corpus.blog
54,302 blogs · [ { "id": "01a0d049-62f5-701d-8627-0c74a9d00b48", "title": "Linesignal", "url": "https://reverse.put.as/linesignal/", "published_at": "2026-09-21T13:20:45+00:00" }, { "id": "01a087d3-a7ae-71b6-834c-7dd2d6b3dd7a", "title": "It's a pre-auth, stupid!", "url": "https://reverse.put.as/2026/07/29/its-a-pre-auth-stupid/", "published_at": "2026-07-29T22:28:56+00:00" }, { "id": "01a087d3-a7ae-71b6-834c-7dd2d70cd14c", "title": "This blog is 18th years old already!", "url": "https://reverse.put.as/2025/10/18/18yearsold/", "published_at": "2025-10-18T02:17:47+00:00" }, { "id": "01a087d3-a7ae-71b6-834c-7dd2d789ff47", "title": "Bringing Metal to a crypto backdoor fight! Exploiting the GPU and the 90s crypto wars to crack the APT Down code signing keys", "url": "https://reverse.put.as/2025/08/24/rc4bruteforce/", "published_at": "2025-08-24T16:17:23+00:00" }, { "id": "01a087d3-a7ae-71b6-834c-7dd2d79d08c9", "title": "It's the certificates, stupid!", "url": "https://reverse.put.as/2025/08/11/itsthecertificatesstupid/", "published_at": "2025-08-11T22:59:17+00:00" }, { "id": "01a087d3-a7ae-71b6-834c-7dd2d7de405e", "title": "clownpertino - A simple macOS debugger detection trick", "url": "https://reverse.put.as/2025/04/04/clownpertino/", "published_at": "2025-04-04T17:54:57+00:00" }, { "id": "01a087d3-a7ae-71b6-834c-7dd2d7f956c2", "title": "Cracking the Crackers", "url": "https://reverse.put.as/2025/03/13/cracking-the-crackers/", "published_at": "2025-03-13T17:30:10+00:00" }, { "id": "01a087d3-a7ae-71b6-834c-7dd2d844dfc3", "title": "Flare-On 2024 Challenge #5 - sshd", "url": "https://reverse.put.as/2024/11/29/flare-on-2024-sshd/", "published_at": "2024-11-29T00:29:38+00:00" }, { "id": "01a087d3-a7ae-71b6-834c-7dd2d8c58641", "title": "Abusing Go's infrastructure", "url": "https://reverse.put.as/2024/05/24/abusing-go-infrastructure/", "published_at": "2024-05-24T17:33:38+00:00" }, { "id": "01a087d3-a7ae-71b6-834c-7dd2d8f1509f", "title": "Attacking the heart of an OpenRG modem", "url": "https://reverse.put.as/2023/10/20/attacking-the-heart-of-an-openrg-modem/", "published_at": "2023-10-20T12:36:20+00:00" }, { "id": "01a087d3-a7ae-71b6-834c-7dd2d92689d7", "title": "Knock Knock! Who's There? - An NSA VM", "url": "https://reverse.put.as/2021/12/17/knock-knock-whos-there/", "published_at": "2021-12-17T14:20:59+00:00" }, { "id": "01a087d3-a7ae-71b6-834c-7dd2d9b58778", "title": "How to build a custom and distributable lldb", "url": "https://reverse.put.as/2021/07/16/how-to-build-custom-lldb/", "published_at": "2021-07-16T02:51:35+00:00" }, { "id": "01a087d3-a7af-70e7-a756-9ad32d641e99", "title": "How to use GitHub Actions and private repositories to deploy a Hugo static site", "url": "https://reverse.put.as/2021/03/11/hugo-githubactions/", "published_at": "2021-03-11T04:56:42+00:00" }, { "id": "01a087d3-a7af-70e7-a756-9ad32df518bc", "title": "The Finfisher Tales, Chapter 1: The dropper", "url": "https://reverse.put.as/2020/09/26/the-finfisher-tales-chapter-1/", "published_at": "2020-09-26T17:03:00+00:00" }, { "id": "01a087d3-a7af-70e7-a756-9ad32e48f44f", "title": "Is macOS under the biggest malware attack ever?", "url": "https://reverse.put.as/2020/09/17/evilquest-revisited/", "published_at": "2020-09-17T14:30:08+00:00" }, { "id": "01a087d3-a7af-70e7-a756-9ad32f48ce6f", "title": "Blog Update", "url": "https://reverse.put.as/2020/07/12/blog-update/", "published_at": "2020-07-12T16:01:33+00:00" }, { "id": "01a087d3-a7af-70e7-a756-9ad32ff13630", "title": "FruitFly's dropper script and its missing tricks", "url": "https://reverse.put.as/2020/03/04/a-fruitfly-dropper-and-the-missing-tricks/", "published_at": "2020-03-03T23:14:40+00:00" }, { "id": "01a087d3-a7af-70e7-a756-9ad33070f335", "title": "Why I Left Twitter", "url": "https://reverse.put.as/2020/02/18/why-i-left-twitter/", "published_at": "2020-02-18T12:47:45+00:00" }, { "id": "01a087d3-a7af-70e7-a756-9ad330d67663", "title": "How to make LLDB a real debugger", "url": "https://reverse.put.as/2019/11/19/how-to-make-lldb-a-real-debugger/", "published_at": "2019-11-19T23:28:35+00:00" }, { "id": "01a087d3-a7af-70e7-a756-9ad3311b806e", "title": "Crafting