Spoofing

all chapters

• Chapter 2 Cracking XorDDoS open with Ghidra XorDDoS · 2026-08 · updated 2026-09-19 In Chapter 1 the C2 stayed encrypted inside the binary. Here I open it with Ghidra and it comes out whole — but on the way, everything else this critter carries turns up too: how it disguises itself as a system process, how it kills the competition using the very trail that gives it away, and how it lies about its own address when its command centre tells it to.