All Writeups

Comprehensive collection of CTF challenges, solutions, and insights.


Filter by tag:

WHAMazon! Rev 2 - Armor

Identifying a PyArmor v9.x protected Python script, generating the correct runtime to execute it, and extracting a base64-encoded flag from the crash dump it writes to disk.

WHAMazon! Rev 1 - Stage ?

Peeling back two layers of PowerShell obfuscation, a base64-encoded outer script and a string-split encoded flag inside, to recover the plaintext flag.