an EFI Emulator and Interactive Debugger", "url": "https://reverse.put.as/2019/10/29/crafting-an-efi-emulator/", "published_at": "2019-10-29T15:58:25+00:00" }, { "id": "01a087d3-a7af-70e7-a756-9ad3313df7c8", "title": "Keygenning Carbon Copy Cloner Keychain Password", "url": "https://reverse.put.as/2018/10/25/keygenning-carbon-copy-cloner-keychain-password/", "published_at": "2018-10-25T22:14:38+00:00" }, { "id": "01a087d3-a7af-70e7-a756-9ad331f192ef", "title": "Reversing and Keygenning qwertyoruiop's Crackme", "url": "https://reverse.put.as/2018/10/06/reversing-and-keygenning-qwertyoruiop-crackme/", "published_at": "2018-10-06T22:15:21+00:00" }, { "id": "01a087d3-a7af-70e7-a756-9ad33209beef", "title": "lldbinit - Improving LLDB", "url": "https://reverse.put.as/2018/01/15/lldbinit-improving-lldb/", "published_at": "2018-01-15T14:24:20+00:00" }, { "id": "01a087d3-a7af-70e7-a756-9ad332acc86b", "title": "Measuring OS X Meltdown Patches Performance", "url": "https://reverse.put.as/2018/01/07/measuring-osx-meltdown-patches-performance/", "published_at": "2018-01-07T16:49:05+00:00" }, { "id": "01a087d3-a7af-70e7-a756-9ad332f146f0", "title": "Exploiting CVE-2017-5123", "url": "https://reverse.put.as/2017/11/07/exploiting-cve-2017-5123/", "published_at": "2017-11-07T15:01:18+00:00" }, { "id": "01a087d3-a7af-70e7-a756-9ad333a0117b", "title": "How to compile AFL's LLVM mode in OS X", "url": "https://reverse.put.as/2017/07/10/compiling-afl-osx-llvm-mode/", "published_at": "2017-07-10T11:10:08+00:00" }, { "id": "01a087d3-a7af-70e7-a756-9ad333bab407", "title": "Papers", "url": "https://reverse.put.as/papers/", "published_at": "2017-06-20T15:32:45+00:00" }, { "id": "01a087d3-a7af-70e7-a756-9ad333e9d206", "title": "gdbinit", "url": "https://reverse.put.as/gdbinit/", "published_at": "2017-06-20T15:30:28+00:00" }, { "id": "01a087d3-a7af-70e7-a756-9ad334c02a0a", "title": "Blog migration to Hugo", "url": "https://reverse.put.as/2017/06/20/blog-migration-to-hugo/", "published_at": "2017-06-20T14:10:49+00:00" }, { "id": "01a087d3-a7af-70e7-a756-9ad33569bbba", "title": "Armory Sandbox – Building a USB analyzer with USB armory", "url": "https://reverse.put.as/2017/06/20/armory-sandbox-building-usb-analyzer-with-usbarmory/", "published_at": "2017-06-20T14:01:55+00:00" }, { "id": "01a087d3-a7af-70e7-a756-9ad335f861e3", "title": "EFI Swiss Knife – An IDA plugin to improve (U)EFI reversing", "url": "https://reverse.put.as/2017/06/13/efi-swiss-knife-an-ida-plugin-to-improve-uefi-reversing/", "published_at": "2017-06-13T14:30:12+00:00" }, { "id": "01a087d3-a7af-70e7-a756-9ad335fa0d3e", "title": "Shut up snitch! – reverse engineering and exploiting a critical Little Snitch vulnerability", "url": "https://reverse.put.as/2016/07/22/shut-up-snitch-reverse-engineering-and-exploiting-a-critical-little-snitch-vulnerability/", "published_at": "2016-07-22T14:20:11+00:00" }, { "id": "01a087d3-a7af-70e7-a756-9ad336bbfcc9", "title": "Apple EFI firmware passwords and the SCBO myth", "url": "https://reverse.put.as/2016/06/25/apple-efi-firmware-passwords-and-the-scbo-myth/", "published_at": "2016-06-25T14:10:25+00:00" }, { "id": "01a087d3-a7af-70e7-a756-9ad337ba2669", "title": "SyScan360 Singapore 2016 slides and exploit code", "url": "https://reverse.put.as/2016/04/27/syscan360-singapore-2016-slides-and-exploit-code/", "published_at": "2016-04-27T14:09:50+00:00" }, { "id": "01a087d3-a7af-70e7-a756-9ad3380beb76", "title": "The Italian morons are back! What are they up to this time?", "url": "https://reverse.put.as/2016/02/29/the-italian-morons-are-back-what-are-they-up-to-this-time/", "published_at": "2016-02-29T14:07:01+00:00" }, { "id": "01a087d3-a7af-70e7-a756-9ad338bda73d", "title": "Reversing Apple’s syslogd bug", "url": "https://reverse.put.as/2016/01/22/reversing-apples-syslogd-bug/", "published_at": "2016-01-22T14:02:28+00:00" }, { "id": "01a087d3-a7af-70e7-a756-9ad338d7b5e1", "title": "Gatekeerper – A kernel extension to mitigate Gatekeeper