If you’re reading this, it means you’re accessing my blog from the world wide web. That’s cool and all, but have you heard of this thing called Gopher ? If I’ve piqued your interest, you might want to checkout the mirror of my blog at gopher.feyor.sh (gopher://gopher.feyor.sh). There’s not complete feature parity with the HTML version, but I’m quite happy with…
I’ve been contemplating getting into FPV since I was in high school, but since I lived in Chicago at the time (and I didn’t own a car) there weren’t many places for me to fly a racing drone. But once I moved to the cornfields I didn’t have an excuse, so after finding a decent deal on a pair of Fatshark goggles (and then procrastinating for 2 years) I finally decided to…
A while back I was messing around with eBPF and I couldn’t find any good materials on using BPF without libbpf/LLVM/GCC (i.e. rawdogging bytecode), so here’s the resource I wished I had. I’ll be using Linux version 6.18 in this post; eBPF moves pretty fast and the verifier gets smarter with every release, so the information in this post might be out of date when you read this. In…
The other day I was working on a pwn challenge and I noticed something interesting: its version of libc had partial RELRO enabled. To redirect control flow I tried overwriting one of libc’s GOT entries with a one_gadget, but I didn’t have enough register control to pop a shell. That got me thinking: what if we could use libc’s GOT as a sort of jump table? This is a technique…
Table of Contents House of Force Fastbin dup Unsafe unlink Safe unlink House of Orange House of Spirit House of Lore House of Einherjar House of Rabbit Tcache dup Tcache dumping Below are some of my notes and challenge writeups for Max Kamper’s excellent Glibc malloc pwn course, HeapLAB . This page will be updated with more challenges in the future. House of Force This technique comes from…
Emacsjail was an Emacs Lisp jail challenge I wrote for UIUCTF 2025. There were 17 solves during the competition, some of which were quite creative! Description Mom, can we have SBCL? No, we have SBCL at home. SBCL at home: Emacs Lisp ;;; -*- lexical-binding:t -*- ( defun check ( input ) ( not ( string-match-p '.*(.*).*' input ))) ( defun panic ( str &rest fmt ) ( message str fmt ) ( kill-emacs ))…
Helpful is a fantastic Emacs package that drastically improves the builtin help-mode . One of the particularly nice features is finding references to a particular symbol. Unfortunately it can be painfully slow in practice due to actually parsing every loaded Elisp file: Emacs Lisp ( require 'benchmark ) ( benchmark-elapse ( elisp-refs-function #'car )) 24.001221 Instead of walking the ASTs of…
I have a slight problem wherein every time I start up a game of NetHack, I completely lose touch with my surroundings for hours on end. Thankfully The DevTeam Thinks Of Everything and there’s a solution that allows communication with the outside world without breaking immersion: the mail daemon! If compiled with -DMAIL and OPTIONS=mail is set in your runtime configuration (the default on…
This challenge was my first experience with kernel pwn, and I’ve got to say it’s a pretty good introduction! Description Security is difficult, and defenses should be always taken with a grain of salt. Who would win? A buffer overflow or The Hottest Linux Defenses? Flag is in /dev/sda . Files kernel-rop-bf9c106d45917343.tar.xz Solution We’re given the kernel image vmlinuz and the…
Disaster is an Emacs package authored by the venerable Justine Tunney that allows disassembling C/C++ and Fortran code from the comfort of your source editing buffer. I really like this idea, but most of the time I’m interested in x86_64 assembly instead of my aarch64 host platform, so I decided to hack on cross compilation support using Zig as a C/C++ cross compiler ! I’m using…
I was talking with my roommate about his Org agenda workflow and he noticed some “trivial” tasks cluttering his inbox. These tasks required no thought, but required being at a specific place to complete. My roommate and I both use the wonderful iOS app beorg to keep our Org files synced to our phones so we can receive reminders and file things into our inboxes when away from our…
I decided to start using an RSS client, primarily because I kept coming back to these same few blogs with really nice content and wanted to stay updated, but also because the signal-to-noise ratio on e.g. Reddit is horrendous and mindlessly doomscrolling is not a good use of my time. I’ve gone through a real Emacs ricing stint lately, and as the lines of elisp in my config continue to…
Schrödinger’s Cat was a quantum computing misc challenge repurposed written for UIUCTF 2023. The challenge had unrated difficulty and had 17 solves during the competition. Description Our boss got mad that our SSH keys were weak, so now we’re using a quantum computer to be extra secure! Hints Hint 0: There are known bugs in OpenQASM transpilation — please use Qiskit, and optimize your…