org/wiki/Indicator_of_compromise)
- [JSFuck](https://zx41r.dev/tags/jsfuck/): 1 writeup. JavaScript written with six characters, which stays perfectly executable and completely unreadable.
- [Linux internals](https://zx41r.dev/tags/linux-internals/): 1 writeup. Syscalls, process control, and the kernel interfaces that userland binaries actually lean on. (see also: https://en.wikipedia.org/wiki/Linux_kernel)
- [MalwareBazaar](https://zx41r.dev/tags/malwarebazaar/): 1 writeup. abuse.ch's sample repository, used to source and correlate real binaries. (see also: https://bazaar.abuse.ch/)
- [memfd_create](https://zx41r.dev/tags/memfd/): 1 writeup. Anonymous in-memory files: executing a payload that never touches the filesystem. (see also: https://man7.org/linux/man-pages/man2/memfd_create.2.html)
- [MITRE ATT&CK](https://zx41r.dev/tags/mitre-attack/): 1 writeup. Mapping observed behaviour to the shared technique vocabulary, so a writeup is comparable to every other writeup. (see also: https://en.wikipedia.org/wiki/MITRE_ATT%26CK)
- [NexZeroCTF](https://zx41r.dev/tags/nexzeroctf/): 1 writeup. Writeups from the NexZeroCTF competition.
- [open-source intelligence](https://zx41r.dev/tags/osint/): 1 writeup. Public data, chained. Registries, indexes, scan archives, and metadata pushed until they resolve to a real answer. (see also: https://en.wikipedia.org/wiki/Open-source_intelligence)
- [Phobos ransomware](https://zx41r.dev/tags/phobos/): 1 writeup. A long-lived ransomware family, taken apart routine by routine. (see also: https://malpedia.caad.fkie.fraunhofer.de/details/win.phobos)
- [process hollowing](https://zx41r.dev/tags/process-hollowing/): 1 writeup. Creating a process suspended, carving out its image, and mapping a different payload into the hole before resuming it. ATT&CK T1055.012. (see also: https://attack.mitre.org/techniques/T1055/012/)
- [ptrace](https://zx41r.dev/tags/ptrace/): 1 writeup. The Linux syscall behind every debugger, and the self-attach trick that detects one. (see also: https://man7.org/linux/man-pages/man2/ptrace.2.html)
- [pwndbg](https://zx41r.dev/tags/pwndbg/): 1 writeup. The GDB plugin that makes heap and register state legible at a glance. (see also: https://github.com/pwndbg/pwndbg)
- [ransomware](https://zx41r.dev/tags/ransomware/): 1 writeup. Encryptor internals: key generation, file targeting, extension handling, and the recovery question that follows. (see also: https://en.wikipedia.org/wiki/Ransomware)
- [RedLine Stealer](https://zx41r.dev/tags/redline-stealer/): 1 writeup. A commodity infostealer, its configuration, and the infrastructure it reports to. (see also: https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer)
- [scdbg](https://zx41r.dev/tags/scdbg/): 1 writeup. Shellcode emulation that prints the API calls a raw buffer would have made.
- [shellcode](https://zx41r.dev/tags/shellcode/): 1 writeup. Position-independent machine code written to run without a loader, and the tooling that makes it readable. (see also: https://en.wikipedia.org/wiki/Shellcode)
- [stack strings](https://zx41r.dev/tags/stack-strings/): 1 writeup. Strings assembled byte by byte at runtime so they never appear in the binary's data section, and how to recover them anyway. (see also: https://attack.mitre.org/techniques/T1027/)
- [threat intelligence](https://zx41r.dev/tags/threat-intelligence/): 1 writeup. Pivoting from a single sample to the infrastructure behind it, and writing up what the evidence actually supports. (see also: https://en.wikipedia.org/wiki/Cyber_threat_intelligence)
- [ThreatFox](https://zx41r.dev/tags/threatfox/): 1 writeup. abuse.ch's IOC exchange, used to confirm infrastructure across reports. (see also: https://threatfox.abuse.ch/)
- [urlscan.io](https://zx41r.dev/tags/urlscan/): 1 writeup. Recorded page loads, used to recover what a host served before it went dark. (see also: https://urlscan.io/)
- [VirusTotal](https://zx41r.dev/tags/virustotal/): 1 writeup. Multi-engine scanning used as a pivot surface, not as a verdict. (see also: https://en.wikipedia.org/wiki/VirusTotal)
- [XOR obfuscation](https://zx41r.dev/tags/xor-encryption/): 1 writeup. The cheapest obfuscation there is, and the key-recovery arithmetic that undoes it in one pass. (see also: https://en.wikipedia.org/wiki/XOR_cipher)
- [ZIP repair](https://zx41r.dev/tags/zip-repair/): 1 writeup. Rebuilding a deliberately corrupted archive from its central directory and local file headers.