bypasses", "url": "https://reverse.put.as/2015/11/09/gatekeerper-a-kernel-extension-to-mitigate-gatekeeper-bypasses/", "published_at": "2015-11-09T14:00:29+00:00" }, { "id": "01a087d3-a7af-70e7-a756-9ad3393d07d3", "title": "London and Asia EFI monsters tour!", "url": "https://reverse.put.as/2015/11/06/london-and-asia-efi-monsters-tour/", "published_at": "2015-11-06T13:59:48+00:00" }, { "id": "01a087d3-a7af-70e7-a756-9ad339919ae0", "title": "Rootfool – a small tool to dynamically disable and enable SIP in El Capitan", "url": "https://reverse.put.as/2015/10/12/rootfool-a-small-tool-to-dynamically-disable-and-enable-sip-in-el-capitan/", "published_at": "2015-10-12T13:58:18+00:00" }, { "id": "01a087d3-a7af-70e7-a756-9ad33a5529e8", "title": "Writing Bad @$$ Lamware for OS X", "url": "https://reverse.put.as/2015/08/07/writing-bad-lamware-for-os-x/", "published_at": "2015-08-07T13:55:51+00:00" }, { "id": "01a087d3-a7af-70e7-a756-9ad33b222b47", "title": "BSides Lisbon and SECUINSIDE 2015 presentations", "url": "https://reverse.put.as/2015/07/21/bsides-lisbon-and-secuinside-2015-presentations/", "published_at": "2015-07-21T13:55:14+00:00" }, { "id": "01a087d3-a7af-70e7-a756-9ad33c11503a", "title": "Reversing Prince Harming’s kiss of death", "url": "https://reverse.put.as/2015/07/01/reversing-prince-harmings-kiss-of-death/", "published_at": "2015-07-01T13:46:45+00:00" }, { "id": "01a087d3-a7af-70e7-a756-9ad33cb88282", "title": "The Empire Strikes Back Apple – how your Mac firmware security is completely broken", "url": "https://reverse.put.as/2015/05/29/the-empire-strikes-back-apple-how-your-mac-firmware-security-is-completely-broken/", "published_at": "2015-05-29T13:44:34+00:00" }, { "id": "01a087d3-a7af-70e7-a756-9ad33cf1794b", "title": "How to fix rootpipe in Mavericks and call Apple’s bullshit bluff about rootpipe fixes", "url": "https://reverse.put.as/2015/04/13/how-to-fix-rootpipe-in-mavericks-and-call-apples-bullshit-bluff-about-rootpipe-fixes/", "published_at": "2015-04-13T13:42:07+00:00" }, { "id": "01a087d3-a7af-70e7-a756-9ad33d250301", "title": "How to bypass Google’s Santa LOCKDOWN mode", "url": "https://reverse.put.as/2015/04/13/how-to-bypass-googles-santa-lockdown-mode/", "published_at": "2015-04-13T13:41:33+00:00" }, { "id": "01a087d3-a7af-70e7-a756-9ad33de3b40f", "title": "BadXNU, a rotten apple! – CodeBlue 2014, SyScan 2015 slides and source code", "url": "https://reverse.put.as/2015/03/19/badxnu-a-rotten-apple-codeblue-2014-syscan-2015-slides-and-source-code/", "published_at": "2015-03-19T13:41:01+00:00" }, { "id": "01a087d3-a7af-70e7-a756-9ad33decef5a", "title": "https is now (finally) supported!", "url": "https://reverse.put.as/2015/01/13/https-is-now-finally-supported/", "published_at": "2015-01-13T13:40:21+00:00" }, { "id": "01a087d3-a7af-70e7-a756-9ad33dfcfa08", "title": "Happy New Year!", "url": "https://reverse.put.as/2015/01/10/happy-new-year/", "published_at": "2015-01-10T13:39:50+00:00" }, { "id": "01a087d3-a7af-70e7-a756-9ad33e89f4f3", "title": "Patching what Apple doesn’t want to or how to make your “old” OS X versions a bit safer", "url": "https://reverse.put.as/2014/10/31/patching-what-apple-doesnt-want-to-or-how-to-make-your-old-os-x-versions-a-bit-safer/", "published_at": "2014-10-31T13:38:51+00:00" }, { "id": "01a087d3-a7af-70e7-a756-9ad33f5bb003", "title": "Can I SUID: a TrustedBSD policy module to control suid binaries execution", "url": "https://reverse.put.as/2014/10/03/can-i-suid-a-trustedbsd-policy-module-to-control-suid-binaries-execution/", "published_at": "2014-10-03T13:38:19+00:00" }, { "id": "01a087d3-a7af-70e7-a756-9ad34013a675", "title": "The double free mach port bug: The short story of a dead 0day", "url": "https://reverse.put.as/2014/09/24/the-double-free-mach-port-bug-the-short-story-of-a-dead-0day/", "published_at": "2014-09-24T13:37:25+00:00" }, { "id": "01a087d3-a7af-70e7-a756-9ad3401ab97c", "title": "Shakacon #6 presentation: Fuck you Hacking Team, From Portugal with