Blog
Field notes on vulnerability research, penetration testing, and the security of OT/ICS and IoT systems.
Subscribe via RSSHow an out-of-bounds read in MariaDB's .frm metadata parser can be turned into a forged C++ object with a fake vtable, reaching arbitrary code execution as the mariadbd process (MDEV-40571).
Read full articleWhy random-mutation fuzzers lose coverage on structured protocols, and how to model a PDU with a grammar to systematically traverse field combinations. Covers And/Or combinatorial-explosion control, automatic boundary-value generation, automatic Size-field computation, and Lua-based checksum recomputation.
Read full articleHow to analyze automotive ECU architectures (PPC-VLE, TriCore) that IDA, Ghidra, and Binary Ninja don't support out of the box. The IR-as-common-language structure of RE tools, the formula for implementing an architecture plugin, and how non-standard calling conventions poison data-flow analysis, with the fix.
Read full articleWhen started with --reranking, llama.cpp lets a remote attacker trigger a denial of service (std::bad_alloc, HTTP 500) via a negative top_n on POST /rerank (CVE-2026-52132).
Read full articleA crafted GGUF file with an empty metadata key reaches an assertion in llama.cpp's gguf_reader::read and aborts the process. Affects any binary that loads GGUF files (CVE-2026-52131).
Read full articleA deeply nested JSON schema exhausts the recursion stack in llama.cpp's grammar converter, crashing the server. Only POST /completions is affected (CVE-2026-52130).
Read full articleMultiple studies conclude that an LLM agent's completion bias and overconfidence cannot be corrected by prompting. This post lays out the design principles of a vulnerability-checking automation harness that makes "surveyed everything" and "0 vulnerabilities" computed from an HMAC receipt ledger and deterministic hooks rather than from the model's narrative. A "200 OK" without a negative control is not confirmation.
Read full articleMasked FVE record: a data API with no authentication or authorization returned real-name rosters of residents' association officers, facility staff contacts and employee numbers in bulk.
Read full articleAn anatomy of how Achilles Communications Certification (ACC) tests PLCs, RTUs, and industrial switches. It covers the classification of 31 L1 / 54 L2 test cases, the seven test types (Scans, Storms, Fuzzers, Grammars), control-protocol coverage from the IP stack up to DNP3, Modbus, and IEC 61850, and what the Normal/Warning/Failure monitors actually determine.
Read full articleA primer map for anyone new to IEC 62443-4-2. Covers why the 62443 series is divided by audience rather than topic, the four faces of SL and the three faces of SL 0, the Component Requirements (CR) of the seven Foundational Requirements (FR1-7), the SAR/EDR/HDR/NDR component types, and the distinctly industrial-security idea of "maintain degraded mode instead of preventing DoS."
Read full articleWhen a manufacturer says "we're IEC 62443-4-2 SL2 certified," the sentence alone tells you nothing about what was actually verified. This post dissects the arithmetic behind the three numbers (RA, NAR, TR) printed on a certificate, the decisive difference between N/A and out-of-scope, and why confusing SL-T/SL-C/SL-D/SL-A ruins any reading of the certificate.
Read full articleThe EU Cyber Resilience Act (Regulation (EU) 2024/2847) is the world's first law to mandate cybersecurity for physical products with digital elements. This post lays out the incoming timeline (reporting obligations on 2026-09-11, full application on 2027-12-11), how 62443 becomes the basis of CE marking as a harmonised standard, and the 6 CRA-specific requirements 62443 does not cover.
Read full articleMany legacy industrial control protocols were designed without authentication or integrity guarantees. This wasn't a mistake — it was a rational choice for the 2000s, premised on an air-gapped network, and this post examines how that choice became today's security debt, using open protocols (Modbus, DNP3) as examples.
Read full articleA defender's retrospective on the attack surface of the MikroTik RB4011 using only public hardware specifications and already-patched CVEs. It organizes router hardening principles centered on the CVE-2023-32154 case from Pwn2Own Toronto 2022.
Read full articleA breakdown of four open-source agent frameworks (CAI, PentAGI, OpenManus, CRS) grounded in their actual code and papers, plus what DARPA AIxCC revealed about the current state of autonomous vulnerability discovery and patching.
