reverse-skills-max/reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-reverse-pwn/references/reverse-pwn.md

Reverse, DFIR, And Pwn Playbook

Reverse And DFIR

• Start with file type, headers, sections, imports, strings, resources, embedded archives, entropy
• Reconstruct process trees, persistence, startup paths, IPC, and network beacons as one execution graph
• Explain when each recovered value becomes plaintext and where it came from

Pwn And Native

• Record mitigations, loader path, libc build, protocol framing, syscall surface
• Separate exploit prerequisites from exploit proof
• Tie allocator layout, crash state, and target object to observed execution

Evidence To Keep

• One compact block for offsets, hashes, imports, config fields, or registry paths
• One compact block for crash state, leaks, allocator state, and protocol steps
• Minimal but sufficient logs proving the decoded layer or privilege effect

Common Pitfalls

• Mixing original and modified artifacts
• Treating one string hit as proof of the full behavior
• Naming a primitive without replaying it from a clean baseline