Gravitational plate of three masses and a slashed discABC0Static engraved plate. Three-dimensional view is unavailable or reduced motion is requested.

← back to fieldhole

through the hole

all notes

The ring is not a fourth main. It is a hole. Everything that has been written is here, including scraps that did not earn a public fold.

  1. Aug 5, 2025/articleGroth16From arithmetic circuits through R1CS and QAP to Groth16's three-element proof, trusted setup toxic waste, and the single pairing verification equation.
  2. Aug 1, 2025/articleAnalysis of ZKP implementation vulnerabilities: under-constrained inputs and Frozen HeartHow missing binary constraints on MultiMux1 selectors break BinaryMerkleRoot/Semaphore membership proofs, and how omitting public inputs from Fiat–Shamir transcripts enables Frozen Heart forgery in PlonK implementations.
  3. Jul 31, 2025/articleDeposit Forwarder SystemArchitecture for per-user deterministic deposit contracts: factory, master forwarder roles, and ETH/ERC-20 forward flows for an exchange backend.
  4. Jul 23, 2025/articleExploring KZG polynomial commitmentsWhy constant-size polynomial commitments beat per-coefficient Pedersen commits, how pairings and t-SDH/t-BSDH underwrite KZG, and the Setup / Commit / CreateWitness / VerifyEval flow.
  5. Jul 6, 2025/articleExploring PlonKProver-side walkthrough of PlonK: gate and wiring constraints, polynomial compilation, the five proof rounds, and how the verifier checks the batched opening.
  6. Dec 20, 2023/articleBlockchain data availability and blobspaceHow light clients face the data availability problem, what Celestia, EigenDA, and DACs change, and how EIP-4844 blobs, KZG, and danksharding reshape rollup throughput.
  7. Mar 3, 2023/articleBlockchain infrastructure and consensus protocol securityStudy notes on PoW vs PoS, finality, and BFT- versus chain-based stake protocols, framed by a survey of long-range attacks on Proof-of-Stake.
  8. Mar 3, 2023/articleLong-range attacks on Proof of Stake — survey notesStudy notes on long-range attacks in PoS: costless simulation, weak subjectivity, simple / posterior-corruption / stake-bleeding variants, and why no single mitigation closes the class.
  9. Feb 2, 2023/articleUniswap V2 math and contract reviewCPMM price rules, marginal price, TWAP oracle, flash swaps, EIP-712 permits, UQ112.112 fixed-point, protocol fees, sync/skim, and a walk through v2-core and v2-periphery.
  10. Jan 30, 2023/articleAMM and PMM mechanisms: math beyond the limit order bookFrom LOB limits to AMM conservation functions: actors, assets, slippage, divergence loss, and a state-space formalization of swaps and liquidity changes.
  11. Jan 25, 2023/articleEthereum P2P eclipse attacks (geth-era study notes)Paper notes on low-resource eclipse attacks against Ethereum's Kademlia-style discovery: why ECDSA node IDs and connection bias mattered before geth v1.8, and what changed.
  12. Jan 19, 2023/articleEVM storage layout collisions and upgradeable proxiesHow Solidity packs storage slots, how proxy + delegatecall share that layout, where upgradeable proxies collide, and the usual mitigations (EIP-1967-style slots, initializers, pattern choices).
  13. Aug 4, 2022/articleUniswapV2 subgraph event queriesHow The Graph indexes contract events: subgraph manifests, GraphQL schemas, AssemblyScript handlers, and a local graph-node deploy for a Swapper-style Uniswap flow.
  14. Aug 3, 2022/articleUniswap V2 smart contractsUniswap V2 core and periphery: Factory, Pair, Router, LP tokens, mint/burn/swap paths, reserve updates, and a swapper/subgraph lab section.
  15. Aug 1, 2022/articleSolana programs and Web3 APIWalkthrough of Solana web3.js patterns: connect, keypair, airdrop, transfer, deploy a hello-world program, create greeting accounts, and read/write on-chain state.