Read full articleFrom what an agent is, to sub-agent interaction, to a catalog of multi-agent patterns, to the harness engineering that wraps it all. A single-article summary of the fundamentals of designing AI agent systems.
Read full articleA single-page summary of four standards in the agent ecosystem. MCP (tool access), A2A (agent-to-agent communication), AGENTS.md (project rules), and SKILL.md (task procedures) — what each standardizes and how they complement one another.
Read full articleStarting from Naive RAG's 7 limitations, this post compares 8 variants including Graph RAG, RAPTOR, and Agentic RAG, and covers practical design for embedding dimensions, chunking, and hybrid search through the 3 levels of agent memory.
Read full articleIn an era where LLM agents have started solving CTFs automatically, how do you design a challenge that "machines struggle with but a skilled human solves in a reasonable time"? This organizes the anti-LLM design principles that target the structural limits of transformers — state tracking, carry propagation, tokenization, and context loss.
Read full articleAn explanation of the MFDS medical device cybersecurity approval/review guideline (Guidance No. 0995-05, 2025.01.10) on the basis of IEC 62443-4-2. It organizes, from the perspective of regulatory practitioners and developers, the structure of the 35 requirements across 6 categories, the mapping to the IEC 62443 FR/CR system, the approval submission requirements, and the transition schedule before and after revision.
Read full articleA defender's explanation of how the three international standards that govern the safety and cybersecurity of medical device software — ISO 14971, IEC 62304, and IEC 62443 — each own a different axis and where they overlap.
Read full articleMasked FVE record: a null accessToken was accepted and order IDs increased sequentially, so anyone could read other customers' phone numbers, names and payment methods without authentication.
Read full articleMasked FVE record: a missing authentication-level check let an anonymous session read a victim's resident-number-based linking information (CI) and identity details.
Read full articleMasked FVE record: an object-level authorization flaw let anyone change another member's password with nothing but an integer member number.
Read full articleThe architecture of a hierarchical multi-agent system that performs autonomous vulnerability assessment, from network reconnaissance to exploit validation. Seven specialists, a five-phase workflow, and the confirmation oracle, execution isolation, and RoE reference monitor that pull the judgment authority out of the model.
Read full articleA collection of Suninatas wargame writeups covering Forensics 14, 15, 18, and Simple Login.
Read full articleKongju National University Gifted Center pwnable2 challenge — patching a Sleep NOP to print the flag instantly.
Read full articleSolving CSAW 2013 Exploitation 2 (200 points) by sending a buffer and a secret, then overwriting RET with a buffer overflow.
Read full articleWalkthrough of the "alert(1) to win" XSS challenge.
Read full articleHow a stack buffer overflow was found in the compression utility dact using AFL and AddressSanitizer. Root-cause analysis of a file_extd_urls array overflow triggered by a crafted DACT header.
Read full articleExploiting HackSys Extreme Vulnerable Driver (HEVD) on Windows 7 x86: a kernel stack buffer overflow using token-stealing shellcode, and privilege escalation via a Write-What-Where overwrite of the HalDispatchTable
Read full articleHow to build the Chrome V8 engine source on Windows and Linux
Read full articleA practical reference for binary exploitation and firmware analysis work: extracting shellcode, finding libc /bin/sh addresses, pwn compilation flags, BinDiff installation, fixing binwalk/sasquatch errors, and AFL crash triage.
Read full articleAnalysis of a type confusion vulnerability caused by a missing global-property Map stability check in V8's TurboFan JIT, plus a Windows RCE exploit
Read full articleStatic reverse engineering of two 32-bit PE binaries identified as Ryuk ransomware (Hermes variant). Covers the dropper/loader and the encryption payload, including persistence, process injection, and VSS deletion behavior.
Read full articleStatic/dynamic analysis of two 32-bit PE binaries — a WinMain-based narrow-down analysis using IDA
Read full articleA draft design for blackbox fuzzing of the LS Electric PLC system, built on analysis of the XGT protocol. Covers automated mutation strategy, crash triage, and the monitoring infrastructure for discovering vulnerabilities in industrial control systems.
