I pointed an agent at a bootloader. It found bugs but not useful ones
Now that we're past the sensational headline, let's be real. This is the first post in a series about using AI/LLMs to do security work. I know,
Read entryLow-level adventures
All things hardware, reverse-engineering, exploit-dev, and fuzzing!
channel open
Research topics
// lab index
Latest dispatches
// latest dispatches
Breaking secure boot without breaking the crypto
This will be mostly rambling disguised as a technical walkthrough. I will touch on certain topics such as hardware roots of trust, signed image formats, Qualcomm boot stages, Android Verified Boot, UEFI,
Read entry
From a stale README to a security research intelligence platform
A stale security-papers README grew into AI Scholar: a production system that ingests papers, deduplicates identities, extracts structured security-research records, maps the corpus as an atlas, and surfaces tensions between papers before I read them end to end.
Read entry
The State of Go Fuzzing - Did we already reach the peak?
During one of the recent working days, I was tasked with fuzzing some Go applications. That's something I had not done in a while, so my first course of action
Read entry
Learning Linux kernel exploitation - Part 2 - CVE-2022-0847
Continuing to walk down Linux Kernel exploitation lane. This time around with an unanticipated topic: DirtyPipe as it actually nicely fits the series as an example.
Read entry
Learning Linux kernel exploitation - Part 1 - Laying the groundwork
Disclaimer: This post will cover basic steps to accomplish a privilege escalation based on a vulnerable driver. The basis for this introduction will be a challenge from the hxp2020 CTF called "
Read entry
Overview of GLIBC heap exploitation techniques
Overview of current GLIBC heap exploitation techniques up to GLIBC 2.34, including their ideas and introduced mitigations along the way
Read entry
MISC study notes about ARM AArch64 Assembly and the ARM Trusted Execution Environment (TEE)
Disclaimer: These are unfiltered study notes mostly for myself. Guaranteed not to be error free. So if you did land here, managed to get to the end of it and found some
Read entry
LinkSys EA6100 AC1200 - Part 2 - A serial connection FTW!
Last time we left off with a pretty decent understanding about how our router is structured and what components were used. We also found two interesting debug pads that showed oscillating voltages
Read entry
The devil entered the stage!
This is a write-up for solving the devils-swapper RE challenge. It was mostly intended for my personal archive, but since it may be interesting to all of you. This especially
Read entry