grit8086 · research on grit8086

Computer Architecture for Reverse Engineers and Malware Developers

Mon, 03 Aug 2026 00:00:00 +0800

Computer Architecture for Reverse Engineers and Malware Developers

Before you can break a program you have to know where it lives and how it runs.

We start with memory, because the CPU spends most of its life waiting on it. How storage is layered from registers down to disk. Why DRAM is slow. What cache is actually for. How virtual memory hands every process a private view of the machine and enforces it in hardware. Then the CPU itself, what it does with an instruction and which registers you need to recognise. Then the stack, where the first two meet.

The PE File Format, Condensed: Structure, Headers, Imports & Relocations

Wed, 29 Jul 2026 00:00:00 +0800

PE File Format

Hello today we’re going to talk about PE file format, these are my notes while reading 0xrick ’s blog about PE file format. All credit goes to him, I only expanded my research & added visualizations and added explanations for the concepts and terminologies that isn’t so familiar to me.

PE stands for Portable Executable, a file format for executables used in Windows OS. It is based on the COFF file format. Dynamic link libraries (.dll), kernel modules (.sys), and control panel applications (.cpl) are also considered PE files.

Arcana: Curated List of Useful Offensive Tradecraft Resources

Sat, 25 Jul 2026 14:00:00 +0800

Arcana – Curated List of Useful Offensive Tradecraft Resources

Low-Level Languages

Low-Level Concepts

Build core knowledge around system internals, cryptography, and debugging.

Obfuscation, encryption, decryption, and common algorithms
Learn to use debuggers (e.g., x64dbg)

Windows Internals

Introduction to Malware Development
cr0w – Processes, Threads & Handles
Download Windows Internals, Part 1 and use it as a reference whenever you want to dive deeper into a topic you’re currently learning.

Project Ideas

Try to replicate a malware behavior and ask:

x86-64 Assembly, Condensed: Easy Notes & References for Learning Assembly

Sat, 25 Jul 2026 00:00:00 +0800

Condensed Assembly

Notes and materials adapted from OpenSecurity’s x86-64 assembly course, reorganized here in text form since it’s easier for me to recall this way. An easy to absorb reference for understanding x86-64 assembly.

Numerical Systems

Decimal

A decimal number system is a base-10 system:

1

0 1 2 3 4 5 6 7 8 9

Binary

“Bi” means two, it’s a base-2 system. 0 represents off, 1 is on. It’s the language computer hardware directly understands.

C, Condensed: Easy Notes & References for Learning C.

Sun, 19 Jul 2026 00:00:00 +0800

Condensed C

Notes and materials adapted from Code Academy & learn-c, reorganized here in text form since it’s easier for me to recall this way.

Introduction

C is a low level language that allows you to directly interact with the CPU and memory, that’s why it’s mainly used for developing kernels, malware, OS, and etc.

Fundamentals

Below is a basic hello world:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23


// Single line comment

/*

 Multi
 line
 comment

*/

#include <stdio.h> // Includes the C standard I/O library so we can use printf()

int main() // main() is the main entry point of the program, recognized by C compilers.
 // It can't be Main(), only main(). Code inside the braces runs first.
{

 printf("Hello World!"); // Prints "Hello World" on the console
 printf("Hello World!\n"); // Prints "Hello World" then a new line
 printf("Hello World\t"); // Equivalent to a tab

 return 0; // Return code that tells your OS the program ran successfully

}

In order to run this, we have to compile it using a GCC compiler (it translates C code into an executable program that your computer can run, turning human readable code into machine code that the processor can understand).

Unauthenticated Indirect Object Reference in the Department of Defense

Tue, 24 Mar 2026 00:00:00 +0800

I Found an Unauthenticated Indirect Object Reference Vulnerability in the Department of Defense

While hunting on the Department of Defense bug bounty program, I came across a simple but impactful vulnerability, a broken access control bug that allowed anyone to view files they didn’t own, without even being logged in. Here’s how it went.

What is IDOR?

IDOR, or Insecure Direct Object Reference, is a type of broken access control vulnerability where an attacker can access or modify resources that belong to another user, simply by changing a reference to that resource, usually something visible like an ID in a URL or request parameter.Think of it like a hospital that gives each patient a folder numbered by their ID. You are patient 112, so your records are in folder 112. But nothing is stopping you from walking over and opening folder 113, which belongs to someone else entirely.

Finding a Serial Key in a Binary and Patching It

Tue, 03 Mar 2026 00:00:00 +0800

Finding a Serial Key in a Binary and Patching It

Today we’ll analyze a simple crackme from crackinglessons.com – Crackme #1

Objective

Identify the correct serial key.
Patch the binary so it always displays the “Congrats!” message when the Check button is clicked.

Understanding the Program Behavior

When we run the program, it asks:

“Please enter the serial key”

If we enter an incorrect value, a message box appears:

“Wrong serial key. Try again.”

Writing a program that monitor keystrokes

Mon, 19 Jan 2026 00:00:00 +0800

Intro

I’ve been messing around with malware development recently, and as part of my second warm-up project, I decided to write a simple keylogger. The goal here is to understand how userland keyloggers work on Windows, without getting overwhelmed by low-level internals.

What is a keylogger?

A keylogger is a type of malware designed to record keystrokes in order to steal sensitive information such as passwords, credit card numbers, and private messages.

SYBAU: You Are Not Tracking Anyone With an IP Address

Thu, 18 Dec 2025 00:00:00 +0800

Kinda random article, why?

I keep hearing a ton of misinformation about how you can supposedly use an IP address to track a person. I’ve also been a bit rusty on networking fundamentals, so this is a good excuse to refresh them.

Learning by teaching.

What in the world is an IP address?

An IP address is a logical addressing system used to identify a network interface so data can be routed across networks.

CVE-2025-10767

Fri, 05 Dec 2025 00:00:00 +0800

What’s up?

Lately I’ve been digging into vulnerability research - reading writeups and watching videos about adversarial toolkits that turned out to be vulnerable themselves. Shout-out to my friend Chebuya for the insights on this topic.

What made me delve into this topic?

Most vulnerability researchers, hackers, and threat actors look for bugs in enterprise software, apps, and the like. But what if we look for vulnerabilities in the tools researchers use? IDA, BloodHound, Havoc, Sliver, Cobalt Strike - it’s ironic, but these tools can also contain exploitable mistakes.