Read full articleAn introduction to coverage-guided fuzzing with AFL: instrumenting xpdf, triaging crashes, and reproducing CVE-2019-13288
Read full articleA writeup for RITSEC CTF 2021's baby WASM challenge, covering WebAssembly bytecode reversing, the WASM memory model, and flag extraction.
Read full articleAnalysis of CVE-2021-26411, a UAF vulnerability in the Internet Explorer JavaScript engine that the Lazarus Group exploited in real-world attacks
Read full articleThe H2C Smuggling technique: abusing the HTTP/2 cleartext upgrade to bypass reverse proxy access controls and reach internal endpoints
Read full articleA security analysis of RAUC, a robust auto-update mechanism used in embedded Linux systems, focusing on update-chain integrity and attack surface.
Read full articleAn in-depth analysis of two vulnerabilities found in Netis MEX605 router firmware v2.00.06: OS command injection via the ping diagnostic tool, and DOM-based XSS in the NTP server configuration.
Read full articleAn introduction to malware analysis techniques — static/dynamic analysis, malware types, and Windows DLL import analysis
Read full articleA research summary covering automated dynamic analysis techniques for Linux-based embedded firmware. Explains FIRMADYNE's emulation strategy, peripheral modeling, and vulnerability discovery methodology.
Read full articleAnalysis of HTTP Request Smuggling (HTTP DeSync Attack): how CL.TE and TE.CL deserialization vulnerabilities bypass frontend security controls and poison the backend request queue
Read full articleA command injection vulnerability found in the WPS PIN handling of the E5600 router — authenticated remote code execution via a crafted WPS PIN parameter
Read full articleStatic and dynamic analysis of the Anubis banking trojan/stealer: persistence mechanisms, C2 communication, and credential theft techniques
Read full articleUnderstanding x86 assembly patterns by debugging Hello World, addition, and calculator programs with GDB
Read full articleAnalyzing how C control structures (if-else, for, while, do-while) compile down to x86 assembly
Read full articleAnalysis of an Integer Overflow (SMBGhost) and an uninitialized kernel memory leak (SMBleed) in the SMBv3.1.1 decompression routine, and a Pre-Auth RCE achieved by chaining the two bugs
Read full articleA step-by-step walkthrough of ARM binary exploitation: reading ARM assembly by hand (hand-ray), stack buffer overflows, ROP gadget chaining, and the ret2zp (return-to-zero-page) technique
Read full articleA hands-on look at the AArch64 calling convention, Link Register control, and ROP chain construction for CTF-style exploitation
Read full articleA practical guide to using angr for CTF binary analysis: symbolic execution basics, find/avoid strategies, setting up symbolic registers and stack arguments, and solving crackmes automatically
Read full articleA hands-on ARM64 exploitation walkthrough covering the AArch64 calling convention, stack layout differences from x86-64, and ROP chain construction
Read full articleMounting a crafted f2fs image and running operations triggers a slab out-of-bounds read in ttm_put_pages.
Read full articleMounting a crafted btrfs image and running operations triggers a slab out-of-bounds write in __btrfs_map_block.
Read full articleMounting a crafted f2fs image triggers a NULL pointer dereference in f2fs_recover_fsync_data.
Read full articleMounting a crafted f2fs image triggers a slab out-of-bounds write in __remove_dirty_segment.
Read full articleA syncfs syscall after operations on a crafted btrfs image triggers a use-after-free reached via mutex_can_spin_on_owner.
Read full articleMounting a crafted f2fs image triggers a slab out-of-bounds read in init_min_max_mtime.
Read full articleA syncfs syscall after operations on a crafted btrfs image triggers a use-after-free in try_merge_free_space.
Read full articleMounting a crafted ext4 image, running a few operations, then unmounting triggers a use-after-free in ext4_put_super.
Read full articleMounting a crafted btrfs filesystem image leads to a slab-out-of-bounds write in index_rbio_pages in fs/btrfs/raid56.c.
Read full articleMounting a crafted btrfs image, performing some operations, and unmounting leads to a use-after-free in btrfs_queue_work in fs/btrfs/async-thread.c.
