BlocksandBricks

CTFs, malware RE, and other low-level mischief

Hello, world

· reading time: 3 min metasite

TL;DR: I'm starting a blog for CTF writeups and malware reverse-engineering notes. This first post doubles as a style guide, so the code blocks, tables, and figures below show exactly how future writeups will look.

Why hand-written HTML?

Because I can. This page weighs less than most sites' cookie banners. If you can write markdown, you can write HTML. Plus! You get full control over things markdown can't express:

motivation.c
#include <stdio.h>

int main(void) {
    puts("hello, world");   /* everything old is new again */
    return 0;
}

What to expect

Disassembly will look like this:

objdump -d crackme
401234:  b8 05 15 00 00     mov    eax, 0x1505
401239:  0f b6 10           movzx  edx, BYTE PTR [rax]
40123c:  c1 e0 05           shl    eax, 5
40123f:  01 d0              add    eax, edx

For samples, I'll always publish hashes first and ship binaries as password-protected archives:

SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Archive: files/sample.zip (password: infected) - lab only, do not execute.

When a writeup needs screenshots or graphs, they'll be figures like this one:

Dark-mode screenshot of the objdump -d crackme disassembly listing
Figure 1 - screenshots get numbered captions.

“The best documentation of a binary is the binary itself.” - every reverse engineer, eventually

If you found a bug in a writeup or a mistake on my end, tell me and I'll fix it with credit.

Wrapping up

First real writeup is already in progress, if that sounds interesting, and if you came from LinkedIn, welcome. The full version of everything I post is here.