Love.", "url": "https://reverse.put.as/2014/06/26/shakacon-6-presentation-fuck-you-hacking-team-from-portugal-with-love/", "published_at": "2014-06-26T13:36:44+00:00" }, { "id": "01a087d3-a7af-70e7-a756-9ad3403f50bd", "title": "About the processor_set_tasks() access to kernel memory vulnerability", "url": "https://reverse.put.as/2014/05/05/about-the-processor_set_tasks-access-to-kernel-memory-vulnerability/", "published_at": "2014-05-05T13:35:40+00:00" }, { "id": "01a087d3-a7af-70e7-a756-9ad3412c59db", "title": "Revisiting Mac OS X Kernel Rootkits Phrack article is finally out!", "url": "https://reverse.put.as/2014/04/18/revisiting-mac-os-x-kernel-rootkits-phrack-article-is-finally-out/", "published_at": "2014-04-18T13:35:09+00:00" }, { "id": "01a087d3-a7af-70e7-a756-9ad341f21838", "title": "Rex vs The Romans – Anti Hacking Team Kernel Extension", "url": "https://reverse.put.as/2014/04/08/rex-vs-the-romans-anti-hacking-team-kernel-extension/", "published_at": "2014-04-08T13:34:21+00:00" }, { "id": "01a087d3-a7af-70e7-a756-9ad3428774b6", "title": "Teaching Rex another TrustedBSD trick to hide from Volatility", "url": "https://reverse.put.as/2014/03/18/teaching-rex-another-trustedbsd-trick-to-hide-from-volatility/", "published_at": "2014-03-18T13:32:11+00:00" }, { "id": "01a087d3-a7af-70e7-a756-9ad342d5912a", "title": "Don’t die GDB, we love you: kgmacros ported to Mavericks.", "url": "https://reverse.put.as/2014/02/21/dont-die-gdb-we-love-you-kgmacros-ported-to-mavericks/", "published_at": "2014-02-21T13:31:25+00:00" }, { "id": "01a087d3-a7af-70e7-a756-9ad3433fc21b", "title": "Analysis of CoinThief/A \"dropper\"", "url": "https://reverse.put.as/2014/02/16/analysis-of-cointhiefa-dropper/", "published_at": "2014-02-16T10:51:26+00:00" }, { "id": "01a087d3-a7af-70e7-a756-9ad343a0c5ec", "title": "AppleDoesntGiveAFuckAboutSecurity iTunes Evil Plugin Proof of Concept", "url": "https://reverse.put.as/2014/02/15/appledoesntgiveafuckaboutsecurity-itunes-evil-plugin-proof-of-concept/", "published_at": "2014-02-15T10:49:37+00:00" }, { "id": "01a087d3-a7af-70e7-a756-9ad343d58d8f", "title": "Updated version of Onyx The Black Cat", "url": "https://reverse.put.as/2014/02/14/updated-version-of-onyx-the-black-cat/", "published_at": "2014-02-14T10:49:05+00:00" }, { "id": "01a087d3-a7af-70e7-a756-9ad34486117f", "title": "Linux/HackingTeamRDorks.A, a “new” and improved version of Linux/CDorked.A", "url": "https://reverse.put.as/2014/02/05/linuxhackingteamrdorks-a-a-new-and-improved-version-of-linuxcdorked-a/", "published_at": "2014-02-05T10:45:29+00:00" }, { "id": "01a087d3-a7af-70e7-a756-9ad345171a4c", "title": "Breaking OS X signed kernel extensions with a NOP", "url": "https://reverse.put.as/2013/11/23/breaking-os-x-signed-kernel-extensions-with-a-nop/", "published_at": "2013-11-23T10:44:32+00:00" }, { "id": "01a087d3-a7af-70e7-a756-9ad345ddb3ac", "title": "One small patch for GDB, one giant leap for reversers!", "url": "https://reverse.put.as/2013/11/08/one-small-patch-for-gdb-one-giant-leap-for-reversers/", "published_at": "2013-11-08T10:43:41+00:00" }, { "id": "01a087d3-a7af-70e7-a756-9ad3465df2ea", "title": "Why ESET’s OS X Rootkit Detector is useless...", "url": "https://reverse.put.as/2013/09/30/why-esets-os-x-rootkit-detector-is-useless/", "published_at": "2013-09-30T10:43:01+00:00" }, { "id": "01a087d3-a7af-70e7-a756-9ad3471ee14c", "title": "SyScan360 Beijing slides", "url": "https://reverse.put.as/2013/09/30/syscan360-beijing-slides/", "published_at": "2013-09-30T10:42:22+00:00" }, { "id": "01a087d3-a7af-70e7-a756-9ad3475ac84c", "title": "HiTCON 2013 slides", "url": "https://reverse.put.as/2013/07/30/hitcon-2013-slides/", "published_at": "2013-07-30T10:41:43+00:00" }, { "id": "01a087d3-a7af-70e7-a756-9ad3478901f4", "title": "Gone in 59 seconds: tips and tricks to bypass AppMinder’s Jailbreak detection", "url": "https://reverse.put.as/2013/06/30/gone-in-59-seconds-tips-and-tricks-to-bypass-appminders-jailbreak-detection/", "published_at": "2013-06-30T10:40:44+00:00" }, { "id": "01a087d3-a7af-70e7-a756-9ad3480786eb", "title": "Another gift: Crackme #1 source code from