zerotistic

A Minecraft chat command became a trip through Apple's ACE protocol, ARM64 emulation, and Siri's surprisingly complicated way of returning an answer.

How I registered a Linux machine with Apple's private services, received an existing Find My People key over IDS, and decrypted the live location without a Mac.

A set of ELF probes where Linux and static tools reconstruct different runtime state, including one relocation-shadowing file that produces the same false imported-call identification in seven decompilers.

A Redis 8.6 stream PEL ownership bug, a malformed RESTORE payload, and a jemalloc size class collision that turns a shared NACK into code execution.

How a Binary Ninja plugin automatically defeats control flow flattening — dispatcher detection, state variable recovery with Z3, and CFG reconstruction — and the math that makes it work.

An introduction to VM-based obfuscation — its core components, hardening techniques, and open research directions — with a focus on design philosophy.

A running index of my Code of the Week series on Hackcyom, covering lesser-known and logic bugs in code review.

A pwn writeup for the RealWorldCTF 2024 'Let's party in the house' challenge: exploiting a buffer overflow in libjansson to get RCE on a Synology BC500 camera.

Setting up Multi-Repository Variant Analysis, writing a CodeQL query to find LDAP injection, and scanning a thousand repositories to rediscover a bug in a 24k-star project.

Slides and annotations from a lightning talk given at an HackTheBox meetup in Paris on why Binary Ninja is a solid choice for reverse engineering.

A series on Binary Ninja, from the very basics of the UI to writing plugins against its API.