  16. Jul 31, 2022/articleSolana transactionsHow Solana transactions bundle instructions, list accounts up front for parallel execution, and charge deterministic fees with a recent blockhash.
  17. Jul 31, 2022/articleSolana on-chain programsHow Solana separates executable programs from account data, what native and SPL programs provide, and how Rust programs are structured and deployed.
  18. Jul 31, 2022/articleSolana accounts modelHow Solana accounts store state: data vs program accounts, PDA limits, ownership rules, rent, and the fields every account carries.
  19. Jul 31, 2022/articleSolana Program Derived AddressesHow Solana PDAs are discovered off the ed25519 curve via seeds and bumps, signed with invoke_signed, and used as program-controlled account indexes.
  20. Dec 31, 2021/articleCloud Vulnerability Lab 6 (CloudGoat: EC2 SSRF)CloudGoat EC2 SSRF path: Solus reads Lambda env keys for Wrex, SSRF hits IMDS, S3 yields Shepard admin creds, then invoke the target Lambda.
  21. Dec 31, 2021/articleCloud service vulnerability analysis 5 (CloudGoat: IAM privilege escalation by attachment)CloudGoat iam_privesc_by_attachment: from Kerrigan's limited IAM user, swap a meek instance profile for a mighty role, launch an EC2 foothold, and terminate the super-critical server.
  22. Dec 31, 2021/articleCloud Service Vulnerability Lab 4 (CloudGoat: Cloud Breach S3)Walkthrough of CloudGoat's cloud_breach_s3 scenario: abuse a misconfigured reverse proxy to reach IMDS, steal the instance-profile keys, and sync confidential objects out of a private S3 bucket.
  23. Dec 31, 2021/articleCloud Vulnerability Lab 2 (CloudGoat: IAM Privilege Escalation by Rollback)CloudGoat walkthrough: start as limited IAM user Raynor, find SetDefaultPolicyVersion, roll back to a policy version with full admin, and confirm the privilege jump.
  24. Dec 31, 2021/archiveCloud service vulnerability analysis 1: CloudGoat lab setupInstall Rhino Security Labs CloudGoat, create an admin IAM user for lab control, and wire AWS CLI plus CloudGoat profile/whitelist config.
  25. Dec 31, 2021/articleCloud service vulnerability analysis 0: overviewSeries opener on cloud security: public vs private clouds, OpenStack/Nova basics, and AWS IAM, EC2, S3, and Lambda as the usual attack surface.
  26. Dec 26, 2021/articleWeb Application SSRF / XXE / SSTI Research NotesPractical notes on SSRF (including gopher into MySQL), XXE (file read and blind OOB), and Jinja2 SSTI sandbox escape via MRO and subprocess.
  27. Dec 25, 2021/archiveWeb application RCE patternsShort notes on common remote code execution paths in PHP file inclusion, Node.js eval/injection, and Flask/Jinja2 server-side template injection.
  28. Dec 24, 2021/articleVulnerability analysis of commercial metaverse-based virtual office platformsBoB MetaVersPloit team report: methodology, common features, and attack impact across Gather, oVice, Kumospace, Spatial, and Horizon Workrooms — 31 findings in four months.
  29. Apr 1, 2021/archiveHyper-V Ubuntu 20.04 Full-Screen FixSet Ubuntu 20.04 on Hyper-V to 1920x1080 by editing GRUB's hyperv_fb mode, updating grub, and rebooting.
  30. Mar 30, 2021/archiveWindows heap management layersHow Windows memory allocation stacks from the kernel manager through VirtualAlloc, the heap APIs, malloc/free, and new/delete — and when each layer is the wrong tool.
  31. Mar 1, 2021/articleLinked-List Attack Surface on Intel (Structure Notes)Singly linked list layout, insert/remove helpers, and Intel disassembly of nodeAlloc/nodeSet/Init/frontInsert/rearInsert/rearRemove with IDA struct recovery and heap traces.
  32. Feb 10, 2021/archiveARM Load/Store Multiple Register InstructionsHow ARM and Thumb LDM/STM move register sets, the four addressing modes, and how those instructions implement push/pop and nested subroutine frames.