hell!", "url": "https://reverse.put.as/2013/06/11/another-gift-crackme-1-source-code-from-hell/", "published_at": "2013-06-11T10:40:06+00:00" }, { "id": "01a087d3-a7af-70e7-a756-9ad34839ebc5", "title": "Clapzok.A: reversing the OS X part of a multiplatform PoC infector", "url": "https://reverse.put.as/2013/05/31/clapzok-a-reversing-the-os-x-part-of-a-multiplatform-poc-infector/", "published_at": "2013-05-31T10:36:55+00:00" }, { "id": "01a087d3-a7af-70e7-a756-9ad348617849", "title": "Gimmedebugah: how to embedded a Info.plist into arbitrary binaries", "url": "https://reverse.put.as/2013/05/28/gimmedebugah-how-to-embedded-a-info-plist-into-arbitrary-binaries/", "published_at": "2013-05-28T10:35:57+00:00" }, { "id": "01a087d3-a7af-70e7-a756-9ad3490a0f9e", "title": "The \"all\" new Onyx The Black Cat!", "url": "https://reverse.put.as/2013/05/24/the-all-new-onyx-the-black-cat/", "published_at": "2013-05-24T10:35:12+00:00" }, { "id": "01a087d3-a7af-70e7-a756-9ad349e4a0e5", "title": "NoSuchCon #1 debrief and slides", "url": "https://reverse.put.as/2013/05/21/nosuchcon-1-debrief-and-slides/", "published_at": "2013-05-21T10:34:36+00:00" }, { "id": "01a087d3-a7af-70e7-a756-9ad34a04521c", "title": "Hydra, the sample util I am unable to describe!", "url": "https://reverse.put.as/2013/05/13/hydra-the-sample-util-i-am-unable-to-describe/", "published_at": "2013-05-13T10:33:58+00:00" }, { "id": "01a087d3-a7af-70e7-a756-9ad34a46d18c", "title": "There is an error in my SyScan slides!", "url": "https://reverse.put.as/2013/05/08/there-is-an-error-in-my-syscan-slides/", "published_at": "2013-05-08T10:33:17+00:00" }, { "id": "01a087d3-a7af-70e7-a756-9ad34adec76f", "title": "SyScan13: Revisiting Mac OS X Rootkits presentation", "url": "https://reverse.put.as/2013/05/07/syscan13-revisiting-mac-os-x-rootkits-presentation/", "published_at": "2013-05-07T10:32:27+00:00" }, { "id": "01a087d3-a7af-70e7-a756-9ad34aed8a41", "title": "How to compile GDB in Mountain Lion (updated)", "url": "https://reverse.put.as/2013/03/20/how-to-compile-gdb-in-mountain-lion-updated/", "published_at": "2013-03-20T10:30:59+00:00" }, { "id": "01a087d3-a7af-70e7-a756-9ad34b5f4dfe", "title": "OS.X/Boubou – Mach-O infector PoC source code", "url": "https://reverse.put.as/2013/03/05/os-xboubou-mach-o-infector-poc-source-code/", "published_at": "2013-03-05T10:30:23+00:00" }, { "id": "01a087d3-a7af-70e7-a756-9ad34c190278", "title": "Ice the Guardian v2, the OS X anti-lamware", "url": "https://reverse.put.as/2013/02/14/ice-the-guardian-v2-the-os-x-anti-lamware/", "published_at": "2013-02-14T10:29:46+00:00" }, { "id": "01a087d3-a7af-70e7-a756-9ad34c25c659", "title": "Happy new year, 2013 edition!", "url": "https://reverse.put.as/2012/12/28/happy-new-year-2013-edition/", "published_at": "2012-12-28T10:29:12+00:00" }, { "id": "01a087d3-a7af-70e7-a756-9ad34ce44bbe", "title": "A quick review of Mac OS X and iOS Internals – To the Apple’s Core", "url": "https://reverse.put.as/2012/12/12/a-quick-review-of-mac-os-x-and-ios-internals-to-the-apples-core/", "published_at": "2012-12-12T10:28:31+00:00" }, { "id": "01a087d3-a7af-70e7-a756-9ad34d3a218f", "title": "Otool-ng – a set of small patches to Apple’s otool", "url": "https://reverse.put.as/2012/11/21/otool-ng-a-set-of-small-patches-to-apples-otool/", "published_at": "2012-11-21T10:27:54+00:00" }, { "id": "01a087d3-a7af-70e7-a756-9ad34d790c82", "title": "Kextstat_ASLR util or how to start hiding your kernel rootkit in Mountain Lion", "url": "https://reverse.put.as/2012/11/18/kext_aslr-util-or-how-to-start-hiding-your-kernel-rootkit-in-mountain-lion/", "published_at": "2012-11-18T10:27:17+00:00" }, { "id": "01a087d3-a7af-70e7-a756-9ad34daea4bc", "title": "5 years of reverse.put.as", "url": "https://reverse.put.as/2012/10/10/5-years-of-reverse-put-as/", "published_at": "2012-10-10T10:26:36+00:00" }, { "id": "01a087d3-a7af-70e7-a756-9ad34ea40113", "title": "My first Hackintosh", "url": "https://reverse.put.as/2012/09/27/my-first-hakintosh/", "published_at": "2012-09-27T10:25:06+00:00" }, { "id": "01a087d3-a7af-70e7-a756-9ad34f4808ed", "title": "OS X Malware at Confraria de