Introduction I haven’t posted in a while and I’m intending to write more often. I will start this new era with a non-techincal blog post about my life. In the beginning of May 2025 I went to Vietnam to visit the place my lovely girlfriend was born and raised. I met her amazing family and felt the most welcome I’ve ever been. So the best way to do them justice to my 10-day escapade is to write down…
Introduction I’ve seen a lot of papers in the academia talk about static analysis in linux kernel’s source code. Some use old tools like KINT , some others just mention an LLVM use-def pass, but for a newcomer it’s difficult to write all of those on their own. In this blog post, I will go step by step into how to track a variable allocation, its data type and it respective kmalloc cache . I will…
In this blog post I publish the results of a project I did during Thanksgiving. While eating an unhealthy amount of turkey I brought up the topic of AI and warned my parents about the risks of its misuse. One such risk being the biggest nightmare of every security practitioner – AI lowering the bar for petty skids to hack real systems after they got bored taking L’s in Fortnite. Security is not a…
Preface Before I get started with this post, I want to give a shouout to OpenAI’s dall-e for generating this whacky cover photo. I will keep this trend of AI cover photos from now on. Now lets start by laying the basis of this post. We will be assuming the threat model of an attacker that is running on user-level privileges. Basically, the attacker needs to be able to reach a privileged state that…
This post is a gentle overview of our paper . I will present some other interesting results we didn’t include in the paper that might interest the broader audience and the industry. Introduction Dynamic malware analysis is the go-to tool for clustering malware into families [1] [2] [3] [4] or detecting malware in cases where static analysis would fail [5] [6] , such as polymorphic malware. Prior…
Introduction In this blog post I will explore the commercial malware sandboxes. It appears malware is allowed to access the internet in many sandboxes . So with that access I decided to collect all the environmental features I could think of and send them to my discord channel. Since Python is the language with the largest library support ever (maybe?) I wrote a python script to take many…