  33. Feb 10, 2021/archiveARM LDR Rd, =constHow the LDR Rd, =const pseudo-instruction builds 32-bit immediates via MOV/MVN or a literal pool, and when LTORG keeps the pool in range.
  34. Feb 10, 2021/archiveARM Data Transfer: Pre/Post-Index and STR/LDRHow ARM moves data between registers and memory with LDR/STR, and how pre-index versus post-index addressing updates the base register.
  35. Feb 10, 2021/archiveARM: loading constants into registersWhy you cannot load an arbitrary 32-bit immediate in one ARM instruction, and how MOV and MVN cover the common cases without a separate memory load.
  36. Feb 10, 2021/archiveARM: Loading Addresses into RegistersADR/ADRL vs LDR Rd,=label for address materialization, jump-table patterns, and string-copy examples in ARM and Thumb.
  37. Feb 9, 2021/archiveARM and Thumb instructionsLoad/store and 3-address data processing on ARM, conditional execution, barrel-shifter operands, and how Thumb differs on registers, flags, and branches.
  38. Feb 9, 2021/archiveARM RegistersQuick reference for ARM's banked registers, general-purpose roles (r0–r15), CPSR flags, and SPSR exception state.
  39. Feb 9, 2021/archiveARM conditional executionHow ARM and Thumb update CPSR flags, which condition codes exist, and how predicated instructions shrink Euclid's GCD compared with branch-heavy code.
  40. Feb 9, 2021/archiveARM Assembly 1ARM instruction layout, labels, AREA/ENTRY/END, BL-based subroutines, and switching between ARM and Thumb with CODE32/CODE16 and BX.
  41. Feb 9, 2021/archiveARM architecture overviewCISC vs RISC tradeoffs, the seven classic ARM processor modes, CPSR mode bits, and how Thumb state differs from ARM state.
  42. Jan 3, 2021/archiveTEB (Thread Environment Block)Windows TEB layout, how NtCurrentTeb and FS:[0x18]/0x30]/0] resolve TEB, PEB, and SEH, and how the FS segment selector indexes the descriptor table.
  43. Jan 3, 2021/archiveWindows SEH (Structured Exception Handling)How Windows SEH chains work, how debuggers interact with exceptions, common NTSTATUS codes, and the TEB ExceptionList entry point.
  44. Jan 3, 2021/archiveWindows SEH chain and TEB ExceptionListHow Windows builds the per-thread SEH singly-linked list on the stack, how FS:[0] and the TEB point at it, and how to walk the chain in WinDbg.
  45. Jan 3, 2021/archiveWindows PEB (Process Environment Block)How user-mode code reaches the PEB via FS:[30], what BeingDebugged / ImageBaseAddress / Ldr / ProcessHeap expose, and how module lists hang off PEB_LDR_DATA.
  46. Jan 3, 2021/archiveTLS (Thread Local Storage) CallbacksHow Windows PE TLS directories and IMAGE_TLS_CALLBACK hooks run before the entry point, and why reverse engineers care for anti-debugging.
  47. Dec 20, 2020/archiveWindows GUI binary fuzzer (dumb fuzzing)Notes on a PyQt dumb fuzzer for Windows PE binaries: install path for PaiMei/pydbg on Python 2.7, CLI flags, and GUI blueprint screenshots.
  48. Dec 20, 2020/articleSQLite3 fts3_tokenizer() Remote Code Execution ResearchHow a PHP sandbox with disabled system functions can still fall to RCE via SQLite3 fts3_tokenizer: leak the module base, hijack tokenizer callbacks, pivot the stack, and call system on both x86 and x86_64.
  49. Sep 18, 2020/articleSSTF 2020 t_express WriteupHeap note on t_express: off-by-one ticket_type overwrite, negative index stderr leak, tcache key forge for double free, then __free_hook to system.
  50. Sep 18, 2020/articleDEF CON 2016 xkcd writeupStatically linked xkcd challenge: a heartbeat-style reply buffer sits 0x200 bytes before the flag in .bss, so an overstated length turns strlen into an out-of-bounds read.