Segurança da Informação presentation slides", "url": "https://reverse.put.as/2012/09/27/os-x-malware-at-confraria-de-seguranca-da-informacao-presentation-slides/", "published_at": "2012-09-27T10:24:11+00:00" }, { "id": "01a087d3-a7af-70e7-a756-9ad34f994dae", "title": "Tales from Crisis, Chapter 4: A ghost in the network", "url": "https://reverse.put.as/2012/08/26/tales-from-crisis-chapter-4-a-ghost-in-the-network/", "published_at": "2012-08-26T10:22:36+00:00" }, { "id": "01a087d3-a7af-70e7-a756-9ad34fb1a591", "title": "Tales from Crisis, Chapter 3: The Italian Rootkit Job", "url": "https://reverse.put.as/2012/08/21/tales-from-crisis-chapter-3-the-italian-rootkit-job/", "published_at": "2012-08-21T10:19:06+00:00" }, { "id": "01a087d3-a7af-70e7-a756-9ad3508fca81", "title": "Tales from Crisis, Chapter 2: Backdoor’s first steps", "url": "https://reverse.put.as/2012/08/20/tales-from-crisis-chapter-2-backdoors-first-steps/", "published_at": "2012-08-20T10:16:10+00:00" }, { "id": "01a087d3-a7af-70e7-a756-9ad350c69cc2", "title": "Tales from Crisis, Chapter 1: The dropper’s box of tricks", "url": "https://reverse.put.as/2012/08/06/tales-from-crisis-chapter-1-the-droppers-box-of-tricks/", "published_at": "2012-08-06T22:59:57+00:00" }, { "id": "01a087d3-a7af-70e7-a756-9ad3513111fa", "title": "ExtractMachO: an IDA plugin to extract Mach-O binaries from disassembly", "url": "https://reverse.put.as/2012/07/30/extractmacho-an-ida-plugin-to-extract-mach-o-binaries-from-disassembly/", "published_at": "2012-07-30T22:59:07+00:00" }, { "id": "01a087d3-a7af-70e7-a756-9ad3522e9998", "title": "HITCON 2012 Review and slides", "url": "https://reverse.put.as/2012/07/27/hitcon-2012-review-and-slides/", "published_at": "2012-07-27T22:57:01+00:00" }, { "id": "01a087d3-a7af-70e7-a756-9ad3527e906b", "title": "Secuinside 2012 Review and Slides", "url": "https://reverse.put.as/2012/07/13/secuinside-2012-review-and-slides/", "published_at": "2012-07-13T22:55:54+00:00" }, { "id": "01a087d3-a7af-70e7-a756-9ad3533a1afe", "title": "See you in Asia!", "url": "https://reverse.put.as/2012/06/25/see-you-in-asia/", "published_at": "2012-06-25T22:55:06+00:00" }, { "id": "01a087d3-a7af-70e7-a756-9ad35358802b", "title": "\"Sandwich\" CrackMe tutorial by qwertyoruiop", "url": "https://reverse.put.as/2012/06/04/sandwich-crackme-tutorial-by-qwertyoruiop/", "published_at": "2012-06-04T22:54:25+00:00" }, { "id": "01a087d3-a7af-70e7-a756-9ad35401547f", "title": "A little social and economics experiment", "url": "https://reverse.put.as/2012/04/16/a-little-social-and-economics-experiment/", "published_at": "2012-04-16T22:52:51+00:00" }, { "id": "01a087d3-a7af-70e7-a756-9ad3542524f6", "title": "How to compile GDB for iOS!", "url": "https://reverse.put.as/2012/04/16/how-to-compile-gdb-for-ios/", "published_at": "2012-04-16T22:50:43+00:00" }, { "id": "01a087d3-a7af-70e7-a756-9ad354f13e48", "title": "gdbinit v8.0: simultaneous support for x86/x86_64 and ARM architectures!", "url": "https://reverse.put.as/2012/04/13/gdbinit-v8-0-simultaneous-support-for-x86x86_64-and-arm-architectures/", "published_at": "2012-04-13T22:49:51+00:00" }, { "id": "01a087d3-a7af-70e7-a756-9ad3551578da", "title": "Dynamic Code Encryption in OS X: the crackme example!", "url": "https://reverse.put.as/2012/03/17/dynamic-code-encryption-in-os-x-the-crackme-example/", "published_at": "2012-03-17T22:41:32+00:00" }, { "id": "01a087d3-a7af-70e7-a756-9ad3559b61af", "title": "A small improvement to OS X “rootkitery”: bruteforcing sysent discovery, fast & easy!", "url": "https://reverse.put.as/2012/02/14/a-small-improvement-to-os-x-rootkitery-bruteforcing-sysent-discovery-fast-easy/", "published_at": "2012-02-14T22:40:53+00:00" }, { "id": "01a087d3-a7af-70e7-a756-9ad35667462a", "title": "AV-monster: the monster that loves yummy OS X anti-virus software", "url": "https://reverse.put.as/2012/02/13/av-monster-the-monster-that-loves-yummy-os-x-anti-virus-software/", "published_at": "2012-02-13T22:39:52+00:00" } ] posts Claim your blog
Back to reverse.put.as
Blog · corpus.blog/blogs/reverse.put.as/posts

