Ariel Koren - Writing and research

A write-side fuzzing campaign against libpng18's APNG re-encode path found a per-frame buffer lifecycle bug causing both a memory leak and a width-dependent heap buffer overflow.

A verified heap out-of-bounds write in Skia's SkOTUtils::RenameFont via the public GDI font API on Windows - reported, reproduced, declined won't-fix.

AI made execution cheap and direction the bottleneck.

A systems-design writeup of Anvil: how AI agents do the research glue work while schemas, sanitizers, reachability, and an evidence ladder keep the claims honest.

A language model predicts; an agent acts.

A founder write-up on OmniBoard, the board game console I shelved when 20 flexible color e-ink cards drove the BOM north of $600.

A single afternoon of fuzzing against libheif 1.21.2 produced two memory-safety bugs in the same function.

Walkthrough of a maliciously crafted Office document that evaded every static engine on VirusTotal - and what the engines were missing.

A grammar-driven .glb fuzzing campaign found a memory-corruption bug in the shared 3D parser used by Microsoft Word and the Microsoft 3D Viewer.

Walkthrough and exploit for Level 06 of the Fusion exploitation series.

Solution for Level 05 of the Fusion series.

Deep technical dive into the Nymaim banking trojan: anti-analysis tricks, control-flow obfuscation, and the parts that fight back.

Reverse-engineering walkthrough of Ursnif: process injection, sandbox evasion, traffic obfuscation, and a bug in the malware's own DGA.