expy (@expend20) header
expy (@expend20) profile picture

expy

@expend20
Joined February 2018
  • Tweets309
  • Following895
  • Followers798
28Media
Photo by expy (@expend20)Photo by expy (@expend20)Photo by expy (@expend20)Photo by expy (@expend20)Photo by expy (@expend20)Photo by expy (@expend20)Photo by expy (@expend20)Photo by expy (@expend20)
#flareon13 that's just crazy, just curious people who finished earlier had cyber access or perhaps used codex? Was blocked ungodly amount of times while using opus 5.5 and even 4.8
Image from expy (@expend20)
2
2
1,781
I gave Opus one prompt and all nine Flare-On 12 challenges. It solved them all in 4h 28m. No IDA, no decompiler, no debugger, and it never ran a single binary. Python with capstone, unicorn and z3. More info 👇 #FlareOn #ReverseEngineering #CTF
15
22
2
214
30,085
YT walkthrough: nitter.cf/expend20/status/209919…
expy (@expend20) profile pictureexpy@expend20Sep 13
Single-shot Flare On 12 youtube.com/watch?v=8Ba9u8j-…
Single-shot Flare On 12 (no MCPs)

Single-shot Flare On 12 (no MCPs)

All nine Flare-On 12 challenges from one prompt, one Claude Code se...

youtube.com
6
2,484
Single-shot Flare On 12 youtube.com/watch?v=8Ba9u8j-…
Single-shot Flare On 12 (no MCPs)

Single-shot Flare On 12 (no MCPs)

All nine Flare-On 12 challenges from one prompt, one Claude Code se...

youtube.com
2
1
11
4,951
repos with results: github.com/expend20/flare-on…
GitHub - expend20/flare-on-12-llm-solution: Flare On 12 single shotted by an LLM without major deps

GitHub - expend20/flare-on-12-llm-solution: Flare On 12 single shotted by an LLM without major deps

Flare On 12 single shotted by an LLM without major deps - expend20/flare-on-12-llm-solution

github.com
1
9
3,321
The prompt. I typed this once and didn't touch the keyboard again.
Image from expy (@expend20)
2
17
2,517
ARM64 Windows debuggers, the complete list: 1. WinDbg ...no x64dbg, no CheatEngine. So I wrote #2. Joybug, beating a game I wrote. 👇1/6
5
1
6
1,092
Genuinely curious, and I'll read every reply: which tool you find lacking in your debugging experience? I want to know what to write next. 6/6
47
Before you find out the hard way: Windows only, no WOW64, no ARM64EC, and the host arch has to match the target's. ARM64 debugs ARM64, x64 debugs x64 (for now). Sorry. 5/6
40
Grab it: * Joybug: github.com/org62/joybug-taur… * Full walkthrough: youtu.be/09-DGkv0zqc * The game github.com/org62/bevy-cuboid… 4/6
Releases · org62/joybug-tauri

Releases · org62/joybug-tauri

Contribute to org62/joybug-tauri development by creating an account on GitHub.

github.com
82
Native ARM64 + x64 Windows debugger with an actual UI, own engine. Memory/pointer/string scanning that keeps working while the target runs. WinDbg + x64dbg keybinds. One portable exe. 3/6
94
Nobody minded while ARM Windows was a curiosity. Then Snapdragon X laptops went mainstream and NVIDIA bolted a Grace ARM CPU onto a Blackwell GPU and aimed it at Windows gaming. The games are coming. 2/6
173
Ported Polaris-Obfuscator from C++/LLVM 16 to Python on LLVM 21. 9 passes: encrypted flattening, modular-arithmetic predicates, pointer mazes, function merging, and an X86 MIR pass that makes IDA's decompiler hallucinate variables that never existed. shifting.codes/blog/polaris-…
Raising the Floor: Polaris and the Next Generation of LLVM Obfuscation

Raising the Floor: Polaris and the Next Generation of LLVM Obfuscation

How Polaris upgrades Pluto's obfuscation passes with modular-arithmetic predicates, encrypted control flow, and four new techniques that defeat both static and dynamic analysis

shifting.codes
12
75
6,427
Shifting Codes — open-source LLVM obfuscation passes ported from Pluto/Polaris/riscy-business to Python via llvm-nanobind. 17 passes, PyQt6 UI, works with modern LLVM 21. Blog post walking through Pluto obfuscations: shifting.codes/blog/llvm-obf… GitHub: github.com/expend20/shifting…

Hiding in Plain Sight: Code Obfuscation with Pluto

How Pluto transforms LLVM IR into something a reverse engineer will hate, and how to use it from Python today

shifting.codes
6
26
2,676
which feature of a debugger (or RE tool based on it) you were always missing in WinDBG/x64dbg or CheatEngine?
2
18
1,335
Also made a quick video on how to install TitanHide in Windows Sandbox using the SandboxBootkit project. It takes about 3 minutes end-to-end.
Duncan Ogilvie 🍍 (@mrexodia) profile pictureDuncan Ogilvie 🍍
@mrexodia1 Jun 2025
🔥 TitanHide has been updated to support the latest VMProtect 3.9.4 changes! The service name is now used as the device name as well, so the check for \\.\TitanHide will fail if you name the service differently 🧠
Screenshot showing x64dbg debugging a VMProtect 3.9.4 sample.

ALT Screenshot showing x64dbg debugging a VMProtect 3.9.4 sample.

2
44
186
16,398
Using LLMs to play Flare-On 11. Much more fun compared to pre-LLMs era. youtu.be/w232BOBfoeA
21
1
100
11,035
BinaryShield a bin2bin x86-64 code virtualizer crackme solution youtube.com/watch?v=7cFgJVt2…
25
72
9,572
Solving easy 'Hack This Game' challenge using Cheat Engine youtube.com/watch?v=aWW_XarJ…
Solving easy 'Hack This Game' challenge using Cheat Engine

Solving easy 'Hack This Game' challenge using Cheat Engine

https://crackmy.app/crackmes/hack-this-game-4879

youtube.com
1
7
1,091
I created a hypervisor-based emulator for Windows x64 binaries. This project uses Windows Hypervisor Platform to build a virtualized user-mode environment, allowing syscalls and memory accesses to be logged or intercepted. elastic.co/security-labs/win… Project: github.com/x86matthew/WinVis…
WinVisor – A hypervisor-based emulator for Windows x64 user-mode executables

WinVisor – A hypervisor-based emulator for Windows x64 user-mode executables

WinVisor is a hypervisor-based emulator for Windows x64 user-mode executables that leverages the Windows Hypervisor Platform API to provide a virtualized environment for logging syscalls and enabling...

elastic.co
29
337
9
1,264
113,459
Load more