reverse.put.as

reverse.put.as

2026

Linesignaloriginal ↗
21 Sept 2026
It's a pre-auth, stupid!original ↗
29 Jul 2026

2025

This blog is 18th years old already!original ↗
18 Oct 2025
Bringing Metal to a crypto backdoor fight! Exploiting the GPU and the 90s crypto wars to crack the APT Down code signing keysoriginal ↗
24 Aug 2025
It's the certificates, stupid!original ↗
11 Aug 2025
clownpertino - A simple macOS debugger detection trickoriginal ↗
4 Apr 2025
Cracking the Crackersoriginal ↗
13 Mar 2025

2024

Flare-On 2024 Challenge #5 - sshdoriginal ↗
29 Nov 2024
Abusing Go's infrastructureoriginal ↗
24 May 2024

2023

Attacking the heart of an OpenRG modemoriginal ↗
20 Oct 2023

2021

Knock Knock! Who's There? - An NSA VMoriginal ↗
17 Dec 2021
How to build a custom and distributable lldboriginal ↗
16 Jul 2021
How to use GitHub Actions and private repositories to deploy a Hugo static siteoriginal ↗
11 Mar 2021

2020

The Finfisher Tales, Chapter 1: The dropperoriginal ↗
26 Sept 2020
Is macOS under the biggest malware attack ever?original ↗
17 Sept 2020
Blog Updateoriginal ↗
12 Jul 2020
FruitFly's dropper script and its missing tricksoriginal ↗
3 Mar 2020
Why I Left Twitteroriginal ↗
18 Feb 2020

2019

How to make LLDB a real debuggeroriginal ↗
19 Nov 2019
Crafting an EFI Emulator and Interactive Debuggeroriginal ↗
29 Oct 2019

2018

Keygenning Carbon Copy Cloner Keychain Passwordoriginal ↗
25 Oct 2018
Reversing and Keygenning qwertyoruiop's Crackmeoriginal ↗
6 Oct 2018
lldbinit - Improving LLDBoriginal ↗
15 Jan 2018
Measuring OS X Meltdown Patches Performanceoriginal ↗
7 Jan 2018

2017

Exploiting CVE-2017-5123original ↗
7 Nov 2017
How to compile AFL's LLVM mode in OS Xoriginal ↗
10 Jul 2017
Papersoriginal ↗
20 Jun 2017
gdbinitoriginal ↗
20 Jun 2017
Blog migration to Hugooriginal ↗
20 Jun 2017
Armory Sandbox – Building a USB analyzer with USB armoryoriginal ↗
20 Jun 2017
EFI Swiss Knife – An IDA plugin to improve (U)EFI reversingoriginal ↗
13 Jun 2017

2016

Shut up snitch! – reverse engineering and exploiting a critical Little Snitch vulnerabilityoriginal ↗
22 Jul 2016
Apple EFI firmware passwords and the SCBO mythoriginal ↗
25 Jun 2016
SyScan360 Singapore 2016 slides and exploit codeoriginal ↗
27 Apr 2016
The Italian morons are back! What are they up to this time?original ↗
29 Feb 2016
Reversing Apple’s syslogd bugoriginal ↗
22 Jan 2016

2015

Gatekeerper – A kernel extension to mitigate Gatekeeper bypassesoriginal ↗
9 Nov 2015
London and Asia EFI monsters tour!original ↗
6 Nov 2015
Rootfool – a small tool to dynamically disable and enable SIP in El Capitanoriginal ↗
12 Oct 2015
Writing Bad @$$ Lamware for OS Xoriginal ↗
7 Aug 2015
BSides Lisbon and SECUINSIDE 2015 presentationsoriginal ↗
21 Jul 2015
Reversing Prince Harming’s kiss of deathoriginal ↗
1 Jul 2015
The Empire Strikes Back Apple – how your Mac firmware security is completely brokenoriginal ↗
29 May 2015
How to fix rootpipe in Mavericks and call Apple’s bullshit bluff about rootpipe fixesoriginal ↗
13 Apr 2015
How to bypass Google’s Santa LOCKDOWN modeoriginal ↗
13 Apr 2015
BadXNU, a rotten apple! – CodeBlue 2014, SyScan 2015 slides and source codeoriginal ↗
19 Mar 2015
https is now (finally) supported!original ↗
13 Jan 2015
Happy New Year!original ↗
10 Jan 2015

