# mahaloz.re The blog of mahaloz: all things hacking and computer science included! This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## LLMs Have Reshaped How We Think About Decompilation and Collaboration DevFeed: [LLMs Have Reshaped How We Think About Decompilation and Collaboration]() Original publisher: [Read original article]() Published: 2026-06-10T00:00:00Z Content type: opinion Language: en Sources: [mahaloz.re]() Topics: [codex](), [Hacking](), [coding](), [harvestbench]() Tags: [agents](), [codex](), [collaboration](), [hacking](), [ida](), [ida-pro](), [llm-agents](), [llms](), [musing](), [reversing](), [workflows]() ### AI overview This think piece examines how LLM agents and Codex are changing software decompilation and hacking workflows. It focuses on the shift from humans directly using reversing tools to humans supervising agents, and on the resulting need to coordinate agents, validate findings, and improve information sharing. It also connects these challenges to the authors' earlier work on BinSync, a decompiler collaboration framework. ### Source excerpt How LLM agents are changing decompilation workflows, collaboration, and the future of reversing tools. ## Decompiling 2024: A Year of Resurgence in Decompilation Research DevFeed: [Decompiling 2024: A Year of Resurgence in Decompilation Research]() Original publisher: [Read original article]() Published: 2025-01-29T00:00:00Z Content type: article Language: en Sources: [mahaloz.re]() Topics: [Programming](), [Software Engineering]() Tags: [graph](), [publications](), [research](), [retrospective]() ### AI overview A retrospective of decompilation research in 2024, covering academic and broader field progress. The article reports that 2024 produced an unusually high number of top-tier decompilation publications, including eight papers that represented nearly 30% of all such work. ### Source excerpt The year 2024 was a resurgent year for decompilation. Academic publications from that year made up nearly 30% of all top publications ever made in decompilation. In this post, I do a summarization and retrospective of both the academic and ideological progress of decompilation in 2024. Hint: decompilation research is back. ## 30 Years of Decompilation and the Unsolved Structuring Problem: Part 2 DevFeed: [30 Years of Decompilation and the Unsolved Structuring Problem: Part 2]() Original publisher: [Read original article]() Published: 2024-01-10T00:00:00Z Content type: article Language: en Sources: [mahaloz.re]() Topics: [Programming](), [compilers](), [phoenix]() Tags: [compilers](), [deep-dive](), [ida](), [ida-pro](), [phoenix](), [research](), [security](), [technical]() ### AI overview Part 2 of a history of decompiler research examines modern control-flow structuring techniques, their limitations, and possible future directions. It reviews four papers from the past 11 years, including Phoenix, and places them in the context of security, compiler, static-analysis, and programming-language research. ### Source excerpt A two-part series on the history of decompiler research and the fight against the unsolved control flow structuring problem. In part 1, we revisit the history of foundational decompilers and techniques, concluding on a look at modern works. In part 2, we deep-dive into the fundamentals of modern control flow structuring techniques, and their limitations, and look to the future. ## 30 Years of Decompilation and the Unsolved Structuring Problem: Part 1 DevFeed: [30 Years of Decompilation and the Unsolved Structuring Problem: Part 1]() Original publisher: [Read original article]() Published: 2024-01-02T00:00:00Z Content type: article Language: en Sources: [mahaloz.re]() Topics: [Algorithm](), [Graphs](), [c/c++]() Tags: [algorithm](), [based](), [c-plus-plus](), [deep-dive](), [go](), [graph](), [history](), [research](), [rust]() ### AI overview Part 1 surveys the history of binary decompilation, from foundational decompiler research to modern techniques, and introduces control flow structuring as a still-unsolved problem. It explains how structuring algorithms transform control-flow graphs into higher-level language structures and sets up a later discussion of modern methods and their limitations. ### Source excerpt A two-part series on the history of decompiler research and the fight against the unsolved control flow structuring problem. In part 1, we revisit the history of foundational decompilers and techniques, concluding on a look at modern works. In part 2, we deep-dive into the fundamentals of modern control flow structuring techniques, and their limitations, and look to the future. ## PwnAgent: A One-Click WAN-side RCE in Netgear RAX Routers with CVE-2023-24749 DevFeed: [PwnAgent: A One-Click WAN-side RCE in Netgear RAX Routers with CVE-2023-24749]() Original publisher: [Read original article]() Published: 2023-02-25T00:00:00Z Content type: article Language: en Sources: [mahaloz.re]() Topics: [bug](), [Exploit](), [Hacking](), [nginx](), [Logging]() Tags: [bug-hunting](), [cve](), [exploit](), [firmware](), [hacking](), [nginx](), [pwn2own](), [rce](), [routers]() ### AI