Read full articleMounting a crafted btrfs image twice causes an rwsem_down_write_slowpath use-after-free because rwsem_owner_flags returns an already freed task_struct pointer.
Read full articleA setxattr operation after mounting a crafted ext4 image causes a slab-out-of-bounds write in ext4_xattr_set_entry because a large old_size value is used in a memset call.
Read full article__btrfs_free_extent in fs/btrfs/extent-tree.c calls btrfs_print_leaf in a certain ENOENT case, leaking potentially sensitive register values to local users through dmesg.
Read full articleext4_empty_dir in fs/ext4/namei.c allows a NULL pointer dereference because ext4_read_dirblock(inode,0,DIRENT_HTREE) can return zero after a crafted ext4 image is mounted.
Read full articlebtrfs_root_node in fs/btrfs/ctree.c allows a NULL pointer dereference because rcu_dereference(root->node) can return zero when a crafted btrfs image is mounted.
Read full articleA crafted btrfs image triggers a NULL pointer dereference in btrfs_verify_dev_extents because fs_devices->devices is mishandled inside find_device (fs/btrfs/volumes.c) in Linux kernels before 5.1.
Read full articleAn in-depth analysis of checkm8, the BootROM exploit for Apple A5-A11 SoCs: the USB DFU stack use-after-free, heap grooming, and AArch64 shellcode execution.
Read full articleWriteups for SUA CTF 2019 challenges in the pwn and reversing categories.
Read full articleWriteups for HackCTF's pwn category: basic BOF, format string bugs, heap exploitation (tcache), RTL chaining, and x64 buffer overflow.
Read full articleA retrospective on my time in Best of the Best (BoB) Cohort 8 — building a filesystem fuzzer, finding 16 CVEs, and speaking at CodeBlue and HITB
Read full articleWriteups for Reversing.kr's Easy series -- Easy CrackMe, Easy ELF, Easy Keygen, Easy Unpack, and Replace -- solved through static and dynamic analysis.
Read full articleProgressing through the LOB (Lord of Buffer Overflow) wargame: Gate (basic BOF), Iron_golem (partial RELRO bypass), Dark_eyes (NX + ASLR) — tracing the evolution of Linux exploitation techniques.
Read full articleA step-by-step breakdown of a V8 OOB exploit: type confusion, addrOf/fakeObj primitives, and WASM RWX shellcode execution
Read full articleSolving pwnable.kr challenges: ARM PC computation quirks (leg), a GOT overwrite via scanf (passcode), and building a ROP chain (horcruxes).
Read full articleWriteups for the ROP Emporium ret2win (basic ROP control-flow hijacking) and callme (chained function calls with specific arguments) challenges.
Read full articleA shellcode injection writeup for Pwnable.tw's Start challenge, exploiting a stack-based buffer overflow in a minimal 32-bit Linux binary with no NX protection.
Read full articleSolving the Protostar wargame: stack buffer overflows, format string bugs, heap exploitation, and a network challenge.
Read full articleSolving exploit.me's vulnerable service: stack buffer overflows, return address overwrites, shellcode injection, and ROP techniques on x86 Linux.
Read full articleSolutions to picoCTF 2018 pwn and assembly challenges: a buffer overflow series, x86 assembly puzzles, and shellcode execution.
Read full articleMS17-010 EternalBlue analysis — the SMBv1 buffer overflow exploit used in WannaCry and NotPetya, and a packet-level analysis of the Metasploit module
Read full articleAnalysis of a heap-based buffer overflow in FFmpeg's libavformat HLS demuxer — arbitrary code execution via a crafted HLS playlist
Read full articleSolving DEF CON 23's babycmd: command injection via blacklist bypass on a 64-bit Linux binary, with a shell-escape technique.
Read full articleSolving DEF CON 22 CTF Qualifier's r0pbaby: leaking the shared library base, finding gadgets via PLT/GOT, and building a 64-bit ROP chain to call system().
Read full articleA classic Plaid CTF 2013 challenge: a ret2libc / ROP chain exploit against a 32-bit Linux binary.
Read full article