Security research, reverse engineering, and low-level systems exploration.
A 1568×1568 PNG fits about 40,000 characters of text in a 6×10 pixel font. That’s ~10,000 tokens worth of text, billed by Anthropic’s pixel formula as 3,279 image tokens. Do you see where I’m going with this? Snapcompact: …
Cross-posted from X / @_can1357 In fact only the edit tool changed. That’s it. ¶ 0x0: The Wrong Question The conversation right now is almost entirely about which model is best at coding, GPT-5.3 or Opus. Gemini vs whatever dropped …
Bracha’s reliable broadcast has been the go-to Byzantine broadcast primitive since 1987. Three rounds, \(O(n^2)\) messages, optimal fault tolerance at \(n > 3f\). Textbook stuff. I’ve been trying to get a fast multi-value …
What happens when you take IDA Pro to a $30B “decentralized” exchange? Hyperliquid markets itself as a “fully on-chain order book perpetual exchange.” $1 trillion in trading volume. $30 billion valuation. Crypto …
I have released another article about Patchguard almost 5 years ago, ByePg, which was about exception hooking in the kernel, but let’s be frank, it didn’t entirely get rid of Patchguard; in this article I will be discussing an …
As cheesy as the title sounds, I promise it cannot beat the cheesiness of the technique I’ll be telling you about in this post. The morning I saw Mark Ermolov’s tweet about the undocumented instruction reading from/writing to …
Before I begin this series of blog posts, I would like to add a small disclaimer. I have no prior experience or academic knowledge when it comes to compiler development so I might not use the correct jargon or state of the art algorithm, …
Now I know what you are thinking, exception hooks? …in kernel-mode? Yes, it is certainly is not as easy as a mere call to kernel32!AddVectoredExceptionHandler, but with some thinking out of the box we actually can implement a …
Just a few days ago, a new vulnerability allowing an unprivileged user to run #DB handler with user-mode GSBASE was found by Nick Peterson (@nickeverdox) and Nemanja Mulasmajic (@0xNemi). At the end of the whitepaper they published on …
By the end of this post, I aim to make an injector unlike any other: one that by design makes your DLL not debuggable from UM, makes your pages invisible to NtQueryVirtualMemory and NtReadVirtualMemory, and lets you execute code in target …
Trapped in a SMEP disabled payload not being able to do anything reliably? You have come to the right place. I’ve seen so many people using Capcom driver in an unsafe manner that I wanted to make this post, simply explaining why some …
With the introduction of sTLB with Intel Nehalem, TLB splitting – once a reliable technique – became a thing of the past. Those who had to hook user-mode stealthily started looking into hypervisors; specifically EPT violations. …