  51. Sep 18, 2020/articleDEF CON 2016 feedme Vulnerability AnalysisWriteup for DEF CON 2016 feedme: fork-stable canary brute-force across child processes, then a static-binary ROP chain to read /bin/sh into .bss and execve.
  52. Aug 16, 2020/articleHITCON 2017 Sakura writeupHITCON 2017 Sakura: 400 bytes of input feed a huge sub_850 checker; angr finds satisfying paths by locating the shared false-store pattern and exploring every third true branch.
  53. Aug 16, 2020/archiveELF Analysis ToolsPractical notes on objdump, strace, ltrace, and readelf for inspecting ELF sections, symbols, syscalls, and dynamic linking.
  54. Aug 16, 2020/archiveELF program headersHow ELF program headers describe loadable segments — PT_LOAD, PT_DYNAMIC, PT_NOTE, PT_INTERP, PT_PHDR — and what readelf -l shows for text versus data.
  55. Aug 16, 2020/archiveELF file formatELF object types (NONE, REL, EXEC, DYN, CORE) and the ELF header fields that describe entry point, program headers, and section headers.
  56. Aug 16, 2020/archiveDevice Files Useful for ELF AnalysisProcfs and boot artifacts that help map process and kernel memory when reversing ELF binaries: maps, kcore, System.map, kallsyms, and iomem.
  57. Aug 16, 2020/archiveLinux Linker Environment VariablesNotes on LD_PRELOAD, LD_SHOW_AUXV, and how linker scripts shape ELF section and segment layout.
  58. Aug 15, 2020/archiveFixing Python locale errors in Docker UbuntuHow to clear locale.Error: unsupported locale setting in an Ubuntu Docker container so pip install works again.
  59. Aug 15, 2020/articleCodeGate 2017 angrybird writeupCodeGate 2017 angrybird: patch early exits and canary-related checks, then use angr from 0x4007c2 to recover the 20-byte input that reaches the final printf.
  60. Aug 14, 2020/articleUsing angr for Binary Analysis, Part 3Walkthrough of the fauxware sample with angr: find the accept path, avoid the reject branch, and recover inputs from forked simulation states.
  61. Aug 14, 2020/archiveangr binary analysis notes 2: the loaderCLE loader internals in angr: loaded objects, symbols and relocations, load options, backends, SimProcedure summaries, and hooking.
  62. Aug 14, 2020/archiveUsing angr for Binary Analysis, Part 1A working tour of angr's Project, CLE loader, factory helpers, SimState, simulation managers, analyses, and explore/find paths.
  63. Jun 9, 2020/archiveGDB cheat sheetA compact GDB reference: startup, help, breakpoints, stack frames, source navigation, print/x examine formats, and register stepping.
  64. Jun 6, 2020/archiveHow to Install the Burp Suite CA CertificateSet Chrome to use Burp Suite as a proxy and install Burp's CA certificate as a trusted root so HTTPS interception works without certificate warnings.
  65. Jun 5, 2020/archiveMetasploit architecture and filesystem layoutWhere Metasploit lives on Kali, what each top-level directory holds, and how modules, plugins, scripts, and tools fit together.
  66. Jun 5, 2020/archiveMetasploit Lab SetupHardware baselines and lab layout for running Metasploit against Metasploitable and Windows VMs without exposing them to the public internet.
  67. Jun 2, 2020/archiveWindows PE File FormatWalkthrough of the Portable Executable layout using calc.exe: DOS header, NT headers, optional header fields, data directories, and section characteristics.
  68. Jun 1, 2020/archiveVulnerabilities and exploits — a field taxonomyWorking definitions of vulnerability and exploit, memory-corruption bug classes with small unsafe-pattern examples, and the local vs remote exploit distinction.
  69. May 29, 2020/archiveLua language notesA compact field guide to Lua syntax: comments, variables, control flow, functions, tables, metatables, class-like patterns, and modules.

graphfeed