zolutal’s blog

One of the inspirations for my work on the System Register Hijacking paper was this blog post by Project Zero written by Andrey Konovalov.

I played Securinets Quals this weekend with Shellphish; we ended up placing 7th, qualifying us for finals!

Linux Kernel ROP gadget scanning is one of those things that seems easy in theory – just run ROPgadget --binary vmlinux on it!

This year I played corCTF with Shellphish, and we did pretty well – placing 6th!

As it turns out, on recent Ubuntu, Arch, Fedora, and likely other distro’s releases, with kernel versions >=5.18, library ASLR is literally broken for 32-bit libraries of at least 2MB in size, on certain filesystems.

I’ve spent quite a lot of time messing with x86_64 page tables, understanding address translation is not easy and when I started learning about it I felt like a lot of the material out there on how it works was hard for me to wrap my head around.

I played corCTF this weekend and managed to solve two pretty tough challenges.

I recently came across a bunch of research describing attacks on memory deduplication, it has been used to fingerprint systems[1], crack (K)ASLR[2,3,4], leak database records[4], and even exploit rowhammer[5].