overview A technical breakdown of CVE-2023-24749, a remotely accessible command-injection vulnerability in some Netgear RAX routers. The article explains how the bug can enable WAN-side remote code execution, potentially with root access, and discusses its discovery and firmware status. ### Source excerpt A breakdown of a bug SEFCOM T0 and I exploited to achieve a WAN-side RCE in some Netgear RAX routers for pwn2own 2022. The bug is a remotely accessible command injection due to bad packet logging, cataloged as CVE-2023-24749. ## Tips and tricks for reversing foreign architecture games DevFeed: [Tips and tricks for reversing foreign architecture games]() Original publisher: [Read original article]() Published: 2022-09-23T00:00:00Z Content type: tutorial Language: en Sources: [mahaloz.re]() Topics: [ctf](), [Tooling](), [console](), [Hacking](), [Software](), [Assembly]() Tags: [console](), [ctf](), [file](), [game-hacking](), [games](), [reversing](), [tooling]() ### AI overview This tutorial presents techniques for reversing software built for unfamiliar architectures, using an 0CTF22 game-hacking challenge involving a Vectrex console and Motorola 6809 architecture as its example. ### Source excerpt Some common techniques used while reversing unknown architectures seen through the lens of an 80's game hacking challenge from 0CTF22 ## Insomnihack22: Reversing a flawed ECC rng-as-a-service Go Server DevFeed: [Insomnihack22: Reversing a flawed ECC rng-as-a-service Go Server]() Original publisher: [Read original article]() Published: 2022-02-07T00:00:00Z Content type: tutorial Language: en Sources: [mahaloz.re]() Topics: [Go Language](), [Randomizer](), [servers](), [HTTP](), [debugging]() Tags: [crypto](), [ctf](), [ecc](), [game-hacking](), [go](), [ida](), [reversing](), [server](), [static-linking]() ### AI overview This write-up explains how to reverse a Go binary from the Insomnihack Teaser 2022 Nobus101 challenge. The binary provides an RNG service using a flawed P-256 elliptic-curve construction with reversible parameters, and the solution applies ideas from the Dual EC cryptography paper. ### Source excerpt Reversing a Go binary to find it generates flawed RNG from a P256 Elliptic Curve chosen with a reversible P and Q for number generation. Solution based on the Dual EC crypto paper. ## Tasteless 21: Godot Game Hacking in Tasteless Shores DevFeed: [Tasteless 21: Godot Game Hacking in Tasteless Shores]() Original publisher: [Read original article]() Published: 2021-10-03T00:00:00Z Content type: tutorial Language: en Sources: [mahaloz.re]() Topics: [Godot](), [Hacking](), [ctf](), [Script](), [client](), [servers](), [Linux]() Tags: [challenges](), [ctf](), [game](), [game-hacking](), [game-servers](), [github](), [hacking](), [hosting](), [ida](), [linux](), [multiplayer](), [reversing](), [scripts]() ### AI overview A writeup of Tasteless 21 multiplayer game-hacking challenges involving a Godot game. It describes analyzing resource packs and binaries, modifying and recompiling Godot scripts, and abusing client-side computations to create hacks such as flying, taking no damage, moving faster, and manipulating random-number behavior. ### Source excerpt A series of game hacking challenges hosted in Tasteless 21. Decompiling, modifying, and recompiling Godot scripts to abuse client-side computations for a multiplayer game. Fly hacks, no-damage, super speed, and rng abuse. ## Exploiting a custom tetris game in CSAW Quals 2020 DevFeed: [Exploiting a custom tetris game in CSAW Quals 2020]() Original publisher: [Read original article]() Published: 2020-09-13T00:00:00Z Content type: tutorial Language: en Sources: [mahaloz.re]() Topics: [Code](), [arcade](), [Ghidra](), [Reconnaissance](), [Script]() Tags: [ctf](), [game](), [ghidra](), [pwn](), [reversing](), [solve](), [writeup]() ### AI overview This writeup explains how a custom Tetris game in CSAW Quals 2020 was analyzed and exploited. The challenge involved discovering cheat-piece placements, obtaining the binary, reverse-engineering its checks, and using an out-of-bounds write to obtain a partial write primitive and ultimately the flag. ### Source excerpt Pwning a custom Tetris game through an out-of-bounds write to memory through block manipulation and changes to the `.text` segment. ## Reversing printf-as-a-VM service in Google Quals 2020 DevFeed: [Reversing printf-as-a-VM service in Google Quals 2020]() Original publisher: [Read original article]() Published: 2020-08-30T00:00:00Z Content type: tutorial Language: en Sources: [mahaloz.re]() Topics: [Reverse Engineering](), [C](), [format](), [Google](), [Ghidra]() Tags: [c](), [ctf](), [format](), [game](), [ghidra](), [reversing](), [vm]() ### AI overview This writeup explains how a Google Quals 2020 challenge implemented a virtual machine using C printf format strings. It covers reverse engineering the program, identifying the format-string instruction set and registers, and beginning to analyze the relevant format specifiers. ### Source excerpt Solving a virtual machine implemented inside format strings found in the printf library in C with @kylebot.