2014

Patching what Apple doesn’t want to or how to make your “old” OS X versions a bit saferoriginal ↗
31 Oct 2014
Can I SUID: a TrustedBSD policy module to control suid binaries executionoriginal ↗
3 Oct 2014
The double free mach port bug: The short story of a dead 0dayoriginal ↗
24 Sept 2014
Shakacon #6 presentation: Fuck you Hacking Team, From Portugal with Love.original ↗
26 Jun 2014
About the processor_set_tasks() access to kernel memory vulnerabilityoriginal ↗
5 May 2014
Revisiting Mac OS X Kernel Rootkits Phrack article is finally out!original ↗
18 Apr 2014
Rex vs The Romans – Anti Hacking Team Kernel Extensionoriginal ↗
8 Apr 2014
Teaching Rex another TrustedBSD trick to hide from Volatilityoriginal ↗
18 Mar 2014
Don’t die GDB, we love you: kgmacros ported to Mavericks.original ↗
21 Feb 2014
Analysis of CoinThief/A "dropper"original ↗
16 Feb 2014
AppleDoesntGiveAFuckAboutSecurity iTunes Evil Plugin Proof of Conceptoriginal ↗
15 Feb 2014
Updated version of Onyx The Black Catoriginal ↗
14 Feb 2014
Linux/HackingTeamRDorks.A, a “new” and improved version of Linux/CDorked.Aoriginal ↗
5 Feb 2014

2013

Breaking OS X signed kernel extensions with a NOPoriginal ↗
23 Nov 2013
One small patch for GDB, one giant leap for reversers!original ↗
8 Nov 2013
Why ESET’s OS X Rootkit Detector is useless...original ↗
30 Sept 2013
SyScan360 Beijing slidesoriginal ↗
30 Sept 2013
HiTCON 2013 slidesoriginal ↗
30 Jul 2013
Gone in 59 seconds: tips and tricks to bypass AppMinder’s Jailbreak detectionoriginal ↗
30 Jun 2013
Another gift: Crackme #1 source code from hell!original ↗
11 Jun 2013
Clapzok.A: reversing the OS X part of a multiplatform PoC infectororiginal ↗
31 May 2013
Gimmedebugah: how to embedded a Info.plist into arbitrary binariesoriginal ↗
28 May 2013
The "all" new Onyx The Black Cat!original ↗
24 May 2013
NoSuchCon #1 debrief and slidesoriginal ↗
21 May 2013
Hydra, the sample util I am unable to describe!original ↗
13 May 2013
There is an error in my SyScan slides!original ↗
8 May 2013
SyScan13: Revisiting Mac OS X Rootkits presentationoriginal ↗
7 May 2013
How to compile GDB in Mountain Lion (updated)original ↗
20 Mar 2013
OS.X/Boubou – Mach-O infector PoC source codeoriginal ↗
5 Mar 2013
Ice the Guardian v2, the OS X anti-lamwareoriginal ↗
14 Feb 2013

2012

Happy new year, 2013 edition!original ↗
28 Dec 2012
A quick review of Mac OS X and iOS Internals – To the Apple’s Coreoriginal ↗
12 Dec 2012
Otool-ng – a set of small patches to Apple’s otooloriginal ↗
21 Nov 2012
Kextstat_ASLR util or how to start hiding your kernel rootkit in Mountain Lionoriginal ↗
18 Nov 2012
5 years of reverse.put.asoriginal ↗
10 Oct 2012
My first Hackintoshoriginal ↗
27 Sept 2012
OS X Malware at Confraria de Segurança da Informação presentation slidesoriginal ↗
27 Sept 2012
Tales from Crisis, Chapter 4: A ghost in the networkoriginal ↗
26 Aug 2012
Tales from Crisis, Chapter 3: The Italian Rootkit Joboriginal ↗
21 Aug 2012
Tales from Crisis, Chapter 2: Backdoor’s first stepsoriginal ↗
20 Aug 2012
Tales from Crisis, Chapter 1: The dropper’s box of tricksoriginal ↗
6 Aug 2012
ExtractMachO: an IDA plugin to extract Mach-O binaries from disassemblyoriginal ↗
30 Jul 2012
HITCON 2012 Review and slidesoriginal ↗
27 Jul 2012
Secuinside 2012 Review and Slidesoriginal ↗
13 Jul 2012
See you in Asia!original ↗
25 Jun 2012
"Sandwich" CrackMe tutorial by qwertyoruioporiginal ↗
4 Jun 2012
A little social and economics experimentoriginal ↗
16 Apr 2012
How to compile GDB for iOS!original ↗
16 Apr 2012
gdbinit v8.0: simultaneous support for x86/x86_64 and ARM architectures!original ↗
13 Apr 2012
Dynamic Code Encryption in OS X: the crackme example!original ↗
17 Mar 2012
A small improvement to OS X “rootkitery”: bruteforcing sysent discovery, fast & easy!original ↗
14 Feb 2012
AV-monster: the monster that loves yummy OS X anti-virus softwareoriginal ↗
13 Feb 2012
Next