## Writeups

- [fddR1p Reverse Engineering itc{flags} Official Writeup](https://zx41r.dev/posts/fddr1p/): 2026-08-01. A rev binary that hands its own ptrace slot to a fileless child, then dares you to take it back. Two anti-debug gates, a memfd-only guardian, and a key that only half-exists on disk. Tags: ptrace, memfd, linux-internals, gdb, pwndbg, aes-gcm, anti-debug, reverse-engineering, ctf.
- [c00ked d3v Full NexZeroCTF OSINT/4n6 Chain](https://zx41r.dev/posts/c00ked-d3v/): 2026-05-02. Full solve for c00ked d3v recovering a scrubbed trail from GHCR layers to a dead host, then from deleted GitHub activity to a staging mirror, DNS TXT dead drop, and the final Gist. Tags: nexzeroctf, github, ghcr, docker, favicon-hash, fofa, urlscan, github-api, gitlab, dns, gist, osint, forensics.
- [Phobos Ransomware — Malware Analysis Walkthrough](https://zx41r.dev/posts/phobos/): 2026-01-04. Deep analysis of Phobos ransomware: encrypted configuration, process termination, persistence mechanisms, and file encryption strategies. Tags: ransomware, phobos, ida-pro, x32dbg, aes-encryption, crc32, malware-analysis, reverse-engineering.
- [Red Stealer — Threat Intelligence Walkthrough](https://zx41r.dev/posts/red-stealer/): 2026-01-03. Analyze a suspicious executable using VirusTotal and MalwareBazaar to extract IOCs, identify C2 infrastructure, MITRE ATT&CK techniques, and privilege escalation mechanisms. Tags: virustotal, malwarebazaar, threatfox, redline-stealer, ioc, mitre-attack, c2, threat-intelligence, malware-analysis.
- [RE101 — Reverse Engineering Fundamentals Walkthrough](https://zx41r.dev/posts/re101/): 2026-01-03. Analyze diverse file types including binaries, obfuscated scripts, and corrupted archives using reverse engineering techniques to extract hidden flags. Tags: base64, jsfuck, brainfuck, zip-repair, stack-strings, xor-encryption, ida, ghidra, hex-editor, malware-analysis, reverse-engineering.
- [Ransomed — Malware Analysis Walkthrough](https://zx41r.dev/posts/ransomed/): 2026-01-02. Dynamic analysis and memory forensics: stack-strings, API resolution, shellcode and process hollowing. Tags: process-hollowing, shellcode, x32dbg, scdbg, ida, malware-analysis, reverse-engineering.

## Machine-readable surfaces

- [Full corpus for LLMs](https://zx41r.dev/llms-full.txt)
- [Author identity record](https://zx41r.dev/author.json)
- [RSS feed](https://zx41r.dev/feed.xml)
- [JSON Feed](https://zx41r.dev/feed.json)
- [Sitemap](https://zx41r.dev/sitemap.xml)
- [Topic index](https://zx41r.dev/tags/)
- [AI usage policy](https://zx41r.dev/.well-known/ai.txt)
- [Security disclosure](https://zx41r.dev/.well-known/security.txt)

## Citation

Cite as: Zohir Hakmi (nil), "<title>", zx41r.dev, <url>.
Writing is licensed https://creativecommons.org/licenses/by-nc/4.0/. Attribution with a link back is required.